Add stats APIs

Add back Docker sample
Clarify connection alias
2021-10-05 08:37:21 -07:00 · 2021-10-04 17:08:58 -07:00 · 2021-10-04 13:47:22 -07:00 · 2021-10-01 11:43:37 -07:00 · 2021-09-30 16:43:05 -07:00 · 2021-09-30 16:22:36 -07:00
25 changed files with 1782 additions and 206 deletions
@@ -0,0 +1,145 @@
+---
+layout: default
+title: Go client
+nav_order: 80
+---
+
+# Go client
+
+The OpenSearch Go client lets you connect your Go application with the data in your OpenSearch cluster.
+
+
+## Setup
+
+If you're creating a new project:
+
+```go
+go mod init
+```
+
+To add the client to your project, import it like any other module:
+
+```go
+go get github.com/opensearch-project/opensearch-go
+```
+
+## Sample code
+
+This sample code creates a client, adds an index with non-default settings, inserts a document, searches for the document, deletes the document, and finally deletes the index:
+
+```go
+package main
+import (
+    "os"
+    "context"
+    "crypto/tls"
+    "fmt"
+    opensearch "github.com/opensearch-project/opensearch-go"
+    opensearchapi "github.com/opensearch-project/opensearch-go/opensearchapi"
+    "net/http"
+    "strings"
+)
+const IndexName = "go-test-index1"
+func main() {
+    // Initialize the client with SSL/TLS enabled.
+    client, err := opensearch.NewClient(opensearch.Config{
+        Transport: &http.Transport{
+            TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+        },
+        Addresses: []string{"https://localhost:9200"},
+        Username:  "admin", // For testing only. Don't store credentials in code.
+        Password:  "admin",
+    })
+    if err != nil {
+        fmt.Println("cannot initialize", err)
+        os.Exit(1)
+    }
+
+    // Print OpenSearch version information on console.
+    fmt.Println(client.Info())
+
+    // Define index mapping.
+    mapping := strings.NewReader(`{
+     'settings': {
+       'index': {
+            'number_of_shards': 4
+            }
+          }
+     }`)
+
+    // Create an index with non-default settings.
+    res := opensearchapi.CreateRequest{
+        Index: IndexName,
+        Body:  mapping,
+    }
+    fmt.Println("creating index", res)
+
+    // Add a document to the index.
+    document := strings.NewReader(`{
+        "title": "Moneyball",
+        "director": "Bennett Miller",
+        "year": "2011"
+    }`)
+
+    docId := "1"
+    req := opensearchapi.IndexRequest{
+        Index:      IndexName,
+        DocumentID: docId,
+        Body:       document,
+    }
+    insertResponse, err := req.Do(context.Background(), client)
+    if err != nil {
+        fmt.Println("failed to insert document ", err)
+        os.Exit(1)
+    }
+    fmt.Println(insertResponse)
+
+    // Search for the document.
+    content := strings.NewReader(`{
+       "size": 5,
+       "query": {
+           "multi_match": {
+           "query": "miller",
+           "fields": ["title^2", "director"]
+           }
+      }
+    }`)
+
+    search := opensearchapi.SearchRequest{
+        Body: content,
+    }
+
+    searchResponse, err := search.Do(context.Background(), client)
+    if err != nil {
+        fmt.Println("failed to search document ", err)
+        os.Exit(1)
+    }
+    fmt.Println(searchResponse)
+
+    // Delete the document.
+    delete := opensearchapi.DeleteRequest{
+        Index:      IndexName,
+        DocumentID: docId,
+    }
+
+    deleteResponse, err := delete.Do(context.Background(), client)
+    if err != nil {
+        fmt.Println("failed to delete document ", err)
+        os.Exit(1)
+    }
+    fmt.Println("deleting document")
+    fmt.Println(deleteResponse)
+
+    // Delete previously created index.
+    deleteIndex := opensearchapi.IndicesDeleteRequest{
+        Index: []string{IndexName},
+    }
+
+    deleteIndexResponse, err := deleteIndex.Do(context.Background(), client)
+    if err != nil {
+        fmt.Println("failed to delete index ", err)
+        os.Exit(1)
+    }
+    fmt.Println("deleting index", deleteIndexResponse)
+}
+```
@@ -9,6 +9,20 @@ redirect_from:

 # OpenSearch client compatibility

+OpenSearch provides clients for several popular programming languages, with more coming. In general, clients are compatible with clusters running the same major version of OpenSearch (`major.minor.patch`).
+
+For example, a 1.0.0 client works with an OpenSearch 1.1.0 cluster, but might not support any non-breaking API changes in OpenSearch 1.1.0. A 1.2.0 client works with the same cluster, but might allow you to pass unsupported options in certain functions. We recommend using the same version for both, but if your tests pass after a cluster upgrade, you don't necessarily need to upgrade your clients immediately.
+
+{% comment %}
+* [OpenSearch Java client]({{site.url}}{{site.baseurl}}/clients/java/)
+{% endcomment %}
+* [OpenSearch Python client]({{site.url}}{{site.baseurl}}/clients/python/)
+* [OpenSearch JavaScript (Node.js) client]({{site.url}}{{site.baseurl}}/clients/javascript/)
+* [OpenSearch Go client]({{site.url}}{{site.baseurl}}/clients/go/)
+
+
+## Legacy clients
+
 Most clients that work with Elasticsearch OSS 7.10.2 *should* work with OpenSearch, but the latest versions of those clients might include license or version checks that artificially break compatibility. This page includes recommendations around which versions of those clients to use for best compatibility with OpenSearch.

 Client | Recommended version
@@ -18,7 +32,7 @@ Client | Recommended version
 [Python Elasticsearch client](https://pypi.org/project/elasticsearch/7.13.4/) | 7.13.4
 [Elasticsearch Node.js client](https://www.npmjs.com/package/@elastic/elasticsearch/v/7.13.0) | 7.13.0

-Clients exist for a wide variety of languages, so if you test a client and verify that it works, please [submit a PR](https://github.com/opensearch-project/documentation-website/pulls) and add it to this table.
+If you test a legacy client and verify that it works, please [submit a PR](https://github.com/opensearch-project/documentation-website/pulls) and add it to this table.


 {% comment %}
@@ -1,10 +1,10 @@
 ---
 layout: default
-title: Java high-level REST client
-nav_order: 97
+title: Elasticsearch OSS Java high-level REST client
+nav_order: 60
 ---

-# Java high-level REST client
+# Elasticsearch OSS Java high-level REST client

 The Elasticsearch OSS Java high-level REST client allows you to interact with your OpenSearch clusters and indices through Java methods and data structures rather than HTTP methods and JSON.

