Original comment by @markwalkom:

Here we're a little light on some details that might make it easier for users to understand what is happening.

eg;

• How does this integrate into SSL/TLS secured clusters?
• Are we using transport protocol? It seems implied that we do but it'd be nice to be explicit (I checked the code but wasn't 100% sure).
• Pending ^; Can HTTP be used instead?
• What are these "other settings" that are mentioned below;

Additional settings may be passed to the remote client by placing them under the shield.audit.index.client namespace