anchor.diff:  ==== Forwarding Audit Logs to a Remote Cluster
   
   To index audit events to a remote Elasticsearch cluster, you configure
  -the following `xpack.security.audit.index.client` settings.
  -
  -.Remote Audit Log Indexing Configuration
  -[options="header"]
  -|======
  -| Attribute                                                 | Description
  -| `xpack.security.audit.index.client.hosts`                 | Comma-separated list of `host:port` pairs. These hosts
  -                                                              should be nodes in the remote cluster.
  -| `xpack.security.audit.index.client.cluster.name`          | The name of the remote cluster.
  -| `xpack.security.audit.index.client.xpack.security.user`   | The `username:password` pair to use to authenticate with
  -                                                              the remote cluster.
  -|======
  +the following `xpack.security.audit.index.client` settings:
  +
  +* `xpack.security.audit.index.client.hosts`
  +* `xpack.security.audit.index.client.cluster.name`
  +* `xpack.security.audit.index.client.xpack.security.user`
  +
  +For more information about these settings, see
  +{ref}/auditing-settings.html#remote-audit-settings[Remote Audit Log Indexing Configuration Settings].
   
   You can pass additional settings to the remote client by specifying them in the
   `xpack.security.audit.index.client` namespace. For example, to allow the remote
  
positive.code: xpack.security.audit.outputs: [ index, logfile ]
  ----------------------------
  
  .Audit Log Indexing Configuration
  [options="header"]
  |======
  | Attribute                           | Default Setting | Description
  | `xpack.security.audit.index.bulk_size`      | `1000`          | Controls how many audit events are batched into a single write.
  | `xpack.security.audit.index.flush_interval` | `1s`            | Controls how often buffered events are flushed to the index.
  | `xpack.security.audit.index.rollover`       | `daily`         | Controls how often to roll over to a new index:
                                                                    `hourly`, `daily`, `weekly`, or `monthly`.
  | `xpack.security.audit.index.events.include` | `anonymous_access_denied`, `authentication_failed`, `realm_authentication_failed`, `access_granted`, `access_denied`, `tampered_request`, `connection_granted`, `connection_denied`, `run_as_granted`, `run_as_denied` | The audit events to be indexed. See <<audit-event-types, Audit Entry Types>> for the complete list.
  | `xpack.security.audit.index.events.exclude` |  | The audit events to exclude from indexing.
  | `xpack.security.audit.index.events.emit_request_body`| false   | Include or exclude the request body from REST requests
                                                                     on certain event types such as `authentication_failed`.
  |======
  
  IMPORTANT: No filtering is performed when auditing, so sensitive data may be
  audited in plain text when including the request body in audit events.
  
negative.code: === Logfile Output Settings
  
  The events and some other information about what gets logged can be
  controlled using settings in the `elasticsearch.yml` file. See
  {ref}/auditing-settings.html#event-audit-settings[Audited Event Settings] and
  {ref}/auditing-settings.html#node-audit-settings[Local Node Info Settings].
  
  IMPORTANT: No filtering is performed when auditing, so sensitive data may be
  audited in plain text when including the request body in audit events.
  
  [[logging-file]]
  You can also configure how the logfile is written in the `log4j2.properties`
  