anchor.diff:    """
   }
   ----
  -====
   
   [discrete]
   [[eql-search-specify-timestamp-field]]
  
positive.code:   """
  }
  ----
  ====
  
negative.code: Many query languages allow you to match single events. However, EQL's
  <<eql-sequences,sequence syntax>> lets you match an ordered series of events.
  
  The following EQL search request matches a sequence that:
  
  . Starts with an event with:
  