anchor.diff:  
   [discrete]
   [[eql-required-fields]]
  -== Required fields
  +=== Required fields
   
   To run an EQL search, the searched data stream or index must contain a
   _timestamp_ and _event category_ field. By default, EQL uses the `@timestamp`
  
positive.code: 
  [discrete]
  [[retrieve-selected-fields]]
  == Retrieve selected fields
  
  By default, each hit in the search response includes the document `_source`,
  which is the entire JSON object that was provided when indexing the document.
  
negative.code: 
  [discrete]
  [[eql-advantages]]
  === Advantages of EQL
  
  * *EQL lets you express relationships between events.* +
  Many query languages allow you to match single events. EQL lets you match a
  