@@ -22,7 +22,7 @@ To start using the Elasticsearch OSS Java high-level REST client, ensure that yo
 </dependency>
 ```

-You can now start your OpenSearch cluster. The 7.10.2 high-level REST client works with the 1.x versions of OpenSearch.
+You can now start your OpenSearch cluster. The 7.10.2 Elasticsearch OSS high-level REST client works with the 1.x versions of OpenSearch.

 ## Sample code

@@ -0,0 +1,141 @@
+---
+layout: default
+title: JavaScript client
+nav_order: 90
+---
+
+# JavaScript client
+
+The OpenSearch JavaScript client provides a safer and easier way to interact with your OpenSearch cluster. Rather than using OpenSearch from the browser and potentially exposing your data to the public, you can build an OpenSearch client that takes care of sending requests to your cluster.
+
+The client contains a library of APIs that let you perform different operations on your cluster and return a standard response body. The example here demonstrates some basic operations like creating an index, adding documents, and searching your data.
+
+## Setup
+
+To add the client to your project, install it from [npm](https://www.npmjs.com):
+
+```bash
+npm install @opensearch-project/opensearch
+```
+
+To install a specific major version of the client, run the following command:
+
+```bash
+npm install @opensearch-project/opensearch@<version>
+```
+
+If you prefer to add the client manually or just want to examine the source code, see [opensearch-js](https://github.com/opensearch-project/opensearch-js) on GitHub.
+
+Then require the client:
+
+```javascript
+const { Client } = require("@opensearch-project/opensearch");
+```
+
+## Sample code
+
+```javascript
+"use strict";
+
+var host = "localhost";
+var protocol = "https";
+var port = 9200;
+var auth = "admin:admin"; // For testing only. Don't store credentials in code.
+var ca_certs_path = "/full/path/to/root-ca.pem";
+
+// Optional client certificates if you don't want to use HTTP basic authentication.
+// var client_cert_path = '/full/path/to/client.pem'
+// var client_key_path = '/full/path/to/client-key.pem'
+
+// Create a client with SSL/TLS enabled.
+var { Client } = require("@opensearch-project/opensearch");
+var fs = require("fs");
+var client = new Client({
+  node: protocol + "://" + auth + "@" + host + ":" + port,
+  ssl: {
+    ca: fs.readFileSync(ca_certs_path),
+    // You can turn off certificate verification (rejectUnauthorized: false) if you're using self-signed certificates with a hostname mismatch.
+    // cert: fs.readFileSync(client_cert_path),
+    // key: fs.readFileSync(client_key_path)
+  },
+});
+
+async function search() {
+  // Create an index with non-default settings.
+  var index_name = "books";
+  var settings = {
+    settings: {
+      index: {
+        number_of_shards: 4,
+        number_of_replicas: 3,
+      },
+    },
+  };
+
+  var response = await client.indices.create({
+    index: index_name,
+    body: settings,
+  });
+
+  console.log("Creating index:");
+  console.log(response.body);
+
+  // Add a document to the index.
+  var document = {
+    title: "The Outsider",
+    author: "Stephen King",
+    year: "2018",
+    genre: "Crime fiction",
+  };
+
+  var id = "1";
+
+  var response = await client.index({
+    id: id,
+    index: index_name,
+    body: document,
+    refresh: true,
+  });
+
+  console.log("Adding document:");
+  console.log(response.body);
+
+  // Search for the document.
+  var query = {
+    query: {
+      match: {
+        title: {
+          query: "The Outsider",
+        },
+      },
+    },
+  };
+
+  var response = await client.search({
+    index: index_name,
+    body: query,
+  });
+
+  console.log("Search results:");
+  console.log(response.body.hits);
+
+  // Delete the document.
+  var response = await client.delete({
+    index: index_name,
+    id: id,
+  });
+
+  console.log("Deleting document:");
+  console.log(response.body);
+
+  // Delete the index.
+  var response = await client.indices.delete({
+    index: index_name,
+  });
+
+  console.log("Deleting index:");
+  console.log(response.body);
+}
+
+search().catch(console.log);
+```
@@ -0,0 +1,128 @@
+---
+layout: default
+title: Python client
+nav_order: 70
+---
+
+# Python client
+
+The OpenSearch Python client provides a more natural syntax for interacting with your cluster. Rather than sending HTTP requests to a given URL, you can create an OpenSearch client for your cluster and call the client's built-in functions.
+
+{% comment %}
+`opensearch-py` is the lower-level of the two Python clients. If you want a general client for assorted operations, it's a great choice. If you want a higher-level client strictly for indexing and search operations, consider [opensearch-dsl-py]({{site.url}}{{site.baseurl}}/clients/python-dsl/).
+{% endcomment %}
+
+
+## Setup
+
+To add the client to your project, install it using [pip](https://pip.pypa.io/):
+
+```bash
+pip install opensearch-py
+```
+
+Then import it like any other module:
+
+```python
+from opensearchpy import OpenSearch
+```
+
+If you prefer to add the client manually or just want to examine the source code, see [opensearch-py on GitHub](https://github.com/opensearch-project/opensearch-py).
+
+
+## Sample code
+
+```python
+from opensearchpy import OpenSearch
+
+host = 'localhost'
+port = 9200
+auth = ('admin', 'admin') # For testing only. Don't store credentials in code.
+ca_certs_path = '/full/path/to/root-ca.pem' # Provide a CA bundle if you use intermediate CAs with your root CA.
+
+# Optional client certificates if you don't want to use HTTP basic authentication.
+# client_cert_path = '/full/path/to/client.pem'
+# client_key_path = '/full/path/to/client-key.pem'
+
+# Create the client with SSL/TLS enabled, but hostname verification disabled.
+client = OpenSearch(
+    hosts = [{'host': host, 'port': port}],
+    http_compress = True, # enables gzip compression for request bodies
+    http_auth = auth,
+    # client_cert = client_cert_path,
+    # client_key = client_key_path,
+    use_ssl = True,
+    verify_certs = True,
+    ssl_assert_hostname = False,
+    ssl_show_warn = False,
+    ca_certs = ca_certs_path
+)
+
+# Create an index with non-default settings.
+index_name = 'python-test-index'
+index_body = {
+  'settings': {
+    'index': {
+      'number_of_shards': 4
+    }
+  }
+}
+
+response = client.indices.create(index_name, body=index_body)
+print('\nCreating index:')
+print(response)
+
+# Add a document to the index.
+document = {
+  'title': 'Moneyball',
+  'director': 'Bennett Miller',
+  'year': '2011'
+}
+id = '1'
+
+response = client.index(
+    index = index_name,
+    body = document,
+    id = id,
+    refresh = True
+)
+
+print('\nAdding document:')
+print(response)
+
+# Search for the document.
+q = 'miller'
+query = {
+  'size': 5,
+  'query': {
+    'multi_match': {
+      'query': q,
+      'fields': ['title^2', 'director']
+    }
+  }
+}
+
+response = client.search(
+    body = query,
+    index = index_name
+)
+print('\nSearch results:')
+print(response)
+
+# Delete the document.
+response = client.delete(
+    index = index_name,
+    id = id
+)
+
+print('\nDeleting document:')
+print(response)
+
+# Delete the index.
+response = client.indices.delete(
+    index = index_name
+)
+
+print('\nDeleting index:')
+print(response)
+```
@@ -45,6 +45,9 @@ collections:
  im-plugin:
    permalink: /:collection/:path/
    output: true
+  replication-plugin:
+    permalink: /:collection/:path/
+    output: true
  monitoring-plugins:
    permalink: /:collection/:path/
    output: true
@@ -81,6 +84,9 @@ just_the_docs:
    im-plugin:
      name: Index management plugin
      nav_fold: true
+    replication-plugin:
+      name: Replication plugin
+      nav_fold: true
    monitoring-plugins:
      name: Monitoring plugins
      nav_fold: true
@@ -90,36 +90,36 @@ You can specify the following options.

 Options | Description | Type | Required
 :--- | :--- |:--- |:--- |
-`source_index` |  The name of the detector. | `string` | Yes
-`target_index` |  Specify the target index that the rolled up data is ingested into. You could either create a new target index or use an existing index. The target index cannot be a combination of raw and rolled up data. | `string` | Yes
-`schedule` |  Schedule of the index rollup job which can be an interval or a cron expression. | `object` | Yes
-`schedule.interval`  |  Specify the frequency of execution of the rollup job. | `object` | No
-`schedule.interval.start_time` | Start time of the interval. | `timestamp` | Yes
-`schedule.interval.period` |  Define the interval period. | `string` | Yes
-`schedule.interval.unit` | Specify the time unit of the interval. | `string` | Yes
-`schedule.interval.cron` | Optionally, specify a cron expression to define therollup frequency. | `list` | No
-`schedule.interval.cron.expression` | Specify a Unix cron expression. | `string` | Yes
-`schedule.interval.cron.timezone` | Specify timezones as defined by the IANA Time Zone Database. Defaults to UTC. | `string` | No
-`description` | Optionally, describe the rollup job. | `string` | No
-`enabled` | When true, the index rollup job is scheduled. Default is true. | `boolean` | Yes
-`continuous` | Specify whether or not the index rollup job continuously rolls up data forever or just executes over the current data set once and stops. Default is false. | `boolean` | Yes
-`error_notification` | Set up a Mustache message template sent for error notifications. For example, if an index rollup job fails, the system sends a message to a Slack channel. | `object` | No
-`page_size` | Specify the number of buckets to paginate through at a time while rolling up. | `number` | Yes
-`delay` | Specify time value to delay execution of the index rollup job. | `time_unit` | No
-`dimensions` | Specify aggregations to create dimensions for the roll up time window. | `object` | Yes
-`dimensions.date_histogram` | Specify either fixed_interval or calendar_interval, but not both. Either one limits what you can query in the target index. | `object` | No
-`dimensions.date_histogram.fixed_interval` | Specify the fixed interval for aggregations in milliseconds, seconds, minutes, hours, or days. | `string` | No
-`dimensions.date_histogram.calendar_interval` | Specify the calendar interval for aggregations in minutes, hours, days, weeks, months, quarters, or years. | `string` | No
-`dimensions.date_histogram.field` | Specify the date field used in date histogram aggregation. | `string` | No
-`dimensions.date_histogram.timezone` | Specify the timezones as defined by the IANA Time Zone Database. The default is UTC. | `string` | No
-`dimensions.terms` | Specify the term aggregations that you want to roll up. | `object` | No
-`dimensions.terms.fields` | Specify terms aggregation for compatible fields. | `object` | No
-`dimensions.histogram` | Specify the histogram aggregations that you want to roll up. | `object` | No
-`dimensions.histogram.field` | Add a field for histogram aggregations. | `string` | Yes
-`dimensions.histogram.interval` | Specify the histogram aggregation interval for the field. | `long` | Yes
-`dimensions.metrics` | Specify a list of objects that represent the fields and metrics that you want to calculate. | `nested object` | No
-`dimensions.metrics.field` | Specify the field that you want to perform metric aggregations on. | `string` | No
-`dimensions.metrics.field.metrics` | Specify the metric aggregations you want to calculate for the field. | `multiple strings` | No
+`source_index` |  The name of the detector. | String | Yes
+`target_index` |  Specify the target index that the rolled up data is ingested into. You could either create a new target index or use an existing index. The target index cannot be a combination of raw and rolled up data. | String | Yes
+`schedule` |  Schedule of the index rollup job which can be an interval or a cron expression. | Object | Yes
+`schedule.interval`  |  Specify the frequency of execution of the rollup job. | Object | No
+`schedule.interval.start_time` | Start time of the interval. | Timestamp | Yes
+`schedule.interval.period` |  Define the interval period. | String | Yes
+`schedule.interval.unit` | Specify the time unit of the interval. | String | Yes
+`schedule.interval.cron` | Optionally, specify a cron expression to define therollup frequency. | List | No
+`schedule.interval.cron.expression` | Specify a Unix cron expression. | String | Yes
+`schedule.interval.cron.timezone` | Specify timezones as defined by the IANA Time Zone Database. Defaults to UTC. | String | No
+`description` | Optionally, describe the rollup job. | String | No
+`enabled` | When true, the index rollup job is scheduled. Default is true. | Boolean | Yes
+`continuous` | Specify whether or not the index rollup job continuously rolls up data forever or just executes over the current data set once and stops. Default is false. | Boolean | Yes
+`error_notification` | Set up a Mustache message template sent for error notifications. For example, if an index rollup job fails, the system sends a message to a Slack channel. | Object | No
+`page_size` | Specify the number of buckets to paginate through at a time while rolling up. | Number | Yes
+`delay` | The number of milliseconds to delay execution of the index rollup job. | Long | No
+`dimensions` | Specify aggregations to create dimensions for the roll up time window. | Object | Yes
+`dimensions.date_histogram` | Specify either fixed_interval or calendar_interval, but not both. Either one limits what you can query in the target index. | Object | No
+`dimensions.date_histogram.fixed_interval` | Specify the fixed interval for aggregations in milliseconds, seconds, minutes, hours, or days. | String | No
+`dimensions.date_histogram.calendar_interval` | Specify the calendar interval for aggregations in minutes, hours, days, weeks, months, quarters, or years. | String | No
+`dimensions.date_histogram.field` | Specify the date field used in date histogram aggregation. | String | No
+`dimensions.date_histogram.timezone` | Specify the timezones as defined by the IANA Time Zone Database. The default is UTC. | String | No
+`dimensions.terms` | Specify the term aggregations that you want to roll up. | Object | No
+`dimensions.terms.fields` | Specify terms aggregation for compatible fields. | Object | No
+`dimensions.histogram` | Specify the histogram aggregations that you want to roll up. | Object | No
+`dimensions.histogram.field` | Add a field for histogram aggregations. | String | Yes
+`dimensions.histogram.interval` | Specify the histogram aggregation interval for the field. | Long | Yes
+`dimensions.metrics` | Specify a list of objects that represent the fields and metrics that you want to calculate. | Nested object | No
+`dimensions.metrics.field` | Specify the field that you want to perform metric aggregations on. | String | No
+`dimensions.metrics.field.metrics` | Specify the metric aggregations you want to calculate for the field. | Multiple strings | No


 #### Sample response
@@ -156,28 +156,6 @@ POST _reindex
 }
 ```

-## Reindex sorted documents
-
-You can copy certain documents after sorting specific fields in the document.
-
-This command copies the last 10 documents based on the `timestamp` field:
-
-```json
-POST _reindex
-{
-   "size":10,
-   "source":{
-      "index":"source",
-      "sort":{
-         "timestamp":"desc"
-      }
-   },
-   "dest":{
-      "index":"destination"
-   }
-}
-```
-
 ## Transform documents during reindexing

 You can transform your data during the reindexing process using the `script` option.
@@ -272,7 +250,6 @@ Option | Valid values | Description | Required
 `query` | Object | The search query to use for the reindex operation. | No
 `size` | Integer | The number of documents to reindex. | No
 `slice` | String | Specify manual or automatic slicing to parallelize reindexing. | No
-`sort` | List | Sort specific fields in the document before reindexing. | No

