anchor.diff:  }
   ----------------------------------
   // NOTCONSOLE
  +
  +
  +[discrete]
  +[[aggs-define-dfeeds]]
  +==== Defining aggregations in {dfeeds}
   
   When you define an aggregation in a {dfeed}, it must have the following form:
   
  
positive.code: ----------------------------------
  // NOTCONSOLE
  
  {dfeeds-cap} not only supports multi-bucket aggregations, but also single bucket
  aggregations. The following shows two `filter` aggregations, each gathering the
  number of unique entries for the `error` field.
  
negative.code: finer, more granular time buckets, which are ideal for this type of analysis. If
  your detectors use <<ml-count-functions,count>> or <<ml-rare-functions,rare>>
  functions, set the interval to the same value as the bucket span.
  
  
  [discrete]
  [[aggs-include-jobs]]
  ==== Including aggregations in {anomaly-jobs}
  
  When you create or update an {anomaly-job}, you can include the names of
  aggregations, for example:
  