anchor.diff:  [[auditing]]
   == Auditing Security Events
   
  -You can enable auditing to keep track of security-related events such as 
  +You can enable auditing to keep track of security-related events such as
   authentication failures and refused connections. Logging these events enables you
   to monitor your cluster for suspicious activity and provides evidence in the
   event of an attack.
   
   [IMPORTANT]
   ============================================================================
  -Audit logs are **disabled** by default. To enable this functionality, you 
  +Audit logs are **disabled** by default. To enable this functionality, you
   must set `xpack.security.audit.enabled` to `true` in `elasticsearch.yml`.
   ============================================================================
   
  -{Security} provides two ways to persist audit logs: 
  +{Security} provides two ways to persist audit logs:
   
   * The <<audit-log-output, `logfile`>> output, which persists events to
     a dedicated `<clustername>_access.log` file on the host's file system.
  
positive.code:                       (request was received on the transport channel),
                        `local_node` (the local node issued the request).
  | `origin_address`  | The IP address from which the request originated.
  | `principal`       | The principal (username) that failed authentication.
  | `action`          | The name of the action that was executed.
  | `request`         | The type of request that was executed.
  | `indices`         | A comma-separated list of indices this request
  
negative.code: xpack.security.audit.outputs: [ index, logfile ]
  ----------------------------
  
  The `index` output type should be used in conjunction with the `logfile`
  output type Because it is possible for the `index` output type to lose
  messages if the target index is unavailable, the `access.log` should be
  used as the official record of events.
  
  NOTE: Audit events are batched for indexing so there is a lag before
  events appear in the index. You can control how frequently batches of
  events are pushed to the index by setting
  `xpack.security.audit.index.flush_interval` in `elasticsearch.yml`.
  
  [float]
  