anchor.diff:  metricbeat modules enable elasticsearch-xpack
   ----------------------------------------------------------------------
   
  -For more information, see 
  -{metricbeat-ref}/configuration-metricbeat.html[Specify which modules to run] and 
  -{metricbeat-ref}/metricbeat-module-elasticsearch.html[{es} module]. 
  -
  -// end::enable-es-module[]
  +Alternatively, you can use the {es} module, as described in the
  +{metricbeat-ref}/metricbeat-module-elasticsearch.html[{es} module usage for {stack} monitoring]. 
   --
   
  -. Configure the {es} {xpack} module in {metricbeat} on each {es} node. +
  +. Configure the {es} {xpack} module in {metricbeat} on each {es} node.
   +
   --
  -// tag::configure-es-module[]
   The `modules.d/elasticsearch-xpack.yml` file contains the following settings:
   
   [source,yaml]
   ----------------------------------
     - module: elasticsearch
  -    metricsets:
  -      - ccr
  -      - cluster_stats
  -      - index
  -      - index_recovery
  -      - index_summary
  -      - ml_job
  -      - node_stats
  -      - shard
  -      - enrich
  +    xpack.enabled: true
       period: 10s
  -    hosts: ["http://localhost:9200"]
  +    hosts: ["http://localhost:9200"] <1>
  +    #scope: node <2>
       #username: "user"
       #password: "secret"
  -    xpack.enabled: true
   ----------------------------------
  -
  -By default, the module collects {es} monitoring metrics from
  +<1> By default, the module collects {es} monitoring metrics from
   `http://localhost:9200`. If that host and port number are not correct, you must
   update the `hosts` setting. If you configured {es} to use encrypted
   communications, you must access it via HTTPS. For example, use a `hosts` setting
   like `https://localhost:9200`.
  -// end::configure-es-module[]
  +<2> By default, `scope` is set to `node` and each entry in the `hosts` list
  +indicates a distinct node in an {es} cluster. If you set `scope` to `cluster`,
  +each entry in the `hosts` list indicates a single endpoint for a distinct {es}
  +cluster (for example, a load-balancing proxy fronting the cluster).
   
  -// tag::remote-monitoring-user[]
   If Elastic {security-features} are enabled, you must also provide a user ID
   and password so that {metricbeat} can collect metrics successfully: 
   
  
positive.code: 
  .. Add the `username` and `password` settings to the {es} module configuration
  file. 
  // end::remote-monitoring-user[]
  --
  
  . Optional: Disable the system module in {metricbeat}.
  +
  --
  // tag::disable-system-module[]
  By default, the {metricbeat-ref}/metricbeat-module-system.html[system module] is
  enabled. The information it collects, however, is not shown on the *Monitoring*
  page in {kib}. Unless you want to use that information for other purposes, run
  
negative.code: If {es} {security-features} are enabled, you must have `monitor` cluster
  privileges to  view the cluster settings and `manage` cluster privileges
  to change them.
  --
  
  . {kibana-ref}/monitoring-data.html[View the monitoring data in {kib}]. 
  