anchor.diff:  xpack.security.audit.outputs: [ index, logfile ]
   ----------------------------
   
  -.Audit Log Indexing Configuration
  -[options="header"]
  -|======
  -| Attribute                           | Default Setting | Description
  -| `xpack.security.audit.index.bulk_size`      | `1000`          | Controls how many audit events are batched into a single write.
  -| `xpack.security.audit.index.flush_interval` | `1s`            | Controls how often buffered events are flushed to the index.
  -| `xpack.security.audit.index.rollover`       | `daily`         | Controls how often to roll over to a new index:
  -                                                                  `hourly`, `daily`, `weekly`, or `monthly`.
  -| `xpack.security.audit.index.events.include` | `anonymous_access_denied`, `authentication_failed`, `realm_authentication_failed`, `access_granted`, `access_denied`, `tampered_request`, `connection_granted`, `connection_denied`, `run_as_granted`, `run_as_denied` | The audit events to be indexed. See <<audit-event-types, Audit Entry Types>> for the complete list.
  -| `xpack.security.audit.index.events.exclude` |  | The audit events to exclude from indexing.
  -| `xpack.security.audit.index.events.emit_request_body`| false   | Include or exclude the request body from REST requests
  -                                                                   on certain event types such as `authentication_failed`.
  -|======
  +For more configuration options, see
  +{ref}/auditing-settings.html#index-audit-settings[Audit Log Indexing Configuration Settings].
   
   IMPORTANT: No filtering is performed when auditing, so sensitive data may be
   audited in plain text when including the request body in audit events.
  
positive.code: `<local_node_info>` ::      Information about the local node that generated
                              the log entry. You can control what node information
                              is included by configuring the
                              <<audit-log-entry-local-node-info, local node info settings>>.
  `<layer>`           ::      The layer from which this event originated:
                              `rest`, `transport` or `ip_filter`.
  `<entry_type>`      ::       The type of event that occurred: `anonymous_access_denied`,
  
negative.code: === Logfile Output Settings
  
  The events and some other information about what gets logged can be
  controlled using settings in the `elasticsearch.yml` file. See
  {ref}/auditing-settings.html#event-audit-settings[Audited Event Settings] and
  {ref}/auditing-settings.html#node-audit-settings[Local Node Info Settings].
  
  IMPORTANT: No filtering is performed when auditing, so sensitive data may be
  audited in plain text when including the request body in audit events.
  
  [[logging-file]]
  You can also configure how the logfile is written in the `log4j2.properties`
  