anchor.diff:                        (request was received on the transport channel),
                         `local_node` (the local node issued the request).
   | `origin_address`  | The IP address from which the request originated.
  -| `principal`       | The principal (username) that failed authentication.
  +| `principal`       | The principal (username) that passed authentication.
   | `action`          | The name of the action that was executed.
   | `request`         | The type of request that was executed.
   | `indices`         | A comma-separated list of indices this request
  
positive.code: [[auditing]]
  == Auditing Security Events
  
  You can enable auditing to keep track of security-related events such as 
  authentication failures and refused connections. Logging these events enables you
  to monitor your cluster for suspicious activity and provides evidence in the
  event of an attack.
  
  [IMPORTANT]
  ============================================================================
  Audit logs are **disabled** by default. To enable this functionality, you 
  must set `xpack.security.audit.enabled` to `true` in `elasticsearch.yml`.
  ============================================================================
  
  {Security} provides two ways to persist audit logs: 
  
  * The <<audit-log-output, `logfile`>> output, which persists events to
    a dedicated `<clustername>_access.log` file on the host's file system.
  
negative.code:                                           authentication token. `<realm>` represents the
                                            realm type.
  | `access_denied`                   | | | Logged when an authenticated user attempts to execute
                                            an action they do not have the necessary
                                            <<security-reference, privilege>> to perform.
  | `access_granted`                  | | | Logged when an authenticated user attempts to execute
                                            an action they have the necessary privilege to perform.
  