anchor.diff:  [%collapsible]
   ====
   The following delete by query API request deletes documents in the `logs` data
  -stream with a `user.id` of `zVZMamUM`.
  -
  -////
  -[source,console]
  -----
  -PUT /logs/_create/1?refresh=wait_for
  -{
  -  "@timestamp": "2020-12-07T11:06:07.000Z",
  -  "user": {
  -    "id": "zVZMamUM"
  -  }
  -}
  -----
  -// TEST[continued]
  -////
  +stream with a `user.id` of `vlb44hny`.
   
   [source,console]
   ----
  
positive.code:   "message": "Login successful"
  }
  ----
  // TEST[continued]
  ====
  
  IMPORTANT: You cannot add new documents to a data stream using the index API's
  
negative.code: ----
  POST /logs/_rollover/
  ----
  ====
  
  [discrete]
  