incorporated feedback

Add themed logo to README

README.md

@@ -1,6 +1,8 @@
+<img src="https://opensearch.org/assets/img/opensearch-logo-themed.svg" height="64px">
+
 # OpenSearch documentation
 
-This repository contains the documentation for OpenSearch, the search, analytics, and visualization suite with advanced security, alerting, SQL support, automated index management, deep performance analysis, and more. You can find the rendered documentation at [docs-beta.opensearch.org](https://docs-beta.opensearch.org).
+This repository contains the documentation for OpenSearch, the search, analytics, and visualization suite with advanced security, alerting, SQL support, automated index management, deep performance analysis, and more. You can find the rendered documentation at [opensearch.org/docs](https://opensearch.org/docs).
 
 Community contributions remain essential in keeping this documentation comprehensive, useful, well-organized, and up-to-date.
 
@@ -11,9 +13,9 @@ Community contributions remain essential in keeping this documentation comprehen
 
   Often, engineering teams can keep existing documentation up-to-date with minimal effort, thus freeing up the documentation team to focus on larger projects.
 
-- Do you have expertise in a particular area of OpenSearch? Cluster sizing? The query DSL? Painless scripting? Aggregations? JVM settings? Take a look at the [current content](https://docs-beta.opensearch.org/docs/opensearch/) and see where you can add value. The [documentation team](#points-of-contact) is happy to help you polish and organize your drafts.
+- Do you have expertise in a particular area of OpenSearch? Cluster sizing? The query DSL? Painless scripting? Aggregations? JVM settings? Take a look at the [current content](https://opensearch.org/docs/opensearch/) and see where you can add value. The [documentation team](#points-of-contact) is happy to help you polish and organize your drafts.
 
-- Are you an OpenSearch Dashboards expert? How did you set up your visualizations? Why is a particular dashboard so valuable to your organization? We have [very little](https://docs-beta.opensearch.org/docs/opensearch-dashboards/) on how to use OpenSearch Dashboards, only how to install it.
+- Are you an OpenSearch Dashboards expert? How did you set up your visualizations? Why is a particular dashboard so valuable to your organization? We have [very little](https://opensearch.org/docs/opensearch-dashboards/) on how to use OpenSearch Dashboards, only how to install it.
 
 - Are you a web developer? Do you want to add an optional dark mode to the documentation? A "copy to clipboard" button for our code samples? Other improvements to the design or usability? See [major changes](#major-changes) for information on building the website locally.
 
@@ -30,11 +32,9 @@ If you encounter problems or have questions when contributing to the documentati
 - [snyder114](https://github.com/snyder114)
 
 
-## How we build the website
+## How the website works
 
-After each commit to this repository, GitHub Pages automatically uses [Jekyll](https://jekyllrb.com) to rebuild the [website](https://docs-beta.opensearch.org). The whole process takes around 30 seconds.
-
-This repository contains many [Markdown](https://guides.github.com/features/mastering-markdown/) files in the `/docs` directory. Each Markdown file correlates with one page on the website.
+This repository contains many [Markdown](https://guides.github.com/features/mastering-markdown/) files organized into Jekyll "collections" (e.g. `_search-plugins`, `_opensearch`, etc.). Each Markdown file correlates with one page on the website.
 
 Using plain text on GitHub has many advantages:
 

_dashboards/notebooks.md

@@ -36,6 +36,7 @@ A notebook is an interface for creating reports.
 
 Choose **Actions** to rename, duplicate, or delete a notebook.
 
+![Create notebook]({{site.url}}{{site.baseurl}}/images/create_notebook.gif)
 
 ### Step 2: Add a paragraph
 
@@ -55,7 +56,7 @@ For example, type `%md` for markdown, `%sql` for SQL, and `%ppl` for PPL.
 Add in text formatted in markdown.
 ```
 
-![Markdown paragraph]({{site.url}}{{site.baseurl}}/images/markdown-notebook.png)
+![Markdown paragraph]({{site.url}}{{site.baseurl}}/images/markdown_notebooks.gif)
 
 ##### Sample SQL block
 
@@ -64,7 +65,7 @@ Add in text formatted in markdown.
 Select * from opensearch_dashboards_sample_data_flights limit 20;
 ```
 
