anchor.diff:  Leave `xpack.monitoring.enabled` set to its default value (`true`). 
   --
   
  -. On each {es} node in the production cluster:
  +. {metricbeat-ref}/metricbeat-installation.html[Install {metricbeat}] on each
  +{es} node in the production cluster.
   
  -.. {metricbeat-ref}/metricbeat-installation.html[Install {metricbeat}].
  -
  -.. Enable the {es} module in {metricbeat}. +
  +. Enable the {es} {xpack} module in {metricbeat} on each {es} node. +
   +
   --
  +// tag::enable-es-module[]
   For example, to enable the default configuration in the `modules.d` directory, 
   run the following command:
   
  
positive.code: For more information, see 
  {metricbeat-ref}/configuration-metricbeat.html[Specify which modules to run] and 
  {metricbeat-ref}/metricbeat-module-elasticsearch.html[{es} module]. 
  --
  
  .. By default the module will collect {es} monitoring metrics from `http://localhost:9200`.
  If the local {es} node has a different address, you must specify it via the `hosts` setting
  in the `modules.d/elasticsearch-xpack.yml` file.
  
  .. If Elastic {security-features} are enabled, you must also provide a user ID
  and password so that {metricbeat} can collect metrics successfully. 
  
  ... Create a user on the production cluster that has the
  {stack-ov}/built-in-roles.html[`remote_monitoring_collector` built-in role]. 
  Alternatively, use the {stack-ov}/built-in-users.html[`remote_monitoring_user` built-in user].
  
  ... Add the `username` and `password` settings to the {es} module configuration
  file.
  +
  --
  For example, add the following settings in the `modules.d/elasticsearch-xpack.yml` file:
  
  [source,yaml]
  ----------------------------------
  - module: elasticsearch
    ...
    username: remote_monitoring_user
    password: YOUR_PASSWORD
  ----------------------------------
  --
  
  .. If you configured {es} to use <<configuring-tls,encrypted communications>>, 
  you must access it via HTTPS. For example, use a `hosts` setting like 
  `https://localhost:9200` in the `modules.d/elasticsearch-xpack.yml` file.
  
  .. Identify where to send the monitoring data. +
  +
  --
  TIP: In production environments, we strongly recommend using a separate cluster 
  
negative.code: 
  To learn about monitoring in general, see 
  {stack-ov}/xpack-monitoring.html[Monitoring the {stack}]. 
  
  //NOTE: The tagged regions are re-used in the Stack Overview.
  
  . Enable the collection of monitoring data. Set 
  `xpack.monitoring.collection.enabled` to `true` on each node in the production 
  