 ## Destination index options

@@ -0,0 +1,121 @@
+---
+layout: default
+title: Reindex
+parent: Document APIs
+grand_parent: REST API reference
+nav_order: 60
+---
+
+# Index document
+Introduced 1.0
+{: .label .label-purple}
+
+The reindex API operation lets you copy all or a subset of your data from a source index into a destination index.
+
+## Example
+
+```json
+POST /_reindex
+{
+   "source":{
+      "index":"my-source-index"
+   },
+   "dest":{
+      "index":"my-destination-index"
+   }
+}
+```
+
+## Path and HTTP methods
+
+```
+POST /_reindex
+```
+
+## URL parameters
+
+All URL parameters are optional.
+
+Parameter | Type | Description
+:--- | :--- | :---
+refresh | Boolean | If true, OpenSearch refreshes shards to make the reindex operation available to search results. Valid options are `true`, `false`, and `wait_for`, which tells OpenSearch to wait for a refresh before executing the operation. Default is `false`.
+timeout | Time | How long to wait for a response from the cluster. Default is `30s`.
+wait_for_active_shards | String | The number of active shards that must be available before OpenSearch processes the reindex request. Default is 1 (only the primary shard). Set to `all` or a positive integer. Values greater than 1 require replicas. For example, if you specify a value of 3, the index must have two replicas distributed across two additional nodes for the operation to succeed.
+wait_for_completion | Boolean | Waits for the matching tasks to complete. Default is `false`.
+requests_per_second | Integer | Specifies the request’s throttling in sub-requests per second. Default is -1, which means no throttling.
+require_alias | Boolean | Whether the destination index must be an index alias. Default is false.
+scroll | Time | How long to keep the search context open. Default is `5m`.
+slices | Integer | Number of sub-tasks OpenSearch should divide this task into. Default is 1, which means OpenSearch should not divide this task. Setting this parameter to `auto` indicates to OpenSearch that it should automatically decide how many slices to split the task into.
+max_docs | Integer | How many documents the update by query operation should process at most. Default is all documents.
+
+## Request body
+
+Your request body must contain the names of the source index and destination index. All other fields are optional.
+
+Field | Description
+:--- | :---
+conflicts | Indicates to OpenSearch what should happen if the delete by query operation runs into a version conflict. Valid options are `abort` and `proceed`. Default is abort.
+source | Information about the source index to include. Valid fields are `index`, `max_docs`, `query`, `remote`, `size`, `slice`, and `_source`.
+index | The name of the source index to copy data from.
+max_docs | The maximum number of documents to reindex.
+query | The search query to use for the reindex operation.
+remote | Information about a remote OpenSearch cluster to copy data from. Valid fields are `host`, `username`, `password`, `socket_timeout`, and `connect_timeout`.
+host | Host URL of the OpenSearch cluster to copy data from.
+username | Username to authenticate with the remote cluster.
+password | Password to authenticate with the remote cluster.
+socket_timeout | The wait time for socket reads. Default is 30s.
+connect_timeout | The wait time for remote connection timeouts. Default is 30s.
+size | The number of documents to reindex.
+slice | Whether to manually or automatically slice the reindex operation so it executes in parallel.
+_source | Whether to reindex source fields. Speicfy a list of fields to reindex or true to reindex all fields. Default is true.
+id | The ID to associate with manual slicing.
+max | Maximum number of slices.
+dest | Information about the destination index. Valid values are `index`, `version_type`, and `op_type`.
+index | Name of the destination index.
+version_type | The indexing operation's version type. Valid values are `internal`, `external`, `external_gt` (retrieve the document if the specified version number is greater than the document’s current version), and `external_gte` (retrieve the document if the specified version number is greater or equal to than the document’s current version).
+op_type | Whether to copy over documents that are missing in the destination index. Valid values are `create` (ignore documents with the same ID from the source index) and `index` (copy everything from the source index).
+script | A script that OpenSearch uses to apply transformations to the data during the reindex operation.
+source | The actual script that OpenSearch runs.
+lang | The scripting language. Valid options are `painless`, `expression`, `mustache`, and `java`.
+
+## Response
+```json
+{
+    "took": 28829,
+    "timed_out": false,
+    "total": 111396,
+    "updated": 0,
+    "created": 111396,
+    "deleted": 0,
+    "batches": 112,
+    "version_conflicts": 0,
+    "noops": 0,
+    "retries": {
+        "bulk": 0,
+        "search": 0
+    },
+    "throttled_millis": 0,
+    "requests_per_second": -1.0,
+    "throttled_until_millis": 0,
+    "failures": []
+}
+```
+
+## Response body fields
+
+Field | Description
+:--- | :---
+took | How long the operation took in milliseconds.
+timed_out | Whether the operation timed out.
+total | The total number of documents processed.
+updated | The number of documents updated in the destination index.
+created | The number of documents created in the destination index.
+deleted | The number of documents deleted.
+batches | Number of scroll responses.
+version_conflicts | Number of version conflicts.
+noops | How many documents OpenSearch ignored during the operation.
+retries | Number of bulk and search retry requests.
+throttled_millis | Number of throttled milliseconds during the request.
+requests_per_second | Number of requests executed per second during the operation.
+throttled_until_millis | The amount of time until OpenSearch executes the next throttled request.
+failures | Any failures that occurred during the operation.
@@ -0,0 +1,391 @@
+---
+layout: default
+title: API
+nav_order: 50
+---
+
+# Cross-cluster replication API
+
+Use these replication operations to programmatically manage cross-cluster replication.
+
+#### Table of contents
+- TOC
+{:toc}
+
+## Start replication
+Introduced 1.1
+{: .label .label-purple }
+
+Initiate replication of an index from the leader cluster to the follower cluster. Send this request to the follower cluster.
+
+
+#### Request
+
+```json
+PUT /_plugins/_replication/<follower-index>/_start
+{
+   "leader_alias":"<connection-alias-name>",
+   "leader_index":"<index-name>",
+   "use_roles":{
+      "leader_cluster_role":"<role-name>",
+      "follower_cluster_role":"<role-name>"
+   }
+}
+```
+
+Specify the following options:
+
+Options | Description | Type | Required
+:--- | :--- |:--- |:--- |
+`leader_alias` |  The name of the cross-cluster connection. You define this alias when you [set up a cross-cluster connection]({{site.url}}{{site.baseurl}}/replication-plugin/get-started/#set-up-a-cross-cluster-connection). | `string` | Yes
+`leader_index` |  The index on the leader cluster that you want to replicate. | `string` | Yes
+`use_roles` |  The roles to use for all subsequent backend replication tasks between the indices. Specify a `leader_cluster_role` and `follower_cluster_role`. See [Map the leader and follower cluster roles]({{site.url}}{{site.baseurl}}/replication-plugin/permissions/#map-the-leader-and-follower-cluster-roles). | `string` | If security plugin is enabled
+
+#### Sample response
+
+```json
+{
+   "acknowledged": true
+}
+```
+
+## Stop replication
+Introduced 1.1
+{: .label .label-purple }
+
+Terminates replication and converts the follower index to a standard index. Send this request to the follower cluster.
+
+#### Request
+
+```json
+POST /_plugins/_replication/<follower-index>/_stop
+{}
+```
+
+#### Sample response
+
+```json
+{
+   "acknowledged": true
+}
+```
+
+## Pause replication
+Introduced 1.1
+{: .label .label-purple }
+
+Pauses replication of the leader index. Send this request to the follower cluster.
+
+#### Request
+
+```json
+POST /_plugins/_replication/<follower-index>/_pause 
+{}
+```
+
+You can't resume replication after it's been paused for more than 12 hours. You must [stop replication]({{site.url}}{{site.baseurl}}/replication-plugin/api/#stop-replication), delete the follower index, and restart replication of the leader.
+
+#### Sample response
+
+```json
+{
+   "acknowledged": true
+}
+```
+
+## Resume replication
+Introduced 1.1
+{: .label .label-purple }
+
+Resumes replication of the leader index. Send this request to the follower cluster.
+
+#### Request
+
+```json
+POST /_plugins/_replication/<follower-index>/_resume
+{}
+```
+
+#### Sample response
+
+```json
+{
+   "acknowledged": true
+}
+```
+
+## Get replication status
+Introduced 1.1
+{: .label .label-purple }
+
+Gets the status of index replication. Possible statuses are `SYNCING`, `BOOTSTRAPING`, `PAUSED`, and `REPLICATION NOT IN PROGRESS`. Use the syncing details to measure replication lag. Send this request to the follower cluster.
+
+#### Request
+
+```json
+GET /_plugins/_replication/<follower-index>/_status
+```
+
+#### Sample response
+
+```json
+{
+  "status" : "SYNCING",
+  "reason" : "User initiated",
+  "leader_alias" : "my-connection-name",
+  "leader_index" : "leader-01",
+  "follower_index" : "follower-01",
+  "syncing_details" : {
+    "leader_checkpoint" : 19,
+    "follower_checkpoint" : 19,
+    "seq_no" : 0
+  }
+}
+```
+To include shard replication details in the response, add the `&verbose=true` parameter.
+
+The leader and follower checkpoint values begin as negative integers and reflect the shard count (-1 for one shard, -5 for five shards, and so on). The values increment toward positive integers with each change that you make. For example, when you make a change on the leader index, the `leader_checkpoint` becomes `0`. The `follower_checkpoint` is initially still `-1` until the follower index pulls the change from the leader, at which point it increments to `0`. If the values are the same, it means the indices are fully synced.
+
+## Get leader cluster stats
+Introduced 1.1
+{: .label .label-purple }
+
+Gets information about replicated leader indices on a specified cluster. 
+
+#### Request
+
+```json
+GET /_plugins/_replication/leader_stats
+```
+
+#### Sample response
+
+```json
+{
+   "num_replicated_indices": 2,
+   "operations_read": 15,
+   "translog_size_bytes": 1355,
+   "operations_read_lucene": 0,
+   "operations_read_translog": 15,
+   "total_read_time_lucene_millis": 0,
+   "total_read_time_translog_millis": 659,
+   "bytes_read": 1000,
+   "index_stats":{
+      "leader-index-1":{
+         "operations_read": 7,
+         "translog_size_bytes": 639,
+         "operations_read_lucene": 0,
+         "operations_read_translog": 7,
+         "total_read_time_lucene_millis": 0,
+         "total_read_time_translog_millis": 353,
+         "bytes_read":466
+      },
+      "leader-index-2":{
+         "operations_read": 8,
+         "translog_size_bytes": 716,
+         "operations_read_lucene": 0,
+         "operations_read_translog": 8,
+         "total_read_time_lucene_millis": 0,
+         "total_read_time_translog_millis": 306,
+         "bytes_read": 534
+      }
+   }
+}
+```
+
+## Get follower cluster stats
+Introduced 1.1
+{: .label .label-purple }
+
+Gets information about follower (syncing) indices on a specified cluster. 
+
+#### Request
+
+```json
+GET /_plugins/_replication/follower_stats
+```
+
+#### Sample response
+
+```json
+{
+   "num_syncing_indices": 2,
+   "num_bootstrapping_indices": 0,
+   "num_paused_indices": 0,
+   "num_failed_indices": 0,
+   "num_shard_tasks": 2,
+   "num_index_tasks": 2,
+   "operations_written": 3,
+   "operations_read": 3,
+   "failed_read_requests": 0,
+   "throttled_read_requests": 0,
+   "failed_write_requests": 0,
+   "throttled_write_requests": 0,
+   "follower_checkpoint": 1,
+   "leader_checkpoint": 1,
+   "total_write_time_millis": 2290,
+   "index_stats":{
+      "follower-index-1":{
+         "operations_written": 2,
+         "operations_read": 2,
+         "failed_read_requests": 0,
+         "throttled_read_requests": 0,
+         "failed_write_requests": 0,
+         "throttled_write_requests": 0,
+         "follower_checkpoint": 1,
+         "leader_checkpoint": 1,
+         "total_write_time_millis": 1355
+      },
+      "follower-index-2":{
+         "operations_written": 1,
+         "operations_read": 1,
+         "failed_read_requests": 0,
+         "throttled_read_requests": 0,
+         "failed_write_requests": 0,
+         "throttled_write_requests": 0,
+         "follower_checkpoint": 0,
+         "leader_checkpoint": 0,
+         "total_write_time_millis": 935
+      }
+   }
+}
+```
+
+## Get auto-follow stats
+Introduced 1.1
+{: .label .label-purple }
+
+Gets information about auto-follow activity and any replication rules configured on the specified cluster.
