anchor.diff:  
   Each histogram bucket has a key, which is the bucket start time. This key cannot
   be used for aggregations in {dfeeds}, however, because they need to know the
  -time of the latest record within a bucket. Otherwise, when you restart a {dfeed},
  -it continues from the start time of the histogram bucket and possibly fetches
  -the same data twice. The max aggregation for the time field is therefore
  +time of the latest record within a bucket. Otherwise, when you restart a 
  +{dfeed}, it continues from the start time of the histogram bucket and possibly 
  +fetches the same data twice. The max aggregation for the time field is therefore
   necessary to provide the time of the latest record within a bucket.
   
   You can optionally specify a terms aggregation, which creates buckets for
  
positive.code: TIP: If you use a terms aggregation and the cardinality of a term is high, the
  aggregation might not be effective and you might want to just use the default
  search and scroll behavior.
  
  There are some limitations to using aggregations in {dfeeds}. Your aggregation
  must include a `date_histogram` aggregation, which in turn must contain a `max`
  
negative.code: By default, {es} limits the maximum number of terms returned to 10000. For high
  cardinality fields, the query might not run. It might return errors related to
  circuit breaking exceptions that indicate that the data is too large. In such
  cases, do not use aggregations in your {dfeed}. For more information, see
  {ref}/search-aggregations-bucket-terms-aggregation.html[Terms aggregation].
  
  You can also optionally specify multiple sub-aggregations. The sub-aggregations
  