anchor.diff:  [[xpack-sa-lf-emit-node-name]]
   // tag::xpack-sa-lf-emit-node-name-tag[]
   `xpack.security.audit.logfile.emit_node_name`::
  +(<<dynamic-cluster-setting,Dynamic>>)
   Specifies whether to include the <<node.name,node name>> as a field in
   each audit event. The default value is `false`.
   // end::xpack-sa-lf-emit-node-name-tag[]
  
positive.code: [[xpack-sa-lf-events-emit-request]]
  // tag::xpack-sa-lf-events-emit-request-tag[]
  `xpack.security.audit.logfile.events.emit_request_body`::
  Specifies whether to include the request body from REST requests on certain
  event types such as `authentication_failed`. The default value is `false`.
  +
  
negative.code: [[xpack-sa-lf-events-ignore-indices]]
  // tag::xpack-sa-lf-events-ignore-indices-tag[]
  `xpack.security.audit.logfile.events.ignore_filters.<policy_name>.indices`::
  (<<dynamic-cluster-setting,Dynamic>>)
  A list of index names or wildcards. The specified policy will
  not print audit events when all the indices in the event match
  these values. If the event concerns several indices, some of which are
  