anchor.diff:  [%collapsible]
   ====
   The following update by query API request updates documents in the `logs` data
  -stream with a `user.id` of `i96BP1mA`. The request uses a
  +stream with a `user.id` of `l7gk7f82`. The request uses a
   <<modules-scripting-using,script>> to assign matching documents a new `user.id`
   value of `XgdX0NoX`.
   
  -////
  -[source,console]
  -----
  -PUT /logs/_create/2?refresh=wait_for
  -{
  -  "@timestamp": "2020-12-07T11:06:07.000Z",
  -  "user": {
  -    "id": "i96BP1mA"
  -  }
  -}
  -----
  -// TEST[continued]
  -////
  -
   [source,console]
   ----
   POST /logs/_update_by_query
   {
     "query": {
       "match": {
  -      "user.id": "i96BP1mA"
  +      "user.id": "l7gk7f82"
       }
     },
     "script": {
  
positive.code: [%collapsible]
  ====
  The following delete by query API request deletes documents in the `logs` data
  stream with a `user.id` of `zVZMamUM`.
  
  ////
  [source,console]
  ----
  PUT /logs/_create/1?refresh=wait_for
  {
    "@timestamp": "2020-12-07T11:06:07.000Z",
    "user": {
      "id": "zVZMamUM"
    }
  }
  ----
  // TEST[continued]
  ////
  
  [source,console]
  ----
  
negative.code: [source,console]
  ----
  PUT /logs/_bulk?refresh
  {"create":{ }}
  { "@timestamp": "2020-12-08T11:04:05.000Z", "user": { "id": "vlb44hny" }, "message": "Login attempt failed" }
  {"create":{ }}
  { "@timestamp": "2020-12-08T11:06:07.000Z", "user": { "id": "8a4f500d" }, "message": "Login successful" }
  {"create":{ }}
  { "@timestamp": "2020-12-09T11:07:08.000Z", "user": { "id": "l7gk7f82" }, "message": "Logout successful" }
  ----
  ====
  --
  
  