anchor.diff:  [[auditing]]
   == Auditing Security Events
   
  -You can enable auditing to keep track of security-related events such as 
  +You can enable auditing to keep track of security-related events such as
   authentication failures and refused connections. Logging these events enables you
   to monitor your cluster for suspicious activity and provides evidence in the
   event of an attack.
   
   [IMPORTANT]
   ============================================================================
  -Audit logs are **disabled** by default. To enable this functionality, you 
  +Audit logs are **disabled** by default. To enable this functionality, you
   must set `xpack.security.audit.enabled` to `true` in `elasticsearch.yml`.
   ============================================================================
   
  -{Security} provides two ways to persist audit logs: 
  +{Security} provides two ways to persist audit logs:
   
   * The <<audit-log-output, `logfile`>> output, which persists events to
     a dedicated `<clustername>_access.log` file on the host's file system.
  
positive.code: [[audit-index]]
  === Index Audit Output
  
  In addition to logging to a file, you can store audit logs in Elasticsearch 
  rolling indices. These indices can be either on the same cluster, or on a 
  remote cluster. You configure the following settings in  
  `elasticsearch.yml` to control how audit entries are indexed. To enable
  this output, you need to configure the setting `xpack.security.audit.outputs`
  in the `elasticsearch.yml` file:
  
negative.code:                                           authentication token. `<realm>` represents the
                                            realm type.
  | `access_denied`                   | | | Logged when an authenticated user attempts to execute
                                            an action they do not have the necessary
                                            <<security-reference, privilege>> to perform.
  | `access_granted`                  | | | Logged when an authenticated user attempts to execute
                                            an action they have the necessary privilege to perform.
  