anchor.diff:  
   [discrete]
   [[eql-required-fields]]
  -== Required fields
  +=== Required fields
   
   To run an EQL search, the searched data stream or index must contain a
   _timestamp_ and _event category_ field. By default, EQL uses the `@timestamp`
  
positive.code: 
  [discrete]
  [[eql-advantages]]
  == Advantages of EQL
  
  * *EQL lets you express relationships between events.* +
  Many query languages allow you to match single events. EQL lets you match a
  
negative.code: 
  [discrete]
  [[run-an-eql-search]]
  === Run an EQL search
  
  Use the <<eql-search-api,EQL search API>> to run a <<eql-basic-syntax,basic EQL
  query>>. If the {es} {security-features} are enabled, you must have the `read`
  