anchor.diff:  [source,yaml]
   ----------------------------------
   output.elasticsearch:
  +  # Array of hosts to connect to.
     hosts: ["http://es-mon-1:9200", "http://es-mon2:9200"] <1>
  +  
  +  # Optional protocol and basic auth credentials.
  +  #protocol: "https"
  +  #username: "elastic"
  +  #password: "changeme"  
   ----------------------------------
   <1> In this example, the data is stored on a monitoring cluster with nodes 
  -`es-mon-1` and `es-mon-2`. 
  +`es-mon-1` and `es-mon-2`.
  +
  +If you configured the monitoring cluster to use encrypted communications, you
  +must access it via HTTPS. For example, use a `hosts` setting like
  +`https://es-mon-1:9200`.
   
   IMPORTANT: The {es} {monitor-features} use ingest pipelines, therefore the
   cluster that stores the monitoring data must have at least one 
   <<ingest,ingest node>>. 
   
  +If {es} {security-features} are enabled on the monitoring cluster, you 
  +must provide a valid user ID and password so that {metricbeat} can send metrics 
  +successfully. 
  +
  +.. Create a user on the monitoring cluster that has the 
  +{stack-ov}/built-in-roles.html[`remote_monitoring_agent` built-in role]. 
  +Alternatively, use the 
  +{stack-ov}/built-in-users.html[`remote_monitoring_user` built-in user].
  +
  +.. Add the `username` and `password` settings to the {es} output information in 
  +the {metricbeat} configuration file.
  +
   For more information about these configuration options, see 
   {metricbeat-ref}/elasticsearch-output.html[Configure the {es} output].
   --
   
  -.. If {es} {security-features} are enabled on the monitoring cluster, you 
  -must provide a valid user ID and password so that {metricbeat} can send metrics 
  -successfully. 
  +. <<starting-elasticsearch,Start {es}>> on each node.
   
  -... Create a user on the monitoring cluster that has the 
  -{stack-ov}/built-in-roles.html[`remote_monitoring_agent` built-in role]. 
  -Alternatively, use the 
  -{stack-ov}/built-in-users.html[`remote_monitoring_user` built-in user].
  -
  -... Add the `username` and `password` settings to the {es} output information in 
  -the {metricbeat} configuration file (`metricbeat.yml`):
  -+
  ---
  -[source,yaml]
  -----------------------------------
  -output.elasticsearch:
  -  ...
  -  username: remote_monitoring_user
  -  password: YOUR_PASSWORD
  -----------------------------------
  ---
  -
  -.. If you configured the monitoring cluster to use 
  -<<configuring-tls,encrypted communications>>, you must access it via 
  -HTTPS. For example, use a `hosts` setting like `https://es-mon-1:9200` in the 
  -`metricbeat.yml` file. 
  -
  -. <<starting-elasticsearch,Start {es}>>.
  -
  -. {metricbeat-ref}/metricbeat-starting.html[Start {metricbeat}]. 
  +. {metricbeat-ref}/metricbeat-starting.html[Start {metricbeat}] on each node. 
   
   . {kibana-ref}/monitoring-data.html[View the monitoring data in {kib}]. 
  
positive.code:     - node_stats
      - shard
    period: 10s
    hosts: ["http://localhost:9200"] <1>
    xpack.enabled: true <2>
  ----------------------------------
  <1> This setting identifies the host and port number that are used to access {es}.
  <2> This setting ensures that {kib} can read this monitoring data successfully. 
  That is to say, it's stored in the same location and format as monitoring data 
  that is sent by <<es-monitoring-exporters,exporters>>. 
  --
  
  .. If Elastic {security-features} are enabled, you must also provide a user ID 
  and password so that {metricbeat} can collect metrics successfully. 
  
  ... Create a user on the production cluster that has the 
  {stack-ov}/built-in-roles.html[`remote_monitoring_collector` built-in role]. 
  Alternatively, use the {stack-ov}/built-in-users.html[`remote_monitoring_user` built-in user].
  
  ... Add the `username` and `password` settings to the {es} module configuration 
  file.
  +
  --
  For example, add the following settings in the `modules.d/elasticsearch.yml` file:
  
  [source,yaml]
  ----------------------------------
  - module: elasticsearch
    ...
    username: remote_monitoring_user
    password: YOUR_PASSWORD
  ----------------------------------
  --
  
  .. If you configured {es} to use <<configuring-tls,encrypted communications>>, 
  you must access it via HTTPS. For example, use a `hosts` setting like 
  `https://localhost:9200` in the `modules.d/elasticsearch.yml` file.
  
  .. Identify where to send the monitoring data. +
  +
  --
  TIP: In production environments, we strongly recommend using a separate cluster 
  
negative.code: Leave `xpack.monitoring.enabled` set to its default value (`true`). 
  --
  
  . {metricbeat-ref}/metricbeat-installation.html[Install {metricbeat}] on each
  {es} node in the production cluster.
  
  . Enable the {es} module in {metricbeat} on each {es} node. +
  +
  --
  // tag::enable-es-module[]
  For example, to enable the default configuration in the `modules.d` directory, 
  run the following command:
  
  