anchor.diff:  
   [[xpack-sa-lf-events-include]]
   // tag::xpack-sa-lf-events-include-tag[]
  -`xpack.security.audit.logfile.events.include` {ess-icon}::
  +`xpack.security.audit.logfile.events.include`::
   Specifies which events to include in the auditing output. The default value is:
   `access_denied, access_granted, anonymous_access_denied, authentication_failed,
   connection_denied, tampered_request, run_as_denied, run_as_granted`.
  
positive.code: 
  [[xpack-sa-lf-events-exclude]]
  // tag::xpack-sa-lf-events-exclude-tag[]
  `xpack.security.audit.logfile.events.exclude` {ess-icon}::
  Excludes the specified events from the output. By default, no events are
  excluded.
  // end::xpack-sa-lf-events-exclude-tag[]
  
  [[xpack-sa-lf-events-emit-request]]
  // tag::xpack-sa-lf-events-emit-request-tag[]
  `xpack.security.audit.logfile.events.emit_request_body` {ess-icon}::
  Specifies whether to include the request body from REST requests on certain
  event types such as `authentication_failed`. The default value is `false`.
  +
  
negative.code: 
  [[xpack-sa-lf-events-ignore-users]]
  // tag::xpack-sa-lf-events-ignore-users-tag[]
  `xpack.security.audit.logfile.events.ignore_filters.<policy_name>.users`::
  A list of user names or wildcards. The specified policy will
  not print audit events for users matching these values.
  // end::xpack-sa-lf-events-ignore-users-tag[]
  
  [[xpack-sa-lf-events-ignore-realms]]
  // tag::xpack-sa-lf-events-ignore-realms-tag[]
  `xpack.security.audit.logfile.events.ignore_filters.<policy_name>.realms`::
  A list of authentication realm names or wildcards. The specified policy will
  not print audit events for users in these realms.
  // end::xpack-sa-lf-events-ignore-realms-tag[]
  
  [[xpack-sa-lf-events-ignore-roles]]
  // tag::xpack-sa-lf-events-ignore-roles-tag[]
  `xpack.security.audit.logfile.events.ignore_filters.<policy_name>.roles`::
  A list of role names or wildcards. The specified policy will
  not print audit events for users that have these roles. If the user has several
  roles, some of which are *not* covered by the policy, the policy will
  