anchor.diff:  
   [source,eql]
   ----
  -my_field == null
  -----
  -
  -IMPORTANT: To avoid errors, the field must contain a non-`null` value in at
  -least one document or be <<explicit-mapping,explicitly mapped>>.
  +?my_field == null
  +----
   
   [discrete]
   [[eql-syntax-strings]]
  
positive.code: ----
  
  [discrete]
  [[eql-syntax-check-field-exists]]
  ==== Check if a field exists
  
  
negative.code: [source,eql]
  ----
  sequence by user.name with maxspan=15m
    [ file where file.extension == "exe" ]
    [ process where true ]
  ----
  
  [discrete]
  [[eql-syntax-optional-by-fields]]
  ==== Optional `by` fields
  
  By default, a join key must be a non-`null` field value. To allow `null` join
  keys, use the `?` operator to mark the `by` field as
  <<eql-syntax-optional-fields,optional>>. This is also helpful if you aren't sure
  the dataset you're searching contains the `by` field.
  
  *Example* +
  The following sequence query uses `sequence by` to constrain matching events
  to:
  
  * Events with the same `process.pid` value, excluding `null` values. If the
    `process.pid` field doesn't exist in the dataset you're searching, the query
    returns an error.
  
  * Events with the same `process.entity_id` value, including `null` values. If
    an event doesn't contain the `process.entity_id` field, its
    `process.entity_id` value is considered `null`. This applies even if the
    `process.pid` field doesn't exist in the dataset you're searching.
  
  [source,eql]
  ----
  sequence by process.pid, ?process.entity_id
    [process where process.name == "regsvr32.exe"]
    [network where true]
  ----
  
  [discrete]
  