Changed transform to rollup

_clients/javascript.md

@@ -1,141 +0,0 @@
----
-layout: default
-title: Javascript client
-nav_order: 90
----
-
-# Javascript client
-
-The OpenSearch Javascript client provides a safer and easier way to interact with your OpenSearch cluster. Rather than using OpenSearch from the browser and potentially exposing your data to the public, you can build an OpenSearch client that takes care of sending requests to your cluster.
-
-The client contains a library of APIs that let you perform different operations on your cluster and return a standard response body. The example here demonstrates some basic operations like creating an index, adding documents, and searching your data.
-
-## Setup
-
-To add the client to your project, install it from npm:
-
-```bash
-npm install @opensearch-project/opensearch
-```
-
-To install a specific major version of the client, run the following command:
-
-```bash
-npm install @opensearch-project/opensearch@<version>
-```
-
-If you prefer to add the client manually or just want to examine the source code, see [opensearch-js](https://github.com/opensearch-project/opensearch-js) on GitHub.
-
-Then require the client:
-
-```javascript
-const { Client } = require("@opensearch-project/opensearch");
-```
-
-## Sample code
-
-```javascript
-"use strict";
-
-var host = "localhost";
-var protocol = "https";
-var port = 9200;
-var auth = "admin:admin"; // For testing only. Don't store credentials in code.
-var ca_certs_path = "/full/path/to/root-ca.pem";
-
-// Optional client certificates if you don't want to use HTTP basic authentication.
-// var client_cert_path = '/full/path/to/client.pem'
-// var client_key_path = '/full/path/to/client-key.pem'
-
-// Create a client with SSL/TLS enabled.
-var { Client } = require("@opensearch-project/opensearch");
-var fs = require("fs");
-var client = new Client({
-  node: protocol + "://" + auth + "@" + host + ":" + port,
-  ssl: {
-    ca: fs.readFileSync(ca_certs_path),
-    // You can turn off certificate verification (rejectUnauthorized: false) if you're using self-signed certificates with a hostname mismatch.
-    // cert: fs.readFileSync(client_cert_path),
-    // key: fs.readFileSync(client_key_path)
-  },
-});
-
-async function search() {
-  // Create an index with non-default settings.
-  var index_name = "books";
-  var settings = {
-    settings: {
-      index: {
-        number_of_shards: 4,
-        number_of_replicas: 3,
-      },
-    },
-  };
-
-  var response = await client.indices.create({
-    index: index_name,
-    body: settings,
-  });
-
-  console.log("Creating index:");
-  console.log(response.body);
-
-  // Add a document to the index.
-  var document = {
-    title: "The Outsider",
-    author: "Stephen King",
-    year: "2018",
-    genre: "Crime fiction",
-  };
-
-  var id = "1";
-
-  var response = await client.index({
-    id: id,
-    index: index_name,
-    body: document,
-    refresh: true,
-  });
-
-  console.log("Adding document:");
-  console.log(response.body);
-
-  // Search for the document.
-  var query = {
-    query: {
-      match: {
-        title: {
-          query: "The Outsider",
-        },
-      },
-    },
-  };
-
-  var response = await client.search({
-    index: index_name,
-    body: query,
-  });
-
-  console.log("Search results:");
-  console.log(response.body.hits);
-
-  // Delete the document.
-  var response = await client.delete({
-    index: index_name,
-    id: id,
-  });
-
-  console.log("Deleting document:");
-  console.log(response.body);
-
-  // Delete the index.
-  var response = await client.indices.delete({
-    index: index_name,
-  });
-
-  console.log("Deleting index:");
-  console.log(response.body);
-}
-
-search().catch(console.log);
-```

_im-plugin/ism/api.md

@@ -2,7 +2,7 @@
 layout: default
 title: ISM API
 parent: Index State Management
-nav_order: 5
+nav_order: 20
 ---
 
 # ISM API

_im-plugin/ism/policies.md

@@ -347,7 +347,7 @@ Parameter | Description | Type | Required | Default
 
 ### allocation
 
-Allocate the index to a node with a specific attribute set [like this]({{site.url}}{{site.baseurl}}/opensearch/cluster/#advanced-step-7-set-up-a-hot-warm-architecture).
+Allocate the index to a node with a specific attribute.
 For example, setting `require` to `warm` moves your data only to "warm" nodes.
 
