anchor.diff:        "agent_dc": { "cardinality": { "field": "agent.keyword" }},
         "geo.dest_dc": { "cardinality": { "field": "geo.dest" }},
         "responses.total": { "value_count": { "field": "timestamp" }},
  -      "responses.counts": { <4>
  -        "scripted_metric": { 
  -          "init_script": "state.responses = ['error':0L,'success':0L,'other':0L]",
  -          "map_script": """
  -            def code = doc['response.keyword'].value;
  -            if (code.startsWith('5') || code.startsWith('4')) {
  -              state.responses.error += 1 ;
  -            } else if(code.startsWith('2')) {
  -              state.responses.success += 1;
  -            } else {
  -              state.responses.other += 1;
  -            }
  -            """,
  -          "combine_script": "state.responses",
  -          "reduce_script": """
  -            def counts = ['error': 0L, 'success': 0L, 'other': 0L];
  -            for (responses in states) {
  -              counts.error += responses['error'];
  -              counts.success += responses['success'];
  -              counts.other += responses['other'];
  -            }
  -            return counts;
  -            """
  -          }
  +      "success" : { <4>
  +         "filter": { 
  +            "term": { "response" : "200"}} 
  +        },
  +      "error404" : {
  +         "filter": { 
  +            "term": { "response" : "404"}}
  +        },
  +      "error503" : {
  +         "filter": { 
  +            "term": { "response" : "503"}}
           },
         "timestamp.min": { "min": { "field": "timestamp" }},
         "timestamp.max": { "max": { "field": "timestamp" }},
  
positive.code:             "src_dc" : 2.0,
              "dest_dc" : 2.0
            },
            "clientip" : "0.72.176.46",
            "agent_dc" : 2.0,
            "bytes_sum" : 4422.0,
            "responses" : {
              "total" : 2.0,
              "counts" : {
                "other" : 0,
                "success" : 2,
                "error" : 0
              }
            },
            "url_dc" : 2.0,
            "timestamp" : {
              "duration_ms" : 5.2191698E8,
              "min" : "2019-11-25T07:51:57.333Z",
              "max" : "2019-12-01T08:50:34.313Z"
            }
          }
        }
  
negative.code: POST _transform/suspicious_client_ips/_start
  ----------------------------------
  // TEST[skip:setup kibana sample data]
  
  
  Shortly thereafter, the first results should be available in the destination
  index:
  