anchor.diff:  
   
   [[example-clientips]]
  -==== Finding suspicious client IPs by using scripted metrics
  -
  -With {transforms}, you can use 
  -{ref}/search-aggregations-metrics-scripted-metric-aggregation.html[scripted 
  -metric aggregations] on your data. These aggregations are flexible and make 
  -it possible to perform very complex processing. Let's use scripted metrics to 
  -identify suspicious client IPs in the web log sample dataset.
  -
  -We transform the data such that the new index contains the sum of bytes and the 
  -number of distinct URLs, agents, incoming requests by location, and geographic 
  -destinations for each client IP. We also use a scripted field to count the 
  -specific types of HTTP responses that each client IP receives. Ultimately, the 
  -example below transforms web log data into an entity centric index where the 
  -entity is `clientip`.
  +==== Finding suspicious client IPs
  +
  +In this example, we use the web log sample dataset to identify suspicious client 
  +IPs. We transform the data such that the new index contains the sum of bytes and 
  +the number of distinct URLs, agents, incoming requests by location, and 
  +geographic destinations for each client IP. We also use filter aggregations to 
  +count the specific types of HTTP responses that each client IP receives. 
  +Ultimately, the example below transforms web log data into an entity centric 
  +index where the entity is `clientip`.
   
   [source,console]
   ----------------------------------
  
positive.code: to synchronize the source and destination indices. The worst case
  ingestion delay is 60 seconds.
  <3> The data is grouped by the `clientip` field.
  <4> This `scripted_metric` performs a distributed operation on the web log data
  to count specific types of HTTP responses (error, success, and other).
  <5> This `bucket_script` calculates the duration of the `clientip` access based
  on the results of the aggregation.
  
  After you create the {transform}, you must start it:
  
  [source,console]
  
negative.code: GET sample_weblogs_by_clientip/_search
  ----------------------------------
  // TEST[skip:setup kibana sample data]
  
  
  The search result shows you data like this for each client IP:
  
  