Update audit.md (#6381)

Fix format.

docs/tasks/debug-application-cluster/audit.md

@@ -359,6 +359,7 @@ Note that this example requries json format output support in Kubernetes 1.8.
 1. install [fluentd, fluent-plugin-forest and fluent-plugin-rewrite-tag-filter][fluentd_install_doc] in the kube-apiserver node
 1. create a config file for fluentd
 
+   ```shell
    $ cat <<EOF > /etc/fluentd/config
    # fluentd conf runs in the same host with kube-apiserver
    <source>
@@ -404,12 +405,20 @@ Note that this example requries json format output support in Kubernetes 1.8.
            include_time_key true
        </template>
    </match>
+   ```
+   
 1. start fluentd
 
+   ```shell
    $ fluentd -c /etc/fluentd/config  -vv
+   ```
+  
 1. start kube-apiserver with the following options:
 
+   ```shell
    --audit-policy-file=/etc/kubernetes/audit-policy.yaml --audit-log-path=/var/log/kube-audit --audit-log-format=json
+   ```
+  
 1. check audits for different namespaces in /var/log/audit-*.log
 
 #### Use logstash to collect and distribute audit events from webhook backend
@@ -421,6 +430,7 @@ different users into different files.
 1. install [logstash][logstash_install_doc]
 1. create config file for logstash
 
+   ```shell
    $ cat <<EOF > /etc/logstash/config
    input{
        http{
@@ -447,11 +457,17 @@ different users into different files.
            path=>"/var/log/kube-audit-%{[event][user][username]}/audit"
        }
    }
+   ```
+   
 1. start logstash
 
+   ```shell
    $ bin/logstash -f /etc/logstash/config --path.settings /etc/logstash/
+   ```
+  
 1. create a [kubeconfig file](/docs/tasks/access-application-cluster/authenticate-across-clusters-kubeconfig/) for kube-apiserver webhook audit backend
 
+   ```shell
    $ cat <<EOF > /etc/kubernetes/audit-webhook-kubeconfig
    apiVersion: v1
    clusters:
@@ -468,9 +484,14 @@ different users into different files.
    preferences: {}
    users: []
    EOF
+   ```
+   
 1. start kube-apiserver with the following options:
 
+   ```shell
    --audit-policy-file=/etc/kubernetes/audit-policy.yaml --audit-webhook-config-file=/etc/kubernetes/audit-webhook-kubeconfig
+   ```
+   
 1. check audits in logstash node's directories /var/log/kube-audit-*/audit
 
 Note that in addition to file output plugin, logstash has a variety of outputs that