anchor.diff:              "path": "C:\\Windows\\System32\\cmd.exe"
             }
           },
  -        "sort": [
  -          1607252645000
  -        ],
           "fields": {
             "@timestamp": [
               "1607252645000"
             ]
  -        }
  +        },        
  +        "sort": [
  +          1607252645000
  +        ]
         },
         {
           "_index": "sec_logs",
  
positive.code:             "path": "C:\\Windows\\System32\\cmd.exe"
            }
          },
          "sort": [
            1607339167000,                                <1>
            "cMyt5SZ2"                                    <2>
  
negative.code:             "path": "C:\\Windows\\System32\\cmd.exe"
            }
          },
          "fields": {
            "@timestamp": [
              "1607252645000"
            ]
          },
          "sort": [
            1607252645000,                                <1>
            "edwCRnyD"                                    <2>
            ]
          },
              {
          "_index": "sec_logs",
          "_id": "3",
  