[DOCS] Clarify audit index settings when remote indexing (#30923)

elastic · Jun 12, 2018 · 5156223 · 5156223
1 parent 8fa278f
commit 5156223
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/docs/reference/settings/audit-settings.asciidoc b/docs/reference/settings/audit-settings.asciidoc
@@ -112,6 +112,15 @@ xpack.security.audit.index.settings:
     number_of_replicas: 1
 ----------------------------
 --
++
+--
+NOTE: These settings apply to the local audit indices, as well as to the
+<<remote-audit-settings, remote audit indices>>, but only if the remote cluster
+does *not* have {security} installed, or the {es} versions are different.
+If the remote cluster has {security} installed, and the versions coincide, the
+settings for the audit indices there will take precedence,
+even if they are unspecified (i.e. left to defaults).
+--
 
 [[remote-audit-settings]]
 ==== Remote Audit Log Indexing Configuration Settings

diff --git a/x-pack/docs/en/security/auditing/output-index.asciidoc b/x-pack/docs/en/security/auditing/output-index.asciidoc
@@ -36,6 +36,13 @@ xpack.security.audit.index.settings:
     number_of_replicas: 1
 ----------------------------
 
+These settings apply to the local audit indices, as well as to the
+<<forwarding-audit-logfiles, remote audit indices>>, but only if the remote cluster
+does *not* have {security} installed, or the {es} versions are different.
+If the remote cluster has {security} installed, and the versions coincide, the
+settings for the audit indices there will take precedence,
+even if they are unspecified (i.e. left to defaults).
+
 NOTE: Audit events are batched for indexing so there is a lag before
 events appear in the index. You can control how frequently batches of
 events are pushed to the index by setting