+
+#### Request
+
+```json
+GET /_plugins/_replication/autofollow_stats
+```
+
+#### Sample response
+
+```json
+{
+   "num_success_start_replication": 2,
+   "num_failed_start_replication": 0,
+   "num_failed_leader_calls": 0,
+   "failed_indices":[
+      
+   ],
+   "autofollow_stats":[
+      {
+         "name":"my-replication-rule",
+         "pattern":"movies*",
+         "num_success_start_replication": 2,
+         "num_failed_start_replication": 0,
+         "num_failed_leader_calls": 0,
+         "failed_indices":[
+            
+         ]
+      }
+   ]
+}
+```
+
+## Update settings
+Introduced 1.1
+{: .label .label-purple }
+
+Updates settings on the follower index.
+
+#### Request
+
+```json
+PUT /_plugins/_replication/<follower-index>/_update
+{
+   "settings":{
+      "index.number_of_shards": 4,
+      "index.number_of_replicas": 2
+   }
+}
+```
+
+#### Sample response
+
+```json
+{
+   "acknowledged": true
+}
+```
+
+## Create replication rule
+Introduced 1.1
+{: .label .label-purple }
+
+Automatically starts replication on indices matching a specified pattern. If a new index on the leader cluster matches the pattern, OpenSearch automatically creates a follower index and begins replication. You can also use this API to update existing replication rules.
+
+Send this request to the follower cluster.
+
+Make sure to note the names of all auto-follow patterns after you create them. The replication plugin currently does not include an API operation to retrieve a list of existing patterns.
+{: .tip }
+
+#### Request
+
+```json
+POST /_plugins/_replication/_autofollow
+{
+   "leader_alias" : "<connection-alias-name>",
+   "name": "<auto-follow-pattern-name>",
+   "pattern": "<pattern>",
+   "use_roles":{
+      "leader_cluster_role": "<role-name>",
+      "follower_cluster_role": "<role-name>"
+   }
+}
+```
+
+Specify the following options:
+
+Options | Description | Type | Required
+:--- | :--- |:--- |:--- |
+`leader_alias` |  The name of the cross-cluster connection. You define this alias when you [set up a cross-cluster connection]({{site.url}}{{site.baseurl}}/replication-plugin/get-started/#set-up-a-cross-cluster-connection). | `string` | Yes
+`name` |  A name for the auto-follow pattern. | `string` | Yes
+`pattern` |  An array of index patterns to match against indices in the specified leader cluster. Supports wildcard characters. For example, `leader-*`. | `string` | Yes
+`use_roles` |  The roles to use for all subsequent backend replication tasks between the indices. Specify a `leader_cluster_role` and `follower_cluster_role`. See [Map the leader and follower cluster roles]({{site.url}}{{site.baseurl}}/replication-plugin/permissions/#map-the-leader-and-follower-cluster-roles). | `string` | If security plugin is enabled
+
+#### Sample response
+
+```json
+{
+   "acknowledged": true
+}
+```
+
+## Delete replication rule
+Introduced 1.1
+{: .label .label-purple }
+
+Deletes the specified replication rule. This operation prevents any new indices from being replicated but does not stop existing replication that the rule has already initiated.
+
+Send this request to the follower cluster.
+
+#### Request
+
+```json
+DELETE /_plugins/_replication/_autofollow
+{
+   "leader_alias" : "<connection-alias-name>",
+   "name": "<auto-follow-pattern-name>",
+}
+```
+
+Specify the following options:
+
+Options | Description | Type | Required
+:--- | :--- |:--- |:--- |
+`leader_alias` |  The name of the cross-cluster connection. You define this alias when you [set up a cross-cluster connection]({{site.url}}{{site.baseurl}}/replication-plugin/get-started/#set-up-a-cross-cluster-connection). | `string` | Yes
+`name` |  The name of the pattern. | `string` | Yes
+
+#### Sample response
+
+```json
+{
+   "acknowledged": true
+}
+```
@@ -0,0 +1,104 @@
+---
+layout: default
+title: Auto-follow
+nav_order: 20
+has_children: false
+
+---
+
+# Auto-follow for cross-cluster replication
+
+Auto-follow lets you automatically replicate indices created on the leader cluster based on matching patterns. When you create an index on the leader cluster with a name that matches a specified pattern (for example, `index-01*`), a corresponding follower index is automatically created on the follower cluster. 
+
+You can configure multiple replication rules for a single cluster. The patterns currently only support wildcard matching. 
+
+## Prerequisites
+
+You need to [set up a cross-cluster connection]({{site.url}}{{site.baseurl}}/replication-plugin/get-started/#set-up-a-cross-cluster-connection) between two clusters before you can enable auto-follow. 
+
+## Permissions
+
+If the security plugin is enabled, non-admin users need to be mapped to the appropriate permissions in order to perform replication actions. For index and cluster-level permissions requirements, see [Cross-cluster replication permissions]({{site.url}}{{site.baseurl}}/replication-plugin/permissions/).
+
+## Get started with auto-follow
+
+Replication rules are a collection of patterns that you create against a single remote cluster. When you create a replication rule, it automatically starts replicating any *new* indices that match the pattern, but does not replicate matching indices that were previously created. 
+
+Create a replication rule on the follower cluster:
+
+```bash
+curl -XPOST -k -H 'Content-Type: application/json' -u 'admin:admin' 'https://localhost:9200/_plugins/_replication/_autofollow?pretty' -d '
+{
+   "leader_alias" : "my-connection-alias",
+   "name": "my-replication-rule",
+   "pattern": "movies*",
+   "use_roles":{
+      "leader_cluster_role": "all_access",
+      "follower_cluster_role": "all_access"
+   }
+}'
+```
+
+If the security plugin is disabled, you can leave out the `use_roles` parameter. If it's enabled, however, you need to specify the leader and follower cluster roles that OpenSearch uses to authenticate requests. This example uses `all_access` for simplicity, but we recommend creating a replication user on each cluster and [mapping it accordingly]({{site.url}}{{site.baseurl}}/replication-plugin/permissions/#map-the-leader-and-follower-cluster-roles).
+{: .tip }
+
+To test the rule, create a matching index on the leader cluster:
+
+```bash
+curl -XPUT -k -H 'Content-Type: application/json' -u 'admin:admin' 'https://localhost:9201/movies-0001?pretty'
+```
+
+And confirm its replica shows up on the follower cluster:
+
+```bash
+curl -XGET -u 'admin:admin' -k 'https://localhost:9200/_cat/indices?v'
+```
+
+It might take several seconds for the index to appear.
+
+```bash
+health status index        uuid                     pri rep docs.count docs.deleted store.size pri.store.size
+yellow open   movies-0001  kHOxYYHxRMeszLjTD9rvSQ     1   1          0            0       208b           208b
+```
+
+## Retrieve replication rules
+
+To retrieve a list of existing replication rules configured on a cluster, send the following request:
+
+```bash
+curl -XGET -u 'admin:admin' -k 'https://localhost:9200/_plugins/_replication/autofollow_stats'
+
+{
+   "num_success_start_replication": 1,
+   "num_failed_start_replication": 0,
+   "num_failed_leader_calls": 0,
+   "failed_indices":[
+      
+   ],
+   "autofollow_stats":[
+      {
+         "name":"my-replication-rule",
+         "pattern":"movies*",
+         "num_success_start_replication": 1,
+         "num_failed_start_replication": 0,
+         "num_failed_leader_calls": 0,
+         "failed_indices":[
+            
+         ]
+      }
+   ]
+}
+```
+
+## Delete a replication rule
+
+When you delete a replication rule, OpenSearch stops replicating *new* indices that match the pattern, but existing indices that the rule previously created continue to replicate. If you need to stop existing replication activity, use the [stop replication API operation]({{site.url}}{{site.baseurl}}/replication-plugin/api/#stop-replication).
+
+```bash
+curl -XDELETE -k -H 'Content-Type: application/json' -u 'admin:admin' 'https://localhost:9200/_plugins/_replication/_autofollow?pretty' -d '
+{
+   "leader_alias" : "my-conection-alias",
+   "name": "my-replication-rule"
+}'
+```
+
@@ -0,0 +1,273 @@
+---
+layout: default
+title: Get started
+nav_order: 10
+---
+
+# Get started with cross-cluster replication
+
+With cross-cluster replication, you index data to a leader index, and OpenSearch replicates that data to one or more read-only follower indices. All subsequent operations on the leader are replicated on the follower, such as creating, updating, or deleting documents.
+
+## Prerequisites
+
+Cross-cluster replication has the following prerequisites:
+- Both the leader and follower cluster must have the replication plugin installed.
+- If you've overridden `node.roles` in `opensearch.yml` on the remote cluster, make sure it also includes the `remote_cluster_client` role:
+
+   ```yaml
+   node.roles: [<other_roles>, remote_cluster_client]
+   ```
+
+## Permissions
+
+Make sure the security plugin is either enabled on both clusters or disabled on both clusters. If you disabled the security plugin, you can skip this section. However, we strongly recommend enabling the security plugin in production scenarios.
+
+If the security plugin is enabled, non-admin users need to be mapped to the appropriate permissions in order to perform replication actions. For index and cluster-level permissions requirements, see [Cross-cluster replication permissions]({{site.url}}{{site.baseurl}}/replication-plugin/permissions/).
+
+In addition, add the following setting to `opensearch.yml` on the leader cluster so it allows connections from the follower cluster: 
+
+```yml
+plugins.security.nodes_dn_dynamic_config_enabled: true
+```
+
+## Example setup
+
+Save this sample file as `docker-compose.yml` and run `docker-compose up` to start two single-node clusters on the same network:
+
+```yml
+version: '3'
+services:
+  replication-node1:
+    image: opensearchproject/opensearch:{{site.opensearch_version}}
+    container_name: replication-node1
+    environment:
+      - cluster.name=leader-cluster
+      - discovery.type=single-node
+      - bootstrap.memory_lock=true
+      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+    volumes:
+      - opensearch-data2:/usr/share/opensearch/data
+    ports:
+      - 9201:9200
+      - 9700:9600 # required for Performance Analyzer
+    networks:
+      - opensearch-net
+  replication-node2:
+    image: opensearchproject/opensearch:{{site.opensearch_version}}
+    container_name: replication-node2
+    environment:
+      - cluster.name=follower-cluster
+      - discovery.type=single-node
+      - bootstrap.memory_lock=true
+      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+    volumes:
+      - opensearch-data1:/usr/share/opensearch/data
+    ports:
+      - 9200:9200
+      - 9600:9600 # required for Performance Analyzer
+    networks:
+      - opensearch-net
+
+volumes:
+  opensearch-data1:
+  opensearch-data2:
+
+networks:
+  opensearch-net:
+```
+
+After the clusters start, verify the names of each:
+
+```bash
+curl -XGET -u 'admin:admin' -k 'https://localhost:9201'
+{
+  "cluster_name" : "leader-cluster",
+  ...
+}
+
+curl -XGET -u 'admin:admin' -k 'https://localhost:9200'
+{
+  "cluster_name" : "follower-cluster",
+  ...
+}
+```
+
+For this example, use port 9201 (`replication-node1`) as the leader and port 9200 (`replication-node2`) as the follower cluster.
+
+To get the IP address for the leader cluster, first identify its container ID:
+
+```bash
+docker ps
+CONTAINER ID    IMAGE                                       PORTS                                                      NAMES
+3b8cdc698be5    opensearchproject/opensearch:{{site.opensearch_version}}   0.0.0.0:9200->9200/tcp, 0.0.0.0:9600->9600/tcp, 9300/tcp   replication-node2
+731f5e8b0f4b    opensearchproject/opensearch:{{site.opensearch_version}}   9300/tcp, 0.0.0.0:9201->9200/tcp, 0.0.0.0:9700->9600/tcp   replication-node1
+```
+
+Then get that container's IP address:
+
+```bash
+docker inspect --format='{% raw %}{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}{% endraw %}' 731f5e8b0f4b
+172.22.0.3
+```
+
+## Set up a cross-cluster connection
+
+Cross-cluster replication follows a "pull" model, so most changes occur on the follower cluster, not the leader cluster. 
+
+On the follower cluster, add the IP address (with port 9300) for each seed node. Because this is a single-node cluster, you only have one seed node. Provide a descriptive name for the connection, which you'll use in the request to start replication:
+
+```bash
+curl -XPUT -k -H 'Content-Type: application/json' -u 'admin:admin' 'https://localhost:9200/_cluster/settings?pretty' -d '
+{
+  "persistent": {
+    "cluster": {
+      "remote": {
+        "my-connection-alias": {
+          "seeds": ["172.22.0.3:9300"]
+        }
+      }
+    }
+  }
+}'
+```
+
+## Start replication
+
+To get started, create an index called `leader-01` on the leader cluster:
+
+```bash
+curl -XPUT -k -H 'Content-Type: application/json' -u 'admin:admin' 'https://localhost:9201/leader-01?pretty'
