anchor.diff:  xpack.security.audit.outputs: [ index, logfile ]
   ----------------------------
   
  -The `index` output type should be used in conjunction with the `logfile` 
  +The `index` output type should be used in conjunction with the `logfile`
   output type Because it is possible for the `index` output type to lose
  -messages if the target index is unavailable, the `access.log` should be 
  +messages if the target index is unavailable, the `access.log` should be
   used as the official record of events.
   
  -NOTE: Audit events are batched for indexing so there is a lag before 
  -events appear in the index. You can control how frequently batches of 
  -events are pushed to the index by setting 
  +NOTE: Audit events are batched for indexing so there is a lag before
  +events appear in the index. You can control how frequently batches of
  +events are pushed to the index by setting
   `xpack.security.audit.index.flush_interval` in `elasticsearch.yml`.
   
   [float]
  
positive.code: | `run_as_denied`                   | | | Logged when an authenticated user attempts to <<run-as-privilege, run as>>
                                            another user action they do not have the necessary
                                            <<security-reference, privilege>> to do so.
  | `tampered_request`                | | | Logged when {security} detects that the request has 
                                            been tampered with. Typically relates to `search/scroll` 
                                            requests when the scroll ID is believed to have been
                                            tampered with.
  | `connection_granted`              | | | Logged when an incoming TCP connection passes the
  
negative.code:                       (request was received on the transport channel),
                        `local_node` (the local node issued the request).
  | `origin_address`  | The IP address from which the request originated.
  | `principal`       | The principal (username) that passed authentication.
  | `action`          | The name of the action that was executed.
  | `request`         | The type of request that was executed.
  | `indices`         | A comma-separated list of indices this request
  