anchor.diff:  
   [source,console]
   ----------------------------------
  -POST _transform/_preview
  +PUT _transform/suspicious_client_ips
   {
     "source": {
  -    "index": "kibana_sample_data_logs",
  -    "query": { <1>
  -      "range" : {
  -        "timestamp" : {
  -          "gte" : "now-30d/d"
  -        }
  -      }
  -    }
  -  },
  -  "dest" : { <2>
  +    "index": "kibana_sample_data_logs"
  +  },
  +  "dest" : { <1>
       "index" : "sample_weblogs_by_clientip"
  -  },  
  +  },
  +  "sync" : { <2>
  +    "time": {
  +      "field": "timestamp",
  +      "delay": "60s"
  +    }
  +  },
     "pivot": {
       "group_by": {  <3>
         "clientip": { "terms": { "field": "clientip" } }
  
positive.code: ----------------------------------
  // TEST[skip:setup kibana sample data]
  
  <1> This range query limits the {transform} to documents that are within the 
  last 30 days at the point in time the {transform} checkpoint is processed. For 
  batch {transforms} this occurs once.
  <2> This is the destination index for the {dataframe}. It is ignored by 
  `_preview`.
  <3> The data is grouped by the `clientip` field. 
  <4> This `scripted_metric` performs a distributed operation on the web log data 
  to count specific types of HTTP responses (error, success, and other).
  <5> This `bucket_script` calculates the duration of the `clientip` access based 
  on the results of the aggregation.
  
  The preview shows you that the new index would contain data like this for each 
  client IP:
  
  [source,js]
  ----------------------------------
  {
    "preview" : [
      {
        "geo" : {
          "src_dc" : 12.0,
          "dest_dc" : 9.0
        },
        "clientip" : "0.72.176.46",
        "agent_dc" : 3.0,
        "responses" : {
          "total" : 14.0,
          "counts" : {
            "other" : 0,
            "success" : 14,
            "error" : 0
          }
        },
        "bytes_sum" : 74808.0,
        "timestamp" : {
          "duration_ms" : 4.919943239E9,
          "min" : "2019-06-17T07:51:57.333Z",
          "max" : "2019-08-13T06:31:00.572Z"
        },
        "url_dc" : 11.0
      },
      ...
    }
  ----------------------------------  
  // NOTCONSOLE
  
  This {dataframe} makes it easier to answer questions such as:
  
  * Which client IPs are transferring the most amounts of data?
  
  * Which client IPs are interacting with a high number of different URLs?
    
  * Which client IPs have high error rates?
    
  * Which client IPs are interacting with a high number of destination countries?
  
negative.code: ----------------------------------
  // NOTCONSOLE
  
  This {transform} makes it easier to answer questions such as:
  
  * Which customers spend the most?
  
  