anchor.diff:  xpack.security.audit.outputs: [ index, logfile ]
   ----------------------------
   
  -The `index` output type should be used in conjunction with the `logfile` 
  +The `index` output type should be used in conjunction with the `logfile`
   output type Because it is possible for the `index` output type to lose
  -messages if the target index is unavailable, the `access.log` should be 
  +messages if the target index is unavailable, the `access.log` should be
   used as the official record of events.
   
  -NOTE: Audit events are batched for indexing so there is a lag before 
  -events appear in the index. You can control how frequently batches of 
  -events are pushed to the index by setting 
  +NOTE: Audit events are batched for indexing so there is a lag before
  +events appear in the index. You can control how frequently batches of
  +events are pushed to the index by setting
   `xpack.security.audit.index.flush_interval` in `elasticsearch.yml`.
   
   [float]
  
positive.code:                                           authentication token. `<realm>` represents the
                                            realm type.
  | `access_denied`                   | | | Logged when an authenticated user attempts to execute
                                            an action they do not have the necessary 
                                            <<security-reference, privilege>> to perform.
  | `access_granted`                  | | | Logged when an authenticated user attempts to execute
                                            an action they have the necessary privilege to perform.
  
negative.code: [[audit-index]]
  === Index Audit Output
  
  In addition to logging to a file, you can store audit logs in Elasticsearch
  rolling indices. These indices can be either on the same cluster, or on a
  remote cluster. You configure the following settings in
  `elasticsearch.yml` to control how audit entries are indexed. To enable
  this output, you need to configure the setting `xpack.security.audit.outputs`
  in the `elasticsearch.yml` file:
  