-![SQL paragraph]({{site.url}}{{site.baseurl}}/images/sql-notebook.png)
+![SQL paragraph]({{site.url}}{{site.baseurl}}/images/sql_notebooks.gif)
 
 ##### Sample PPL block
 
@@ -73,7 +74,7 @@ Select * from opensearch_dashboards_sample_data_flights limit 20;
 source=opensearch_dashboards_sample_data_logs | head 20
 ```
 
-![PPL paragraph]({{site.url}}{{site.baseurl}}/images/ppl-notebook.png)
+![PPL paragraph]({{site.url}}{{site.baseurl}}/images/ppl_notebooks.gif)
 
 
 #### Add a visualization
@@ -82,7 +83,7 @@ source=opensearch_dashboards_sample_data_logs | head 20
 1. In **Title**, select your visualization and choose a date range. You can choose multiple timelines to compare and contrast visualizations.
 1. To run and save a paragraph, choose **Run**.
 
-![Visualization paragraph]({{site.url}}{{site.baseurl}}/images/visualization-notebook.png)
+![Visualization paragraph]({{site.url}}{{site.baseurl}}/images/visualization_notebooks.gif)
 
 ## Paragraph actions
 
@@ -93,7 +94,8 @@ You can perform the following actions on paragraphs:
 - Run all the paragraphs at the same time.
 - Clear the outputs of all paragraphs.
 - Delete all the paragraphs.
-- Move paragraphs up and down.
+
+![Sample notebooks]({{site.url}}{{site.baseurl}}/images/paragraphs_notebooks.gif)
 
 ## Sample notebooks
 
@@ -105,6 +107,8 @@ We prepared the following sample notebooks that showcase a variety of use cases:
 
 To add a sample notebook, choose **Actions** and select **Add sample notebooks**.
 
+![Sample notebooks]({{site.url}}{{site.baseurl}}/images/sample_notebooks.gif)
+
 ## Create a report
 
 You can use notebooks to create PNG and PDF reports:
@@ -116,3 +120,5 @@ You can use notebooks to create PNG and PDF reports:
 
 1. To create a schedule-based report, choose **Create report definition**. For steps to create a report definition, see [Create reports using a definition]({{site.url}}{{site.baseurl}}/dashboards/reporting#create-reports-using-a-definition).
 1. To see all your reports, choose **View all reports**.
+
+![Report notebooks]({{site.url}}{{site.baseurl}}/images/report_notebooks.gif)

_im-plugin/ism/api.md

@@ -160,6 +160,10 @@ POST _plugins/_ism/add/index_1
 }
 ```
 
+If you use a wildcard `*` while adding a policy to an index, the ISM plugin interprets `*` as all indices, including system indices like `.opendistro-security`, which stores users, roles, and tenants. A delete action in your policy might accidentally delete all user roles and tenants in your cluster.
+Don't use the broad `*` wildcard, and instead add a prefix, such as `my-logs*`, when specifying indices with the `_ism/add` API.
+{: .warning }
+
 ---
 
 

_layouts/default.html

@@ -94,6 +94,9 @@ layout: table_wrappers
           {% endfor %}
         {% endif %}
       </nav>
+      <div class="site-footer">
+        <p class="text-small text-grey-dk-100">See a problem? Submit <a href="https://github.com/opensearch-project/documentation-website/issues">issues</a> or <a href="https://github.com/opensearch-project/documentation-website/edit/main/{{ page.path }}">edit this page</a> on <a href="https://github.com/opensearch-project/documentation-website/">GitHub</a>.</p>
+      </div>
     </div>
     <div class="copy-banner">
       <div class="container">

_opensearch/data-streams.md

@@ -12,18 +12,9 @@ If you're ingesting continuously generated time-series data such as logs, events
 - You don’t need to update older documents.
 - Your searches generally target the newer documents.
 
-A typical workflow to manage time-series data is as follows:
+A typical workflow to manage time-series data consists of setting up an alias, configuring a rollover operation, defining a write index, and creating common mapping fields in an index template. Data streams simplifies this process.
 