+```
+
+Then start replication from the follower cluster. In the request body, provide the connection name and leader index that you want to replicate, along with the security roles you want to use:
+
+```bash
+curl -XPUT -k -H 'Content-Type: application/json' -u 'admin:admin' 'https://localhost:9200/_plugins/_replication/follower-01/_start?pretty' -d '
+{
+   "leader_alias": "my-connection-alias",
+   "leader_index": "leader-01",
+   "use_roles":{
+      "leader_cluster_role": "all_access",
+      "follower_cluster_role": "all_access"
+   }
+}'
+```
+
+If the security plugin is disabled, omit the `use_roles` parameter. If it's enabled, however, you must specify the leader and follower cluster roles that OpenSearch will use to authenticate the request. This example uses `all_access` for simplicity, but we recommend creating a replication user on each cluster and [mapping it accordingly]({{site.url}}{{site.baseurl}}/replication-plugin/permissions/#map-the-leader-and-follower-cluster-roles).
+{: .tip }
+
+This command creates an identical read-only index named `follower-01` on the local cluster that continuously stays updated with changes to the `leader-01` index on the remote cluster. Starting replication creates a follower index from scratch; you can't convert an existing index to a follower index. 
+
+## Confirm replication
+
+After replication starts, get the status:
+
+```bash
+curl -XGET -k -u 'admin:admin' 'https://localhost:9200/_plugins/_replication/follower-01/_status?pretty'
+
+{
+  "status" : "SYNCING",
+  "reason" : "User initiated",
+  "leader_alias" : "my-connection-alias",
+  "leader_index" : "leader-01",
+  "follower_index" : "follower-01",
+  "syncing_details" : {
+    "leader_checkpoint" : -1,
+    "follower_checkpoint" : -1,
+    "seq_no" : 0
+  }
+}
+```
+
+Possible statuses are `SYNCING`, `BOOTSTRAPING`, `PAUSED`, and `REPLICATION NOT IN PROGRESS`. 
+
+The leader and follower checkpoint values begin as negative numbers and reflect the shard count (-1 for one shard, -5 for five shards, and so on). The values increment with each change and illustrate how many updates the follower is behind the leader. If the indices are fully synced, the values are the same.
+
+To confirm that replication is actually happening, add a document to the leader index:
+
+```bash
+curl -XPUT -k -H 'Content-Type: application/json' -u 'admin:admin' 'https://localhost:9201/leader-01/_doc/1?pretty' -d '{"The Shining": "Stephen King"}'
+```
+
+Then validate the replicated content on the follower index:
+
+```bash
+curl -XGET -k -u 'admin:admin' 'https://localhost:9200/follower-01/_search?pretty'
+
+{
+  ...
+  "hits": [{
+    "_index": "follower-01",
+    "_type": "_doc",
+    "_id": "1",
+    "_score": 1.0,
+    "_source": {
+      "The Shining": "Stephen King"
+    }
+  }]
+}
+```
+
+## Pause and resume replication
+
+You can temporarily pause replication of an index if you need to remediate issues or reduce load on the leader cluster:
+
+```bash
+curl -XPOST -k -H 'Content-Type: application/json' -u 'admin:admin' 'https://localhost:9200/_plugins/_replication/follower-01/_pause?pretty' -d '{}'
+```
+
+To confirm replication is paused, get the status:
+
+```bash
+curl -XGET -k -u 'admin:admin' 'https://localhost:9200/_plugins/_replication/follower-01/_status?pretty'
+
+{
+  "status" : "PAUSED",
+  "reason" : "User initiated",
+  "leader_alias" : "my-connection-alias",
+  "leader_index" : "leader-01",
+  "follower_index" : "follower-01"
+}
+```
+
+When you're done making changes, resume replication:
+
+```bash
+curl -XPOST -k -H 'Content-Type: application/json' -u 'admin:admin' 'https://localhost:9200/_plugins/_replication/follower-01/_resume?pretty' -d '{}'
+```
+
+When replication resumes, the follower index picks up any changes that were made to the leader index while replication was paused.
+
+Note that you can't resume replication after it's been paused for more than 12 hours. You must [stop replication]({{site.url}}{{site.baseurl}}/replication-plugin/api/#stop-replication), delete the follower index, and restart replication of the leader.
+
+## Stop replication
+
+Terminate replication of a specified index from the follower cluster:
+
+```bash
+curl -XPOST -k -H 'Content-Type: application/json' -u 'admin:admin' 'https://localhost:9200/_plugins/_replication/follower-01/_stop?pretty' -d '{}'
+```
+
+When you stop replication, the follower index un-follows the leader and becomes a standard index that you can write to. You can't restart replication after stopping it. 
+
+Get the status to confirm that the index is no longer being replicated:
+
+```bash
+curl -XGET -k -u 'admin:admin' 'https://localhost:9200/_plugins/_replication/follower-01/_status?pretty'
+
+{
+  "status" : "REPLICATION NOT IN PROGRESS"
+}
+```
+
+You can further confirm that replication is stopped by making modifications to the leader index and confirming they don't show up on the follower index.
+
+
@@ -0,0 +1,22 @@
+---
+layout: default
+title: Cross-cluster replication
+nav_order: 1
+has_children: false
+
+---
+
+# Cross-cluster replication
+
+The cross-cluster replication plugin lets you replicate indices, mappings, and metadata from one OpenSearch cluster to another. Cross-cluster replication has the following benefits:
+- By replicating your indices, you ensure that you can continue to handle search requests in the event of an outage.
+- Replicating data across geographically distant data centers minimizes the distance between the data and the application server, reducing expensive latencies.
+- You can replicate data from multiple smaller clusters to a centralized reporting cluster, which is useful when it's inefficient to query across a large network.
+
+Replication follows an active-passive model where the follower index (where the data is replicated) pulls data from the leader (remote) index.
+
+The replication plugin supports replication of indices using wildcard pattern matching and provides commands to pause, resume, and stop replication. Once replication starts on an index, it initiates persistent background tasks on all primary shards on the follower cluster, which continuously poll corresponding shards from the leader cluster for updates.
+
+You can use the replication plugin with the security plugin to encrypt cross-cluster traffic with node-to-node encryption and control access to replication activities.
+
+To start, see [Get started with cross-cluster replication]({{site.url}}{{site.baseurl}}/replication-plugin/get-started/).
@@ -0,0 +1,78 @@
+---
+layout: default
+title: Permissions
+nav_order: 30
+---
+
+# Cross-cluster replication permissions
+
+You can use the [security plugin]({{site.url}}{{site.baseurl}}/security-plugin/index/) with cross-cluster replication to limit users to certain actions. For example, you might want certain users to only perform replication activity on the leader or follower cluster.
+
+Because cross-cluster replication involves multiple clusters, it's possible that clusters might have different security configurations. The following configurations are supported:
+
+- Security plugin fully enabled on both clusters
+- Security plugin enabled only for TLS on both clusters (`plugins.security.ssl_only`)
+- Security plugin absent or disabled on both clusters (not recommended)
+
+Enable node-to-node encryption on both the leader and the follower cluster to ensure that replication traffic between the clusters is encrypted.
+
+## Basic permissions
+
+In order for non-admin users to perform replication activities, they must be mapped to the appropriate permissions.  
+
+The security plugin has two built-in roles that cover most replication use cases: `cross_cluster_replication_leader_full_access`, which provides replication permissions on the leader cluster, and `cross_cluster_replication_follower_full_access`, which provides replication permissions on the follower cluster. For descriptions of each, see [Predefined roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/users-roles#predefined-roles).
+
+If you don't want to use the default roles, you can combine individual replication [permissions]({{site.url}}{{site.baseurl}}/replication-plugin/permissions/#replication-permissions) to meet your needs. Most permissions correspond to specific REST API operations. For example, the `indices:admin/plugins/replication/index/pause` permission lets you pause replication.
+
+## Map the leader and follower cluster roles
+
+The [start replication]({{site.url}}{{site.baseurl}}/replication-plugin/api/#start-replication) and [create replication rule]({{site.url}}{{site.baseurl}}/replication-plugin/api/#create-replication-rule) operations are special cases. They involve background processes on the leader and follower clusters that must be associated with roles. When you perform one of these actions, you must explicitly pass the `leader_cluster_role` and
+`follower_cluster_role` in the request, which OpenSearch then uses in all backend replication tasks.
+
+To enable non-admins to start replication and create replication rules, create an identical user on each cluster (for example, `replication_user`) and map them to the `cross_cluster_replication_leader_full_access` role on the remote cluster and `cross_cluster_replication_follower_full_access` on the follower cluster. For instructions, see [Map users to roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/users-roles/#map-users-to-roles).
+
+Then add those roles to the request, and sign it with the appropriate credentials:
+
+```bash
+curl -XPUT -k -H 'Content-Type: application/json' -u 'replication_user:password' 'https://localhost:9200/_plugins/_replication/follower-01/_start?pretty' -d '
+{
+   "leader_alias": "leader-cluster",
+   "leader_index": "leader-01",
+   "use_roles":{
+      "leader_cluster_role": "cross_cluster_replication_leader_full_access",
+      "follower_cluster_role": "cross_cluster_replication_follower_full_access"
+   }
+}'
+```
+
+You can create your own, custom leader and follower cluster roles using individual permissions, but we recommend using the default roles, which are a good fit for most use cases.
+
+## Replication permissions
+
+The following sections list the available index and cluster-level permissions for cross-cluster replication.
+
+### Follower cluster
+
+The security plugin supports these permissions for the follower cluster:
+
+```
+indices:admin/plugins/replication/index/setup/validate
+indices:admin/plugins/replication/index/start
+indices:admin/plugins/replication/index/pause
+indices:admin/plugins/replication/index/resume
+indices:admin/plugins/replication/index/stop
+indices:admin/plugins/replication/index/update
+indices:admin/plugins/replication/index/status_check
+indices:data/write/plugins/replication/changes
+cluster:admin/plugins/replication/autofollow/update
+```
+
+### Leader cluster
+
+The security plugin supports these permissions for the leader cluster:
+
+```
+indices:admin/plugins/replication/validate
+indices:data/read/plugins/replication/file_chunk
+indices:data/read/plugins/replication/changes
+```
@@ -0,0 +1,34 @@
+---
+layout: default
+title: Settings
+nav_order: 40
+---
+
+# Replication settings
+
+The replication plugin adds several settings to the standard OpenSearch cluster settings.
+The settings are dynamic, so you can change the default behavior of the plugin without restarting your cluster.
+You can mark settings as `persistent` or `transient`.
+
+For example, to update how often the follower cluster polls the leader cluster for updates:
+
+```json
+PUT _cluster/settings
+{
+  "persistent": {
+    "plugins.replication.follower.metadata_sync_interval": "30s"
+  }
+}
+```
+
+These settings manage the resources consumed by remote recoveries. We don’t recommend changing these settings; the defaults should work well for most use cases.
+
+Setting | Default | Description
+:--- | :--- | :---
+`plugins.replication.follower.index.recovery.chunk_size` | 10MB | The chunk size requested by the follower cluster during file transfer. Specify the chunk size as a value and unit, for example, 10MB, 5KB. See [Supported units]({{site.url}}{{site.baseurl}}/opensearch/units/).
+`plugins.replication.follower.index.recovery.max_concurrent_file_chunks` | 4 | The number of file chunk requests that can be sent in parallel for each recovery. 
+`plugins.replication.follower.index.ops_batch_size` | 5000 | The number of operations that can be fetched at a time during the syncing phase of replication.
+`plugins.replication.follower.concurrent_readers_per_shard` | 2 | The number of concurrent requests from the follower cluster per shard during the syncing phase of replication.
+`plugins.replication.autofollow.fetch_poll_interval` | 30s | How often auto-follow tasks poll the leader cluster for new matching indices.
+`plugins.replication.follower.metadata_sync_interval` | 60s | How often the follower cluster polls the leader cluster for updated index metadata.
+
@@ -1159,6 +1159,12 @@ Introduced 1.0

