According to the Logging official documentation, we found references to send the audit logs to the default (internal) Elasticsearch:
"Because the internal OpenShift Container Platform Elasticsearch log store does not provide secure storage for audit logs, audit logs are not stored in the internal Elasticsearch instance by default. If you want to send the audit logs to the default internal Elasticsearch log store, for example to view the audit logs in Kibana, you must use the Log Forwarding API as described in Forward audit logs to the log store"

As currently we also support Loki as default storage logging system, these references should be updated.