anchor.diff:        the respective indices permission entry.
   
   The specified `query` expects the same format as if it was defined in the
  -search request and supports ELasticsearch's full {ref}/query-dsl.html[Query DSL].
  -
  -For example, the following role grants read access to all indices, but restricts
  -access to documents whose `department_id` equals `12`.
  +search request and supports the full {es} {ref}/query-dsl.html[Query DSL].
  +
  +For example, the following role grants read access only to the documents whose
  +`department_id` equals `12`:
   
   [source,js]
   --------------------------------------------------
  
positive.code: 
  The following rules apply:
  
  Absence of "field_security" in a role is equivalent to * access.
  Denied fields may only be provided if permission has been granted explicitly to other fields. The exceptions given must be a subset of the
  fields that permissions have been granted to.
  Denied and granted fields defined implies access to all granted fields except those which match the pattern in denied fields. Example:
  
  
  [source,js]
  --------------------------------------------------
  
negative.code: [[set-security-user-processor]]
  ===== Set Security User Ingest Processor
  
  If an index is shared by many small users it makes sense to put all these users
  into the same index.  Having a dedicated index or shard per user is wasteful.
  To guarantee that a user reads only their own documents, it makes sense to set up
  document level security. In this scenario, each document must have the username
  or role name associated with it, so that this information can be used by the
  role query for document level security. This is a situation where the
  `set_security_user` ingest processor can help.
  
  NOTE: Document level security doesn't apply to write APIs. You must use unique
  ids for each user that uses the same index, otherwise they might overwrite other
  users' documents. The ingest processor just adds properties for the current
  authenticated user to the documents that are being indexed.
  
  The `set_security_user` processor attaches user-related details (such as
  `username`,  `roles`, `email`, `full_name` and `metadata` ) from the current
  authenticated user to the current document by pre-processing the ingest. When
  you index data with an ingest pipeline, user details are automatically attached
  to the document. For example:
  
  [source,js]
  --------------------------------------------------
  