anchor.diff:  
   [[xpack-sa-lf-emit-node-name]]
   // tag::xpack-sa-lf-emit-node-name-tag[]
  -`xpack.security.audit.logfile.emit_node_name` {ess-icon}::
  +`xpack.security.audit.logfile.emit_node_name`::
   Specifies whether to include the <<node.name,node name>> as a field in
   each audit event. The default value is `false`.
   // end::xpack-sa-lf-emit-node-name-tag[]
   
   [[xpack-sa-lf-emit-node-host-address]]
   // tag::xpack-sa-lf-emit-node-host-address-tag[]
  -`xpack.security.audit.logfile.emit_node_host_address` {ess-icon}::
  +`xpack.security.audit.logfile.emit_node_host_address`::
   Specifies whether to include the node's IP address as a field in each audit event.
   The default value is `false`.
   // end::xpack-sa-lf-emit-node-host-address-tag[]
   
   [[xpack-sa-lf-emit-node-host-name]]
   // tag::xpack-sa-lf-emit-node-host-name-tag[]
  -`xpack.security.audit.logfile.emit_node_host_name` {ess-icon}::
  +`xpack.security.audit.logfile.emit_node_host_name`::
   Specifies whether to include the node's host name as a field in each audit event.
   The default value is `false`.
   // end::xpack-sa-lf-emit-node-host-name-tag[]
   
   [[xpack-sa-lf-emit-node-id]]
   // tag::xpack-sa-lf-emit-node-id-tag[]
  -`xpack.security.audit.logfile.emit_node_id` {ess-icon}::
  +`xpack.security.audit.logfile.emit_node_id`::
   Specifies whether to include the node id as a field in each audit event.
   This is available for the new format only. That is to say, this information
   does not exist in the `<clustername>_access.log` file.
  
positive.code: 
  [[xpack-sa-lf-events-ignore-indices]]
  // tag::xpack-sa-lf-events-ignore-indices-tag[]
  `xpack.security.audit.logfile.events.ignore_filters.<policy_name>.indices` {ess-icon}::
  A list of index names or wildcards. The specified policy will
  not print audit events when all the indices in the event match
  these values. If the event concerns several indices, some of which are
  
negative.code: 
  [[xpack-sa-lf-events-exclude]]
  // tag::xpack-sa-lf-events-exclude-tag[]
  `xpack.security.audit.logfile.events.exclude`::
  Excludes the specified events from the output. By default, no events are
  excluded.
  // end::xpack-sa-lf-events-exclude-tag[]
  
  [[xpack-sa-lf-events-emit-request]]
  // tag::xpack-sa-lf-events-emit-request-tag[]
  `xpack.security.audit.logfile.events.emit_request_body`::
  Specifies whether to include the request body from REST requests on certain
  event types such as `authentication_failed`. The default value is `false`.
  +
  