 The `allocation` operation has the following parameters:
@@ -363,7 +363,7 @@ Parameter | Description | Type | Required
 "actions": [
   {
     "allocation": {
-      "require": { "temp": "warm" }
+      "require": { "box_type": "warm" }
     }
   }
 ]

_im-plugin/refresh-analyzer/index.md

@@ -1,7 +1,7 @@
 ---
 layout: default
 title: Refresh search analyzer
-nav_order: 40
+nav_order: 50
 has_children: false
 redirect_from: /im-plugin/refresh-analyzer/
 has_toc: false

_im-plugin/security.md

@@ -0,0 +1,41 @@
+---
+layout: default
+title: Index management security
+nav_order: 40
+has_children: false
+---
+
+# Index management security
+
+Using the security plugin with index management lets you limit non-admin users to certain actions. For example, you might want to set up your security such that a group of users can only read ISM policies, while others can create, delete, or change policies.
+
+All index management data are protected as system indices, and only a super admin or an admin with a Transport Layer Security (TLS) certificate can access system indices. For more information, see [System indices]({{site.url}}{{site.baseurl}}/security-plugin/configuration/system-indices).
+
+## Basic permissions
+
+The security plugin comes with one role that offers full access to index management: `index_management_full_access`. For a description of the role's permissions, see [Predefined roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/users-roles#predefined-roles).
+
+With security enabled, users not only need the correct index management permissions, but they also need permissions to execute actions to involved indices. For example, if a user wants to use the REST API to attach a policy that executes a rollup job to an index named `system-logs`, they would need the permissions to attach a policy and execute a rollup job, as well as access to `system-logs`.
+
+Finally, with the exceptions of Create Policy, Get Policy, and Delete Policy, users also need the `indices:admin/opensearch/ism/managedindex` permission to execute [ISM APIs]({{site.url}}{{site.baseurl}}/im-plugin/ism/api).
+
+## (Advanced) Limit access by backend role
+
+You can use backend roles to configure fine-grained access to index management policies and actions. For example, users of different departments in an organization might view different policies depending on what roles and permissions they are assigned.
+
+First, ensure your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
+
+Use the REST API to enable the following setting:
+
+```json
+PUT _cluster/settings
+{
+  "transient": {
+    "plugins.index_management.filter_by_backend_roles": "true"
+  }
+}
+```
+
+With security enabled, only users who share at least one backend role can see and execute the policies and actions relevant to their roles.
+
+For example, consider a scenario with three users: `John` and `Jill`, who have the backend role `helpdesk_staff`, and `Jane`, who has the backend role `phone_operator`. `John` wants to create a policy that performs a rollup job on an index named `airline_data`, so `John` would need a backend role that has permissions to access that index, create relevant policies, and execute relevant actions, and `Jill` would be able to access the same index, policy, and job. However, `Jane` cannot access or edit those resources or actions.

_security-plugin/access-control/users-roles.md

@@ -121,6 +121,7 @@ Role | Description
 `reports_full_access` | Grants full permissions to reports.
 `asynchronous_search_full_access` | Grants full permissions to all asynchronous search actions.
 `asynchronous_search_read_access` | Grants permissions to view asynchronous searches, but not to submit, modify, or delete async searches.
+`index_management_full_access` | Grants full permissions to all index management actions, including ISM, transforms, and rollups.
 
 
 For more detailed summaries of the permissions for each role, reference their action groups against the descriptions in [Default action groups]({{site.url}}{{site.baseurl}}/security-plugin/access-control/default-action-groups/).