 Updates the existing configuration using the REST API. This operation can easily break your existing configuration, so we recommend using `securityadmin.sh` instead, which is far safer. See [Access control for the API](#access-control-for-the-api) for how to enable this operation.

+Before you can execute the operation, you must first add the following line to `opensearch.yml`:
+
+```yml
+plugins.security.unsupported.restapi.allow_securityconfig_modification: true
+```
+
 #### Request

 ```json
@@ -1179,6 +1185,106 @@ PATCH _plugins/_security/api/securityconfig
 }
 ```

+---
+
+## Distinguished names
+
+These REST APIs let a super admin add, retrieve, update, or delete any distinguished names from an allow list to enable communication between clusters and/or nodes.
+
+Before you can use the REST API to configure the allow list, you must first add the following line to `opensearch.yml`:
+
+```yml
+plugins.security.nodes_dn_dynamic_config_enabled: true
+```
+
+
+### Get distinguished names
+
+Retrieves all distinguished names in the allow list.
+
+#### Request
+
+```
+GET _plugins/_security/api/nodesdn
+```
+
+#### Sample response
+
+```json
+{
+  "cluster1": {
+    "nodes_dn": [
+      "CN=cluster1.example.com"
+    ]
+  }
+}
+```
+
+To get the distinguished names from a specific cluster's or node's allow list, include the cluster's name in the request path.
+
+#### Request
+
+```
+GET _plugins/_security/api/nodesdn/<cluster-name>
+```
+
+#### Sample response
+
+```json
+{
+  "cluster3": {
+    "nodes_dn": [
+      "CN=cluster3.example.com"
+    ]
+  }
+}
+```
+
+
+### Update distinguished names
+
+Adds or updates the specified distinguished names in the cluster's or node's allow list.
+
+#### Request
+
+```json
+PUT _plugins/_security/api/nodesdn/<cluster-name>
+{
+  "nodes_dn": [
+    "CN=cluster3.example.com"
+  ]
+}
+```
+
+#### Sample response
+
+```json
+{
+  "status": "CREATED",
+  "message": "'cluster3' created."
+}
+```
+
+
+### Delete distinguished names
+
+Deletes all distinguished names in the specified cluster's or node's allow list.
+
+#### Request
+
+```
+DELETE _plugins/_security/api/nodesdn/<cluster-name>
+```
+
+#### Sample response
+
+```json
+{
+  "status": "OK",
+  "message": "'cluster3' deleted."
+}
+```
+

 ---

@@ -1188,101 +1294,38 @@ PATCH _plugins/_security/api/securityconfig
 Introduced 1.0
 {: .label .label-purple }

-Retrieves the current security plugin configuration in JSON format.
+Retrieves the cluster's security certificates.

 #### Request

 ```
-GET _plugins/_security/api/securityconfig
-```
-
-
-### Update configuration
-Introduced 1.0
-{: .label .label-purple }
-
-Creates or updates the existing configuration using the REST API rather than `securityadmin.sh`. This operation can easily break your existing configuration, so we recommend using `securityadmin.sh` instead. See [Access control for the API](#access-control-for-the-api) for how to enable this operation.
-
-#### Request
-
-```json
-PUT _plugins/_security/api/securityconfig/config
-{
-  "dynamic": {
-    "filtered_alias_mode": "warn",
-    "disable_rest_auth": false,
-    "disable_intertransport_auth": false,
-    "respect_request_indices_options": false,
-    "opensearch-dashboards": {
-      "multitenancy_enabled": true,
-      "server_username": "kibanaserver",
-      "index": ".opensearch-dashboards"
-    },
-    "http": {
-      "anonymous_auth_enabled": false
-    },
-    "authc": {
-      "basic_internal_auth_domain": {
-        "http_enabled": true,
-        "transport_enabled": true,
-        "order": 0,
-        "http_authenticator": {
-          "challenge": true,
-          "type": "basic",
-          "config": {}
-        },
-        "authentication_backend": {
-          "type": "intern",
-          "config": {}
-        },
-        "description": "Authenticate via HTTP Basic against internal users database"
-      }
-    },
-    "auth_failure_listeners": {},
-    "do_not_fail_on_forbidden": false,
-    "multi_rolespan_enabled": true,
-    "hosts_resolver_mode": "ip-only",
-    "do_not_fail_on_forbidden_empty": false
-  }
-}
+GET _opendistro/_security/api/ssl/certs
 ```

 #### Sample response

 ```json
 {
-  "status": "OK",
-  "message": "'config' updated."
+  "http_certificates_list": [
+    {
+      "issuer_dn": "CN=Example Com Inc. Root CA,OU=Example Com Inc. Root CA,O=Example Com Inc.,DC=example,DC=com",
+      "subject_dn": "CN=node-0.example.com,OU=node,O=node,L=test,DC=de",
+      "san": "[[8, 1.2.3.4.5.5], [2, node-0.example.com]",
+      "not_before": "2018-04-22T03:43:47Z",
+      "not_after": "2028-04-19T03:43:47Z"
+    }
+  ],
+  "transport_certificates_list": [
+    {
+      "issuer_dn": "CN=Example Com Inc. Root CA,OU=Example Com Inc. Root CA,O=Example Com Inc.,DC=example,DC=com",
+      "subject_dn": "CN=node-0.example.com,OU=node,O=node,L=test,DC=de",
+      "san": "[[8, 1.2.3.4.5.5], [2, node-0.example.com]",
+      "not_before": "2018-04-22T03:43:47Z",
+      "not_after": "2028-04-19T03:43:47Z"
+    }
+  ]
 }
 ```
-
-
-### Patch configuration
-Introduced 1.0
-{: .label .label-purple }
-
-Updates the existing configuration using the REST API rather than `securityadmin.sh`. This operation can easily break your existing configuration, so we recommend using `securityadmin.sh` instead. See [Access control for the API](#access-control-for-the-api) for how to enable this operation.
-
-#### Request
-
-```json
-PATCH _plugins/_security/api/securityconfig
-[
-  {
-    "op": "replace", "path": "/config/dynamic/authc/basic_internal_auth_domain/transport_enabled", "value": "true"
-  }
-]
-```
-
-#### Sample response
-
-```json
-{
-  "status": "OK",
-  "message": "Resource updated."
-}
-```
-
 ---

 ## Cache
@@ -41,8 +41,8 @@ plugins.security.authcz.impersonation_dn:

 ## Impersonating Users

-To impersonate another user, submit a request to the system with the HTTP header `opensearch_security_impersonate_as` set to the name of the user to be impersonated. A good test is to make a GET request to the `_plugins/_security/authinfo` URI:
+To impersonate another user, submit a request to the system with the HTTP header `opendistro_security_impersonate_as` set to the name of the user to be impersonated. A good test is to make a GET request to the `_plugins/_security/authinfo` URI:

 ```bash
-curl -XGET -u 'admin:admin' -k -H "opensearch_security_impersonate_as: user_1" https://localhost:9200/_plugins/_security/authinfo?pretty
+curl -XGET -u 'admin:admin' -k -H "opendistro_security_impersonate_as: user_1" https://localhost:9200/_plugins/_security/authinfo?pretty
 ```
@@ -7,58 +7,130 @@ nav_order: 50

 # Permissions

-This page is a complete list of available permissions in the security plugin. Each permission controls access to a data type or API.
+Each permission in the security plugin controls access to some action that the OpenSearch cluster can perform, such as indexing a document or checking cluster health.

-Rather than creating new action groups from individual permissions, you can often achieve your desired security posture using some combination of the default action groups. To learn more, see [Default Action Groups]({{site.url}}{{site.baseurl}}/security-plugin/access-control/default-action-groups/).
+Most permissions are self-describing. For example, `cluster:admin/ingest/pipeline/get` lets you retrieve information about ingest pipelines. _In many cases_, a permission correlates to a specific REST API operation, such as `GET _ingest/pipeline`.
+
+Despite this correlation, permissions do **not** directly map to REST API operations. Operations such as `POST _bulk` and `GET _msearch` can access many indices and perform many actions in a single request. Even a simple request, such as `GET _cat/nodes`, performs several actions in order to generate its response.
+
+In short, controlling access to the REST API is insufficient. Instead, the security plugin controls access to the underlying OpenSearch actions.
+
+For example, consider the following `_bulk` request:
+
+```json
+POST _bulk
+{ "delete": { "_index": "test-index", "_id": "tt2229499" } }
+{ "index": { "_index": "test-index", "_id": "tt1979320" } }
+{ "title": "Rush", "year": 2013 }
+{ "create": { "_index": "test-index", "_id": "tt1392214" } }
+{ "title": "Prisoners", "year": 2013 }
+{ "update": { "_index": "test-index", "_id": "tt0816711" } }
+{ "doc" : { "title": "World War Z" } }
+
+```
+
+For this request to succeed, you must have the following permissions for `test-index`:
+
+- indices:data/write/bulk*
+- indices:data/write/delete
+- indices:data/write/index
+- indices:data/write/update
+
+These permissions also allow you add, update, or delete documents (e.g. `PUT test-index/_doc/tt0816711`), because they govern the underlying OpenSearch actions of indexing and deleting documents rather than a specific API path and HTTP method.
+
+
+## Test permissions
+
+If you want a user to have the absolute minimum set of permissions necessary to perform some function---the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege)----the best way is to send representative requests to your cluster as a new test user. In the case of a permissions error, the security plugin is very explicit about which permissions are missing. Consider this request and response:
+
+```json
+GET _cat/shards?v
+
+{
+  "error": {
+    "root_cause": [{
+      "type": "security_exception",
+      "reason": "no permissions for [indices:monitor/stats] and User [name=test-user, backend_roles=[], requestedTenant=null]"
+    }]
+  },
+  "status": 403
+}
+```
+
+[Create a user and a role]({{site.url}}{{site.baseurl}}/security-plugin/access-control/users-roles/), map the role to the user, and start sending signed requests using curl, Postman, or any other client. Then gradually add permissions to the role as you encounter errors. Even after you resolve one permissions error, the same request might generate new errors; the plugin only returns the first error it encounters, so keep trying until the request succeeds.
+
+Rather than individual permissions, you can often achieve your desired security posture using a combination of the default action groups. See [Default action groups]({{site.url}}{{site.baseurl}}/security-plugin/access-control/default-action-groups/) for descriptions of the permissions that each group grants.
 {: .tip }


-## Cluster
+## Cluster permissions
+
+These permissions are for the cluster and can't be applied granularly. For example, you either have permissions to take snapshots (`cluster:admin/snapshot/create`) or you don't. You can't have permissions to take snapshots only for certain indices.

