Thanks for pointing this out, @jtudelag. "If you want to forward logs to only the internal OpenShift Container Platform Elasticsearch instance, do not configure the Log Forwarding API" is too general. I'll add a phrase mentioning audit logs and pointing users to the right topic.

For more background, see this Slack thread: https://coreos.slack.com/archives/CB3HXM2QK/p1614019681029600?thread_ts=1614012012.023100&cid=CB3HXM2QK