anchor.diff:      "bucket_span": "60m",
       "detectors": [{
         "function": "mean",
  -      "field_name": "responsetime",
  -      "by_field_name": "airline"
  +      "field_name": "responsetime",  <1>
  +      "by_field_name": "airline"  <1>
       }],
       "summary_count_field_name": "doc_count"
     },
     "data_description": {
  -    "time_field":"time"
  +    "time_field":"time"  <1>
     }
   }
   ----------------------------------
   // TEST[skip:setup:farequote_data]
   
  -In this example, the `airline`, `responsetime`, and `time` fields are
  -aggregations.
  +<1> In this example, the `airline`, `responsetime`, and `time` fields are
  +aggregations. Only the aggregated fields defined in the `analysis_config` object 
  +are analyzed by the {anomaly-job}.
   
   NOTE: When the `summary_count_field_name` property is set to a non-null value,
   the job expects to receive aggregated input. The property must be set to the
  
positive.code:         "time_zone": "UTC"
        },
        "aggregations": {
          "time": {
            "max": {"field": "time"}
          },
          "airline": {
            "terms": {
              "field": "airline",
              "size": 100
            },
            "aggregations": {
              "responsetime": {
                "avg": {
                  "field": "responsetime"
                }
  
negative.code: The top level aggregation must be either a
  {ref}/search-aggregations-bucket.html[bucket aggregation] containing as single
  sub-aggregation that is a `date_histogram` or the top level aggregation is the
  required `date_histogram`. There must be exactly one `date_histogram`
  aggregation. For more information, see
  {ref}/search-aggregations-bucket-datehistogram-aggregation.html[Date histogram aggregation].
  
  NOTE: The `time_zone` parameter in the date histogram aggregation must be set to
  