anchor.diff:      - node_stats
       - shard
     period: 10s
  -  hosts: ["http://localhost:9200"] <1>
  -  xpack.enabled: true <2>
  +  hosts: ["http://localhost:9200"] 
  +  #username: "user"
  +  #password: "secret"
  +  xpack.enabled: true 
   ----------------------------------
  -<1> This setting identifies the host and port number that are used to access {es}.
  -<2> This setting ensures that {kib} can read this monitoring data successfully. 
  -That is to say, it's stored in the same location and format as monitoring data 
  -that is sent by <<es-monitoring-exporters,exporters>>. 
  ---
   
  -.. If Elastic {security-features} are enabled, you must also provide a user ID 
  -and password so that {metricbeat} can collect metrics successfully. 
  +By default, the module collects {es} monitoring metrics from
  +`http://localhost:9200`. If that host and port number are not correct, you must
  +update the `hosts` setting. If you configured {es} to use encrypted
  +communications, you must access it via HTTPS. For example, use a `hosts` setting like `https://localhost:9200`.
  +// end::configure-es-module[]
   
  -... Create a user on the production cluster that has the 
  +// tag::remote-monitoring-user[]
  +If Elastic {security-features} are enabled, you must also provide a user ID 
  +and password so that {metricbeat} can collect metrics successfully: 
  +
  +.. Create a user on the production cluster that has the 
   {stack-ov}/built-in-roles.html[`remote_monitoring_collector` built-in role]. 
   Alternatively, use the {stack-ov}/built-in-users.html[`remote_monitoring_user` built-in user].
   
  -... Add the `username` and `password` settings to the {es} module configuration 
  +.. Add the `username` and `password` settings to the {es} module configuration 
   file.
  -+
  ---
  -For example, add the following settings in the `modules.d/elasticsearch.yml` file:
  -
  -[source,yaml]
  -----------------------------------
  -- module: elasticsearch
  -  ...
  -  username: remote_monitoring_user
  -  password: YOUR_PASSWORD
  -----------------------------------
  +// end::remote-monitoring-user[]
   --
   
  -.. If you configured {es} to use <<configuring-tls,encrypted communications>>, 
  -you must access it via HTTPS. For example, use a `hosts` setting like 
  -`https://localhost:9200` in the `modules.d/elasticsearch.yml` file.
  -
  -.. Identify where to send the monitoring data. +
  +. Identify where to send the monitoring data. +
   +
   --
   TIP: In production environments, we strongly recommend using a separate cluster 
  
positive.code: [source,yaml]
  ----------------------------------
  output.elasticsearch:
    hosts: ["http://es-mon-1:9200", "http://es-mon2:9200"] <1>
  ----------------------------------
  <1> In this example, the data is stored on a monitoring cluster with nodes 
  `es-mon-1` and `es-mon-2`. 
  
  IMPORTANT: The {es} {monitor-features} use ingest pipelines, therefore the
  cluster that stores the monitoring data must have at least one 
  <<ingest,ingest node>>. 
  
  For more information about these configuration options, see 
  {metricbeat-ref}/elasticsearch-output.html[Configure the {es} output].
  --
  
  .. If {es} {security-features} are enabled on the monitoring cluster, you 
  must provide a valid user ID and password so that {metricbeat} can send metrics 
  successfully. 
  
  ... Create a user on the monitoring cluster that has the 
  {stack-ov}/built-in-roles.html[`remote_monitoring_agent` built-in role]. 
  Alternatively, use the 
  {stack-ov}/built-in-users.html[`remote_monitoring_user` built-in user].
  
  ... Add the `username` and `password` settings to the {es} output information in 
  the {metricbeat} configuration file (`metricbeat.yml`):
  +
  --
  [source,yaml]
  ----------------------------------
  output.elasticsearch:
    ...
    username: remote_monitoring_user
    password: YOUR_PASSWORD
  ----------------------------------
  --
  
  .. If you configured the monitoring cluster to use 
  <<configuring-tls,encrypted communications>>, you must access it via 
  HTTPS. For example, use a `hosts` setting like `https://es-mon-1:9200` in the 
  `metricbeat.yml` file. 
  
  . <<starting-elasticsearch,Start {es}>>.
  
  . {metricbeat-ref}/metricbeat-starting.html[Start {metricbeat}]. 
  
  . {kibana-ref}/monitoring-data.html[View the monitoring data in {kib}]. 
  
negative.code: Leave `xpack.monitoring.enabled` set to its default value (`true`). 
  --
  
  . {metricbeat-ref}/metricbeat-installation.html[Install {metricbeat}] on each
  {es} node in the production cluster.
  
  . Enable the {es} module in {metricbeat} on each {es} node. +
  +
  --
  // tag::enable-es-module[]
  For example, to enable the default configuration in the `modules.d` directory, 
  run the following command:
  
  