Original comment by @jaymode:

Some users have the requirement that if auditing fails, the application must go to a known failure state such that it can no longer be interacted with until the issue has been corrected. In terms of elasticsearch, the easiest failure state to go to would be to shut down the node. This must be an opt-in feature with the implications well documented.