diff --git a/.github/workflows/docs-preview-links.yml b/.github/workflows/docs-preview-links.yml
new file mode 100644
index 0000000000000..79ea1de7748a9
--- /dev/null
+++ b/.github/workflows/docs-preview-links.yml
@@ -0,0 +1,26 @@
+name: Docs Preview Links
+
+on:
+  pull_request_target:
+    types: [opened]
+    paths:
+      - '**.asciidoc'
+
+jobs:
+  doc-preview:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v6
+        name: Add doc preview links
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const comment = `Documentation preview:
+              - ✨ [Changed pages](https://${context.repo.repo}_${pr.number}.docs-preview.app.elstc.co/diff)`;
+            
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: comment,
+            });
\ No newline at end of file
diff --git a/docs/user/security/audit-logging.asciidoc b/docs/user/security/audit-logging.asciidoc
index 8cd293654c29c..ce1e63c20d1c6 100644
--- a/docs/user/security/audit-logging.asciidoc
+++ b/docs/user/security/audit-logging.asciidoc
@@ -2,7 +2,7 @@
 [[xpack-security-audit-logging]]
 === Audit logs
 
-Audit logging is a https://www.elastic.co/subscriptions[subscription feature] that you can enable to keep track of security-related events,
+Audit logging is a {subscriptions}[subscription feature] that you can enable to keep track of security-related events,
 such as authorization success and failures. Logging these events enables you to monitor {kib} for suspicious activity and provides evidence
 in the event of an attack.
 
@@ -410,7 +410,7 @@ Example: `[marketing]`
 Example: `get`, `post`, `put`, `delete`
 
 | `url.domain`
-| Domain of the url.
+| Domain of the URL.
 
 Example: `www.elastic.co`
 
@@ -440,7 +440,7 @@ Example: `https`
 | *Description*
 
 | [[field-trace-id]] `trace.id`
-| Unique identifier allowing events of the same transaction from {kib} and {es} to be be correlated.
+| Unique identifier allowing events of the same transaction from {kib} and {es} to be correlated.
 
 |======