anchor.diff:  (Optional, integer or float)
   Maximum number of matching events to return. Defaults to `50`. Values must be
   greater than `0`.
  +
  +[[eql-search-api-timestamp-field]]
  +`timestamp_field`::
  ++
  +--
  +(Required*, string)
  +Field containing event timestamp.
  +
  +Defaults to `@timestamp`, as defined in the
  +{ecs-ref}/ecs-event.html[Elastic Common Schema (ECS)]. If an index does not
  +contain the `@timestamp` field, this value is required.
  +
  +Events in the API response are sorted by this field's value, converted to
  +milliseconds since the https://en.wikipedia.org/wiki/Unix_time[Unix epoch], in
  +ascending order.
  +--
   
   [role="child_attributes"]
   [[eql-search-api-response-body]]
  
positive.code: Common Schema (ECS)]. If an index does not contain the `event.category` field,
  this value is required.
  
  [[eql-search-api-timestamp-field]]
  `timestamp_field`::
  +
  --
  (Required*, string)
  Field containing event timestamp.
  
  Defaults to `@timestamp`, as defined in the
  {ecs-ref}/ecs-event.html[Elastic Common Schema (ECS)]. If an index does not
  contain the `@timestamp` field, this value is required.
  
  Events in the API response are sorted by this field's value, converted to
  milliseconds since the https://en.wikipedia.org/wiki/Unix_time[Unix epoch], in
  ascending order.
  --
  
  `implicit_join_key_field`::
  (Optional, string)
  Reserved for future use.
  
  `filter`::
  (Optional, <<query-dsl,query DSL object>>)
  Query, written in query DSL, used to filter the events on which the EQL query
  runs.
  
  `search_after`::
  (Optional, string)
  Reserved for future use.
  
negative.code: [[eql-search-api-request-body]]
  ==== {api-request-body-title}
  
  `event_category_field`::
  (Required*, string)
  Field containing the event classification, such as `process`, `file`, or
  