anchor.diff:  [[eql-by-keyword]]
   ==== `by` keyword
   
  -You can use the `by` keyword with sequences to only match events that share the
  -same field values. If a field value should be shared across all events, you
  -can use `sequence by`.
  +Use the `by` keyword in a sequence query to only match events that share the
  +same values, even if those values are in different fields. These shared values
  +are called join keys. If a join key should be in the same field across all
  +events, use `sequence by`.
   
   [source,eql]
   ----
  
positive.code: [source,eql]
  ----
  sequence by field_foo with maxspan=30s
    [ event_category_1 where condition_1 ] by field_baz
    [ event_category_2 where condition_2 ] by field_bar
    ...
  ----
  
  
negative.code: ----
  
  The `runs` value must be between `1` and `100` (inclusive).
  
  You can use a `with runs` statement with the <<eql-by-keyword,`by` keyword>>.
  For example:
  
  