anchor.diff:  === Run an EQL search
   
   Use the <<eql-search-api,EQL search API>> to run a <<eql-basic-syntax,basic EQL
  -query>>. If the {es} {security-features} are enabled, you must have the `read`
  -<<privileges-list-indices,index privilege>> for the target data stream, index,
  -or index alias.
  +query>>.
   
   ////
   [source,console]
  
positive.code: 
  To check the progress of an async search, use the <<get-async-eql-search-api,get
  async EQL search API>> with the search ID. Specify how long you'd like for
  complete results in the `wait_for_completion_timeout` parameter. If the {es}
  {security-features} are enabled, only the user who first submitted the EQL
  search can retrieve the search using this API.
  
  [source,console]
  ----
  GET /_eql/search/FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=?wait_for_completion_timeout=2s
  
negative.code: 
  Use the <<delete-async-eql-search-api,delete async EQL search API>> to
  manually delete an async EQL search before the `keep_alive` period ends. If the
  search is still ongoing, {es} cancels the search request.
  
  [source,console]
  ----
  