anchor.diff:  `<local_node_info>` ::      Information about the local node that generated
                               the log entry. You can control what node information
                               is included by configuring the
  -                            <<audit-log-entry-local-node-info, local node info settings>>.
  +                            {ref}/auditing-settings.html#node-audit-settings[local node info settings].
   `<layer>`           ::      The layer from which this event originated:
                               `rest`, `transport` or `ip_filter`.
   `<entry_type>`      ::       The type of event that occurred: `anonymous_access_denied`,
  
positive.code: ==== Forwarding Audit Logs to a Remote Cluster
  
  To index audit events to a remote Elasticsearch cluster, you configure
  the following `xpack.security.audit.index.client` settings.
  
  .Remote Audit Log Indexing Configuration
  [options="header"]
  |======
  | Attribute                                                 | Description
  | `xpack.security.audit.index.client.hosts`                 | Comma-separated list of `host:port` pairs. These hosts
                                                                should be nodes in the remote cluster.
  | `xpack.security.audit.index.client.cluster.name`          | The name of the remote cluster.
  | `xpack.security.audit.index.client.xpack.security.user`   | The `username:password` pair to use to authenticate with
                                                                the remote cluster.
  |======
  
  You can pass additional settings to the remote client by specifying them in the
  `xpack.security.audit.index.client` namespace. For example, to allow the remote
  
negative.code: === Logfile Output Settings
  
  The events and some other information about what gets logged can be
  controlled using settings in the `elasticsearch.yml` file. See
  {ref}/auditing-settings.html#event-audit-settings[Audited Event Settings] and
  {ref}/auditing-settings.html#node-audit-settings[Local Node Info Settings].
  
  IMPORTANT: No filtering is performed when auditing, so sensitive data may be
  audited in plain text when including the request body in audit events.
  
  [[logging-file]]
  You can also configure how the logfile is written in the `log4j2.properties`
  