anchor.diff:              "path": "C:\\Windows\\System32\\cmd.exe"
             }
           },
  +        "fields": {
  +          "@timestamp": [
  +            "1607339167000"
  +          ]
  +        },
           "sort": [
             1607339167000,                                <1>
             "cMyt5SZ2"                                    <2>
  
positive.code:             "path": "C:\\Windows\\System32\\cmd.exe"
            }
          },
          "sort": [
            1607339167000
          ],
          "fields": {
            "@timestamp": [
              "1607339167000"
            ]
          }
        }
      ]
    }
  
negative.code:             "path": "C:\\Windows\\System32\\cmd.exe"
            }
          },
          "fields": {
            "@timestamp": [
              "1607252645000"
            ]
          },
          "sort": [
            1607252645000,                                <1>
            "edwCRnyD"                                    <2>
            ]
          },
              {
          "_index": "sec_logs",
          "_id": "3",
  