anchor.diff:  
   .. If you configured {es} to use <<configuring-tls,encrypted communications>>, 
   you must access it via HTTPS. For example, use a `hosts` setting like 
  -`https://localhost:9200` in the `modules.d/elasticsearch.yml` file.
  +`https://localhost:9200` in the `modules.d/elasticsearch-xpack.yml` file.
   
   .. Identify where to send the monitoring data. +
   +
  
positive.code: 
  ["source","sh",subs="attributes,callouts"]
  ----------------------------------------------------------------------
  metricbeat modules enable elasticsearch
  ----------------------------------------------------------------------
  
  For more information, see 
  
negative.code: {metricbeat-ref}/metricbeat-module-elasticsearch.html[{es} module]. 
  --
  
  .. By default the module will collect {es} monitoring metrics from `http://localhost:9200`.
  If the local {es} node has a different address, you must specify it via the `hosts` setting
  in the `modules.d/elasticsearch-xpack.yml` file.
  
  .. If Elastic {security-features} are enabled, you must also provide a user ID
  and password so that {metricbeat} can collect metrics successfully. 
  
  ... Create a user on the production cluster that has the
  {stack-ov}/built-in-roles.html[`remote_monitoring_collector` built-in role]. 
  Alternatively, use the {stack-ov}/built-in-users.html[`remote_monitoring_user` built-in user].
  
  ... Add the `username` and `password` settings to the {es} module configuration
  file.
  +
  --
  For example, add the following settings in the `modules.d/elasticsearch-xpack.yml` file:
  
  [source,yaml]
  ----------------------------------
  