 - cluster:admin/ingest/pipeline/delete
 - cluster:admin/ingest/pipeline/get
 - cluster:admin/ingest/pipeline/put
 - cluster:admin/ingest/pipeline/simulate
 - cluster:admin/ingest/processor/grok/get
- cluster:admin/opensearch/ad/detector/delete
- cluster:admin/opensearch/ad/detector/jobmanagement
- cluster:admin/opensearch/ad/detector/run
- cluster:admin/opensearch/ad/detector/search
- cluster:admin/opensearch/ad/detector/stats
- cluster:admin/opensearch/ad/detector/write
- cluster:admin/opensearch/ad/detectors/get
- cluster:admin/opensearch/ad/result/search
- cluster:admin/opensearch/alerting/alerts/ack
- cluster:admin/opensearch/alerting/alerts/get
- cluster:admin/opensearch/alerting/destination/delete
- cluster:admin/opensearch/alerting/destination/email_account/delete
- cluster:admin/opensearch/alerting/destination/email_account/get
- cluster:admin/opensearch/alerting/destination/email_account/search
- cluster:admin/opensearch/alerting/destination/email_account/write
- cluster:admin/opensearch/alerting/destination/email_group/delete
- cluster:admin/opensearch/alerting/destination/email_group/get
- cluster:admin/opensearch/alerting/destination/email_group/search
- cluster:admin/opensearch/alerting/destination/email_group/write
- cluster:admin/opensearch/alerting/destination/get
- cluster:admin/opensearch/alerting/destination/write
- cluster:admin/opensearch/alerting/monitor/delete
- cluster:admin/opensearch/alerting/monitor/execute
- cluster:admin/opensearch/alerting/monitor/get
- cluster:admin/opensearch/alerting/monitor/search
- cluster:admin/opensearch/alerting/monitor/write
- cluster:admin/opensearch/asynchronous_search/stats
- cluster:admin/opensearch/asynchronous_search/delete
- cluster:admin/opensearch/asynchronous_search/get
- cluster:admin/opensearch/asynchronous_search/submit
- cluster:admin/opensearch/reports/definition/create
- cluster:admin/opensearch/reports/definition/delete
- cluster:admin/opensearch/reports/definition/get
- cluster:admin/opensearch/reports/definition/list
- cluster:admin/opensearch/reports/definition/on_demand
- cluster:admin/opensearch/reports/definition/update
- cluster:admin/opensearch/reports/instance/get
- cluster:admin/opensearch/reports/instance/list
- cluster:admin/opensearch/reports/menu/download
+- cluster:admin/opendistro/ad/detector/delete
+- cluster:admin/opendistro/ad/detector/info
+- cluster:admin/opendistro/ad/detector/jobmanagement
+- cluster:admin/opendistro/ad/detector/preview
+- cluster:admin/opendistro/ad/detector/run
+- cluster:admin/opendistro/ad/detector/search
+- cluster:admin/opendistro/ad/detector/stats
+- cluster:admin/opendistro/ad/detector/write
+- cluster:admin/opendistro/ad/detectors/get
+- cluster:admin/opendistro/ad/result/search
+- cluster:admin/opendistro/ad/tasks/search
+- cluster:admin/opendistro/alerting/alerts/ack (acknowledge)
+- cluster:admin/opendistro/alerting/alerts/get
+- cluster:admin/opendistro/alerting/destination/delete
+- cluster:admin/opendistro/alerting/destination/email_account/delete
+- cluster:admin/opendistro/alerting/destination/email_account/get
+- cluster:admin/opendistro/alerting/destination/email_account/search
+- cluster:admin/opendistro/alerting/destination/email_account/write
+- cluster:admin/opendistro/alerting/destination/email_group/delete
+- cluster:admin/opendistro/alerting/destination/email_group/get
+- cluster:admin/opendistro/alerting/destination/email_group/search
+- cluster:admin/opendistro/alerting/destination/email_group/write
+- cluster:admin/opendistro/alerting/destination/get
+- cluster:admin/opendistro/alerting/destination/write
+- cluster:admin/opendistro/alerting/monitor/delete
+- cluster:admin/opendistro/alerting/monitor/execute
+- cluster:admin/opendistro/alerting/monitor/get
+- cluster:admin/opendistro/alerting/monitor/search
+- cluster:admin/opendistro/alerting/monitor/write
+- cluster:admin/opendistro/asynchronous_search/stats
+- cluster:admin/opendistro/asynchronous_search/delete
+- cluster:admin/opendistro/asynchronous_search/get
+- cluster:admin/opendistro/asynchronous_search/submit
+- cluster:admin/opendistro/ism/managedindex/add
+- cluster:admin/opendistro/ism/managedindex/change
+- cluster:admin/opendistro/ism/managedindex/remove
+- cluster:admin/opendistro/ism/managedindex/explain
+- cluster:admin/opendistro/ism/managedindex/retry
+- cluster:admin/opendistro/ism/policy/write
+- cluster:admin/opendistro/ism/policy/get
+- cluster:admin/opendistro/ism/policy/search
+- cluster:admin/opendistro/ism/policy/delete
+- cluster:admin/opendistro/rollup/index
+- cluster:admin/opendistro/rollup/get
+- cluster:admin/opendistro/rollup/search
+- cluster:admin/opendistro/rollup/delete
+- cluster:admin/opendistro/rollup/start
+- cluster:admin/opendistro/rollup/stop
+- cluster:admin/opendistro/rollup/explain
+- cluster:admin/opendistro/reports/definition/create
+- cluster:admin/opendistro/reports/definition/update
+- cluster:admin/opendistro/reports/definition/on_demand
+- cluster:admin/opendistro/reports/definition/delete
+- cluster:admin/opendistro/reports/definition/get
+- cluster:admin/opendistro/reports/definition/list
+- cluster:admin/opendistro/reports/instance/list
+- cluster:admin/opendistro/reports/instance/get
+- cluster:admin/opendistro/reports/menu/download
+- cluster:admin/plugins/replication/autofollow/update
 - cluster:admin/reindex/rethrottle
 - cluster:admin/repository/delete
 - cluster:admin/repository/get
@@ -94,7 +166,9 @@ Rather than creating new action groups from individual permissions, you can ofte
 - cluster:monitor/tasks/list


-## Indices
+## Index permissions
+
+These permissions apply to an index or index pattern. You might want a user to have read access to all indices (i.e. `*`), but write access to only a few (e.g. `web-logs` and `product-catalog`).

 - indices:admin/aliases
 - indices:admin/aliases/exists
@@ -102,18 +176,34 @@ Rather than creating new action groups from individual permissions, you can ofte
 - indices:admin/analyze
 - indices:admin/cache/clear
 - indices:admin/close
- indices:admin/create
- indices:admin/delete
+- indices:admin/close*
+- indices:admin/create (create indices)
+- indices:admin/data_stream/create
+- indices:admin/data_stream/delete
+- indices:admin/data_stream/get
+- indices:admin/delete (delete indices)
 - indices:admin/exists
 - indices:admin/flush
 - indices:admin/flush*
 - indices:admin/forcemerge
- indices:admin/get
+- indices:admin/get (retrieve index and mapping)
+- indices:admin/index_template/delete
+- indices:admin/index_template/get
+- indices:admin/index_template/put
+- indices:admin/index_template/simulate
+- indices:admin/index_template/simulate_index
 - indices:admin/mapping/put
 - indices:admin/mappings/fields/get
 - indices:admin/mappings/fields/get*
 - indices:admin/mappings/get
 - indices:admin/open
+- indices:admin/plugins/replication/index/setup/validate
+- indices:admin/plugins/replication/index/start
+- indices:admin/plugins/replication/index/pause
+- indices:admin/plugins/replication/index/resume
+- indices:admin/plugins/replication/index/stop
+- indices:admin/plugins/replication/index/update
+- indices:admin/plugins/replication/index/status_check
 - indices:admin/refresh
 - indices:admin/refresh*
 - indices:admin/resolve/index
@@ -137,22 +227,26 @@ Rather than creating new action groups from individual permissions, you can ofte
 - indices:data/read/mget*
 - indices:data/read/msearch
 - indices:data/read/msearch/template
- indices:data/read/mtv
+- indices:data/read/mtv (multi-term vectors)
 - indices:data/read/mtv*
+- indices:data/read/plugins/replication/file_chunk
+- indices:data/read/plugins/replication/changes
 - indices:data/read/scroll
 - indices:data/read/scroll/clear
 - indices:data/read/search
 - indices:data/read/search*
 - indices:data/read/search/template
- indices:data/read/tv
+- indices:data/read/tv (term vectors)
 - indices:data/write/bulk
 - indices:data/write/bulk*
- indices:data/write/delete
+- indices:data/write/delete (delete documents)
 - indices:data/write/delete/byquery
- indices:data/write/index
+- indices:data/write/plugins/replication/changes
+- indices:data/write/index (add documents to existing indices)
 - indices:data/write/reindex
 - indices:data/write/update
 - indices:data/write/update/byquery
+- indices:monitor/data_stream/stats
 - indices:monitor/recovery
 - indices:monitor/segments
 - indices:monitor/settings/get
@@ -109,6 +109,8 @@ Role | Description
 `anomaly_full_access` | Grants full permissions to all anomaly detection actions.
 `anomaly_read_access` | Grants permissions to view detectors, but not create, modify, or delete detectors.
 `all_access` | Grants full access to the cluster: all cluster-wide operations, write to all indices, write to all tenants.
+`cross_cluster_replication_follower_full_access` | Grants full access to perform cross-cluster replication actions on the follower cluster.
+`cross_cluster_replication_leader_full_access` | Grants full access to perform cross-cluster replication actions on the leader cluster.
 `kibana_read_only` | A special role that prevents users from making changes to visualizations, dashboards, and other OpenSearch Dashboards objects. See `opensearch_security.readonly_mode.roles` in `opensearch_dashboards.yml`. Pair with the `kibana_user` role.
 `kibana_user` | Grants permissions to use OpenSearch Dashboards: cluster-wide searches, index monitoring, and write to various OpenSearch Dashboards indices.
 `logstash` | Grants permissions for Logstash to interact with the cluster: cluster-wide searches, cluster monitoring, and write to the various Logstash indices.
@@ -11,7 +11,6 @@ Active Directory and LDAP can be used for both authentication and authorization

 In most cases, you want to configure both authentication and authorization. You can also use authentication only and map the users retrieved from LDAP directly to security plugin roles.

-{% comment %}

 ## Docker example

@@ -38,7 +37,7 @@ We provide a fully functional example that can help you understand how to use an
 1. Index a document as `psantos`:

   ```bash
-   curl -XPUT https://localhost:9200/new-index/_doc/1 -H 'Content-Type: application/json' -d '{"title": "Spirited Away"}' -u psantos:password -k
+   curl -XPUT 'https://localhost:9200/new-index/_doc/1' -H 'Content-Type: application/json' -d '{"title": "Spirited Away"}' -u 'psantos:password' -k
   ```

   If you try the same request as `jroe`, it fails. The `Developers` group is mapped to the `readall`, `manage_snapshots`, and `kibana_user` roles and has no write permissions.
@@ -46,14 +45,13 @@ We provide a fully functional example that can help you understand how to use an
 1. Search for the document as `jroe`:

   ```bash
-   curl -XGET https://localhost:9200/new-index/_search?pretty -u jroe:password -k
+   curl -XGET 'https://localhost:9200/new-index/_search?pretty' -u 'jroe:password' -k
   ```

   This request succeeds, because the `Developers` group is mapped to the `readall` role.

