anchor.diff:  [[audit-index]]
   === Index Audit Output
   
  -In addition to logging to a file, you can store audit logs in Elasticsearch 
  -rolling indices. These indices can be either on the same cluster, or on a 
  -remote cluster. You configure the following settings in  
  +In addition to logging to a file, you can store audit logs in Elasticsearch
  +rolling indices. These indices can be either on the same cluster, or on a
  +remote cluster. You configure the following settings in
   `elasticsearch.yml` to control how audit entries are indexed. To enable
   this output, you need to configure the setting `xpack.security.audit.outputs`
   in the `elasticsearch.yml` file:
  
positive.code: |======
  
  You can pass additional settings to the remote client by specifying them in the
  `xpack.security.audit.index.client` namespace. For example, to allow the remote 
  client to discover all of the nodes in the remote cluster you can specify the
  `client.transport.sniff` setting:
  
  
negative.code:                       (request was received on the transport channel),
                        `local_node` (the local node issued the request).
  | `origin_address`  | The IP address from which the request originated.
  | `principal`       | The principal (username) that passed authentication.
  | `action`          | The name of the action that was executed.
  | `request`         | The type of request that was executed.
  | `indices`         | A comma-separated list of indices this request
  