anchor.diff:  
   [[xpack-sa-lf-events-ignore-indices]]
   // tag::xpack-sa-lf-events-ignore-indices-tag[]
  -`xpack.security.audit.logfile.events.ignore_filters.<policy_name>.indices` {ess-icon}::
  +`xpack.security.audit.logfile.events.ignore_filters.<policy_name>.indices`::
   A list of index names or wildcards. The specified policy will
   not print audit events when all the indices in the event match
   these values. If the event concerns several indices, some of which are
  
positive.code: 
  [[xpack-sa-lf-emit-node-name]]
  // tag::xpack-sa-lf-emit-node-name-tag[]
  `xpack.security.audit.logfile.emit_node_name` {ess-icon}::
  Specifies whether to include the <<node.name,node name>> as a field in
  each audit event. The default value is `false`.
  // end::xpack-sa-lf-emit-node-name-tag[]
  
  [[xpack-sa-lf-emit-node-host-address]]
  // tag::xpack-sa-lf-emit-node-host-address-tag[]
  `xpack.security.audit.logfile.emit_node_host_address` {ess-icon}::
  Specifies whether to include the node's IP address as a field in each audit event.
  The default value is `false`.
  // end::xpack-sa-lf-emit-node-host-address-tag[]
  
  [[xpack-sa-lf-emit-node-host-name]]
  // tag::xpack-sa-lf-emit-node-host-name-tag[]
  `xpack.security.audit.logfile.emit_node_host_name` {ess-icon}::
  Specifies whether to include the node's host name as a field in each audit event.
  The default value is `false`.
  // end::xpack-sa-lf-emit-node-host-name-tag[]
  
  [[xpack-sa-lf-emit-node-id]]
  // tag::xpack-sa-lf-emit-node-id-tag[]
  `xpack.security.audit.logfile.emit_node_id` {ess-icon}::
  Specifies whether to include the node id as a field in each audit event.
  This is available for the new format only. That is to say, this information
  does not exist in the `<clustername>_access.log` file.
  
negative.code: 
  [[xpack-sa-lf-events-include]]
  // tag::xpack-sa-lf-events-include-tag[]
  `xpack.security.audit.logfile.events.include`::
  Specifies which events to include in the auditing output. The default value is:
  `access_denied, access_granted, anonymous_access_denied, authentication_failed,
  connection_denied, tampered_request, run_as_denied, run_as_granted`.
  