 1. If you want to examine the contents of the various containers, run `docker ps` to find the container ID and then `docker exec -it <container-id> /bin/bash`.

-{% endcomment %}

 ## Connection settings

@@ -11,7 +11,6 @@ The security plugin supports user authentication through SAML single sign-on. Th

 This profile is meant for use with web browsers. It is not a general-purpose way of authenticating users against the security plugin, so its primary use case is to support OpenSearch Dashboards single sign-on.

-{% comment %}

 ## Docker example

@@ -35,7 +34,6 @@ We provide a fully functional example that can help you understand how to use SA

   In particular, you might find it helpful to review the contents of the `/var/www/simplesamlphp/config/` and `/var/www/simplesamlphp/metadata/` directories.

-{% endcomment %}

 ## Activating SAML

@@ -300,13 +298,13 @@ authc:

 Because most of the SAML-specific configuration is done in the security plugin, just activate SAML in your `opensearch_dashboards.yml` by adding the following:

-```
-plugins.security.auth.type: "saml"
+```yml
+opensearch_security.auth.type: "saml"
 ```

 In addition, the OpenSearch Dashboards endpoint for validating the SAML assertions must be whitelisted:

-```
+```yml
 server.xsrf.whitelist: ["/_plugins/_security/saml/acs"]
 ```

@@ -126,7 +126,7 @@ plugins.security.restapi.password_validation_error_message: "Password must be mi

 ## whitelist.yml

-You can use `whitelist.yml` to allow list any endpoints and HTTP requests. If enabled, all users except the SuperAdmin are allowed access to only the specified endpoints and HTTP requests, and all other HTTP requests associated with the endpoint are denied. For example, if GET `_cluster/settings` is allow listed, users cannot submit PUT requests to `_cluster/settings` to update cluster settings.
+You can use `whitelist.yml` to add any endpoints and HTTP requests to a list of allowed endpoints and requests. If enabled, all users except the super admin are allowed access to only the specified endpoints and HTTP requests, and all other HTTP requests associated with the endpoint are denied. For example, if GET `_cluster/settings` is added to the allow list, users cannot submit PUT requests to `_cluster/settings` to update cluster settings.

 Note that while you can configure access to endpoints this way, for most cases, it is still best to configure permissions using the security plugin's users and roles, which have more granular settings.

@@ -165,7 +165,7 @@ requests:
    - PUT
 ```

-You can also allow list custom indices. `whitelist.yml` doesn't support wildcards, so you must manually specify all of the indices you want to allow list.
+You can also add custom indices to the allow list. `whitelist.yml` doesn't support wildcards, so you must manually specify all of the indices you want to add.

 ```yml
 requests: # Only allow GET requests to /sample-index1/_doc/1 and /sample-index2/_doc/1
@@ -315,6 +315,10 @@ _meta:

 ## tenants.yml

+You can use this file to specify and add any number of OpenSearch Dashboards tenants to your OpenSearch cluster. For more information about tenants, see [OpenSearch Dashboards multi-tenancy]({{site.url}}{{site.baseurl}}/security-plugin/access-control/multi-tenancy).
+
+Like all of the other YAML files, we recommend you use `tenants.yml` to add any tenants you must have in your cluster, and then use OpenSearch Dashboards or the [REST API]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api/#tenants) if you need to further configure or create any other tenants.
+
 ```yml
 ---
 _meta:
@@ -325,9 +329,12 @@ admin_tenant:
  description: "Demo tenant for admin user"
 ```

-
 ## nodes_dn.yml

+`nodes_dn.yml` lets you add certificates' [distinguished names (DNs)]({{site.url}}{{site.baseurl}}/security-plugin/configuration/generate-certificates/#add-distinguished-names-to-opensearchyml) an allow list to enable communication between any number of nodes and/or clusters. For example, a node that has the DN `CN=node1.example.com` in its allow list accepts communication from any other node or certificate that uses that DN.
+
+The DNs get indexed into a [system index]({{site.url}}{{site.baseurl}}/security-plugin/configuration/system-indices) that only a super admin or an admin with a Transport Layer Security (TLS) certificate can access. If you want to programmatically add DNs to your allow lists, use the [REST API]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api/#distinguished-names).
+
 ```yml
 ---
 _meta:
@@ -37,7 +37,7 @@ Component | Purpose
 [Anomaly Detection]({{site.url}}{{site.baseurl}}/monitoring-plugins/ad/) | Identify atypical data and receive automatic notifications
 [Asynchronous Search]({{site.url}}{{site.baseurl}}/search-plugins/async/) | Run search requests in the background

-Most of OpenSearch plugins have a corresponding OpenSearch Dashboards plugin that provide a convenient, unified user interface.
+Most OpenSearch plugins have corresponding OpenSearch Dashboards plugins that provide a convenient, unified user interface.

 For specifics around the project, see the [FAQ](https://opensearch.org/faq/).
Author	SHA1	Message	Date
Liz Snyder	79737566a9	Add stats APIs	2021-10-05 08:37:21 -07:00
Liz Snyder	f57469e0f7	Add back Docker sample	2021-10-04 17:08:58 -07:00
Liz Snyder	16e8e1bbc4	Clarify connection alias	2021-10-04 13:47:22 -07:00
Liz Snyder	cdff560cf6	Incorporate feedback and random fixes	2021-10-01 11:43:37 -07:00
Liz Snyder	8d3ae42f6a	Typo	2021-09-30 16:43:05 -07:00
Liz Snyder	214f82f1e3	Merge branch 'main' of https://github.com/opensearch-project/documentation-website into cross-cluster-replication	2021-09-30 16:22:36 -07:00
Liz Snyder	5862b1b300	First crack at CCR docs	2021-09-30 16:10:28 -07:00
aetter	c378da8799	Make name more explicit	2021-09-30 14:01:14 -07:00
aetter	7cb714894f	Nitpicks	2021-09-30 13:52:34 -07:00
Andrew Etter	7f9932f008	Merge pull request #158 from opensearch-project/go-opensearch Getting started content for Go	2021-09-30 13:49:29 -07:00
Andrew Etter	fff3b3ec2b	Merge pull request #159 from opensearch-project/js-client Node JS client overview docs	2021-09-30 13:49:19 -07:00
Andrew Etter	1a901d2033	Merge pull request #150 from opensearch-project/python-client Getting started content for Python and general client compatibility information	2021-09-30 13:49:07 -07:00
aetter	ab00a05549	Comment out Java for now	2021-09-30 13:48:32 -07:00
aetter	973d967514	Update impersonation.md	2021-09-29 14:57:46 -07:00
Keith Chan	dcb3a0c02d	Merge pull request #185 from opensearch-project/document-rest-apis Added reindex API to REST API reference	2021-09-29 10:31:26 -07:00
aetter	65d2ef4860	Re-add SAML example	2021-09-29 09:29:41 -07:00
aetter	d4c20f0402	Re-add LDAP Docker example Update Docker Compose file	2021-09-28 15:33:48 -07:00
aetter	9a5c8cd6ae	Wording change	2021-09-28 13:53:49 -07:00
Andrew Etter	48d1603ed1	Merge pull request #187 from opensearch-project/permissions-improvements Improve permissions introduction	2021-09-28 13:53:15 -07:00
aetter	01a9fb6d6d	Adding async back in, just in case	2021-09-28 11:10:36 -07:00
aetter	cbdefc2463	Improve permissions introduction Also corrects some permissions names that still use `opendistro`, adds missing permissions, adds some short () description to unclear permissions.	2021-09-28 10:54:04 -07:00
Keith Chan	a38eb15400	Merge pull request #183 from opensearch-project/security-yml-files Add descriptions to config yaml files and added some security APIs	2021-09-27 17:08:12 -07:00
keithhc2	dc69f8010b	Added a setting to enable patch configuration	2021-09-27 17:07:38 -07:00
Andrew Etter	268f1d9571	Merge pull request #174 from opensearch-project/rollups-delay-fix Update delay to milliseconds	2021-09-27 14:36:29 -07:00
Andrew Etter	f8cac33ebc	Merge pull request #186 from opensearch-project/ism_priority Added info about the priority value	2021-09-27 14:36:15 -07:00
keithhc2	7c425f102d	Added reindex API	2021-09-27 12:52:36 -07:00
keithhc2	c85fd21b4f	Addressed comments	2021-09-27 10:07:37 -07:00
keithhc2	430b9fed50	Added "security"	2021-09-24 14:53:33 -07:00
keithhc2	e8a863e943	Minor language tweak	2021-09-24 14:23:17 -07:00
keithhc2	b12dab6705	Add descriptions to config yaml files and added some security APIs	2021-09-24 14:13:26 -07:00
Liz Snyder	293743e15b	Missed one	2021-09-22 12:27:39 -07:00
Liz Snyder	2d228a86ca	Update client name	2021-09-22 12:26:41 -07:00
aetter	96f94c649e	Merge branch 'main' into python-client	2021-09-21 16:40:46 -07:00
aetter	66ca05e714	Update links	2021-09-21 13:56:25 -07:00
aetter	65f333d038	Update python.md	2021-09-21 13:40:38 -07:00
ashwinkumar12345	54a0b8e755	minor change	2021-09-20 13:29:58 -07:00
ashwinkumar12345	6bf8a7d51a	minor change	2021-09-20 13:27:13 -07:00
ashwinkumar12345	05ba9198f6	modified description	2021-09-20 13:22:18 -07:00
aetter	125585f04e	OK fine we can call it a number	2021-09-14 09:10:35 -07:00
aetter	ed8230cb02	Update delay to milliseconds, page_size to integer	2021-09-14 09:08:45 -07:00
aetter	50f3fa51d8	Update python.md	2021-09-10 15:01:43 -07:00
ashwinkumar12345	7aed3bfbf1	updated code to check error message	2021-08-27 14:00:26 -07:00
ashwinkumar12345	fbc0447bcd	added more context	2021-08-27 13:20:59 -07:00
Liz Snyder	18d3891879	Specify how to turn off cert verification	2021-08-26 15:23:06 -07:00
Liz Snyder	e210d7d217	Fix nav order to not conflict with Go	2021-08-26 13:36:12 -07:00
Liz Snyder	51d359ec40	Remove index refresh	2021-08-26 13:34:19 -07:00
Liz Snyder	4d39000cd3	Add command to install specific version	2021-08-26 12:51:04 -07:00
Liz Snyder	cea3ba7ce9	Getting started docs for javascript	2021-08-26 12:44:58 -07:00
aetter	c972869893	Link to pip, because why not	2021-08-26 11:50:46 -07:00
ashwinkumar12345	1c4f81eb53	minor fix	2021-08-26 11:41:09 -07:00
ashwinkumar12345	bfc56f2f7f	incorporated feedback	2021-08-26 11:39:32 -07:00
ashwinkumar12345	9a2e6ed028	spacing	2021-08-26 11:33:21 -07:00
aetter	ac9acb3c62	Adds some statements around compatibility Should (hopefully) apply to all clients.	2021-08-26 09:15:50 -07:00
ashwinkumar12345	12ce7e5fea	rough draft	2021-08-25 11:05:24 -07:00
aetter	30facfe628	Typo	2021-08-19 14:38:30 -07:00
aetter	9ce5d95786	Clean up spacing	2021-08-19 13:23:14 -07:00
aetter	0bf8624824	Getting started content for Python	2021-08-19 12:56:53 -07:00