anchor.diff:  [[xpack-sa-lf-events-ignore-realms]]
   // tag::xpack-sa-lf-events-ignore-realms-tag[]
   `xpack.security.audit.logfile.events.ignore_filters.<policy_name>.realms`::
  +(<<dynamic-cluster-setting,Dynamic>>)
   A list of authentication realm names or wildcards. The specified policy will
   not print audit events for users in these realms.
   // end::xpack-sa-lf-events-ignore-realms-tag[]
  
positive.code: [[xpack-sa-lf-events-ignore-users]]
  // tag::xpack-sa-lf-events-ignore-users-tag[]
  `xpack.security.audit.logfile.events.ignore_filters.<policy_name>.users`::
  A list of user names or wildcards. The specified policy will
  not print audit events for users matching these values.
  // end::xpack-sa-lf-events-ignore-users-tag[]
  
negative.code: [[xpack-sa-lf-emit-node-host-name]]
  // tag::xpack-sa-lf-emit-node-host-name-tag[]
  `xpack.security.audit.logfile.emit_node_host_name`::
  (<<dynamic-cluster-setting,Dynamic>>)
  Specifies whether to include the node's host name as a field in each audit event.
  The default value is `false`.
  // end::xpack-sa-lf-emit-node-host-name-tag[]
  