anchor.diff:  [[xpack-sa-lf-emit-node-id]]
   // tag::xpack-sa-lf-emit-node-id-tag[]
   `xpack.security.audit.logfile.emit_node_id`::
  +(<<dynamic-cluster-setting,Dynamic>>)
   Specifies whether to include the node id as a field in each audit event.
   This is available for the new format only. That is to say, this information
   does not exist in the `<clustername>_access.log` file.
  
positive.code: [[xpack-sa-lf-emit-node-host-address]]
  // tag::xpack-sa-lf-emit-node-host-address-tag[]
  `xpack.security.audit.logfile.emit_node_host_address`::
  Specifies whether to include the node's IP address as a field in each audit event.
  The default value is `false`.
  // end::xpack-sa-lf-emit-node-host-address-tag[]
  
negative.code: ++++
  <titleabbrev>Auditing settings</titleabbrev>
  ++++
  
  [[auditing-settings-description]]
  You can use <<enable-audit-logging,audit logging>> to record security-related
  events, such as authentication failures, refused connections, and data-access
  events.
  
  If configured, auditing settings must be set on every node in the cluster.
  Static settings, such as `xpack.security.audit.enabled`, must be configured in
  `elasticsearch.yml` on each node. For dynamic auditing settings, use the
  <<cluster-update-settings,cluster update settings API>> to ensure the setting is
  the same on all nodes.
  
  [[general-audit-settings]]
  ==== General Auditing Settings
  [[xpack-security-audit-enabled]]
  // tag::xpack-security-audit-enabled-tag[]
  `xpack.security.audit.enabled`::
  (<<static-cluster-setting,Static>>)
  Set to `true` to enable auditing on the node. The default value is `false`. This
  puts the auditing events in a dedicated file named `<clustername>_audit.json` on
  each node.
  +
  If enabled, this setting must be configured in `elasticsearch.yml` on all nodes
  in the cluster.
  // end::xpack-security-audit-enabled-tag[]
  
  [[event-audit-settings]]
  