-- To split your data into an index for each day, use the rollover operation.
-- To perform searches on a virtual index name that gets expanded to the underlying indices, create an [index alias]({{site.url}}{{site.baseurl}}/opensearch/index-alias/).
-- To perform a write operation on an index alias, configure the latest index as the write index.
-- To configure new indices, extract common mappings and settings into an [index template]({{site.url}}{{site.baseurl}}/opensearch/index-templates/).
-
-Even after you perform all these operations, you’re still not enforcing the best practices when dealing with time-series data. For example, you can modify the indices directly. You’re able to ingest documents without a timestamp field, which might result in slower queries.
-
-Data streams abstract the complexity and enforce the best practices for managing time-series data.
-
-With data streams, you can store append-only time-series data across multiple indices with a single endpoint for ingesting and searching data. It replaces index aliases for time-series data.
+With data streams, you can store append-only time-series data across multiple indices with a single endpoint for ingesting and searching data. We recommend using data streams in place of index aliases for time-series data.
 
 ## About data streams
 
@@ -276,7 +267,7 @@ To manage data streams from OpenSearch Dashboards, open **OpenSearch Dashboards*
 You see a toggle switch for data streams that you can use to show or hide indices belonging to a data stream.
 
 When you enable this switch, you see a data stream multi-select dropdown menu that you can use for filtering data streams.
-You also see a data stream column that shows you the name of the parent data stream the index is contained in.
+You also see a data stream column that shows you the name of the data stream the index is contained in.
 
 ![data stream toggle]({{site.url}}{{site.baseurl}}/images/data_streams_toggle.png)
 

_opensearch/date_math_support.md

@@ -0,0 +1,60 @@
+---
+layout: default
+title: Date math support for index names
+nav_order: 92
+---
+
+# Date math support for index names
+
+Date math is shorthand arithmetic for finding relative dates.
+
+If you're indexing time-series data with the dates mapped in the index names, you can use date math in your queries to filter index names and limit the number of searched indices.
+
+## Date math syntax
+
+The date math syntax for an index name is as follows:
+
+```
+<static_name{date_math_expr{date_format|time_zone}}>
+```
+
+- `static_name`: The unchanged or static portion of the index name. To use the characters `{` and `}` in the static part of an index name, escape them with a backslash `\`.
+- `date_math_expr`: The changing or dynamic portion of the index name that’s computed by the date math expression. For example, `now+1h` adds one hour, `now-1d` subtracts one hour, and `now/d` rounds down to the nearest day, where `now` represents the current timestamp.
+- `date_format`: (Optional) Specify the format for the computed date. The default value is `YYYY.MM.dd`. Make sure that you’re using the correct small or capital letters in the date format. For example, `mm` denotes minute of hour, while `MM` denotes month of year. Similarly, `hh` denotes the hour in the `1-12` range in combination with AM/PM, while `HH` denotes the hour in the `0-23` 24-hour range.
+- `time_zone`: (Optional) Specify the timezone offset. The default value is UTC. For example, the UTC time offset for PST is `-08:00`.
+
+## Date math example
+
+You must enclose date math index names within angle brackets.
+
+If today is 22nd March, 2024:
+
+- `<logstash-{now/d}>` resolves to `logstash-2024.03.22`
+- `<logstash-{now/M}>` resolves to `logstash-2024.03.01`
+- `<logstash-{now/M{YYYY.MM}}>` resolves to `logstash-2024.03`
+- `<logstash-{now/M-1M{YYYY.MM}}>` resolves to `logstash-2024.02`
+- `<logstash-{now/d{yyyy.MM.dd|+12:00}}>` resolves to `logstash-2024.03.23`
+
+You need to encode all special characters in URI format:
+
+Special characters | URI format
+:--- | :---
+`<` | %3C
+`>` | %3E
+`/` | %2F
+`{` | %7B
+`}` | %7D
+`|` | %7C
+`+` | %2B
+`:` | %3A
+`,` | %2C
+`\` | %5C
+
+If you are searching for errors in your daily logs with the default Logstash index name format `logstash-YYYY.MM.dd`, you can use date math to restrict the search to indices of the past three days:
+
+```
+# GET <logstash-{now/d-2d}>,<logstash-{now/d-1d}>,<logstash-{now/d}>/_search
+GET %3Clogstash-%7Bnow%2Fd-2d%7D%3E%2C%3Clogstash-%7Bnow%2Fd-1d%7D%3E%2C%3Clogstash-%7Bnow%2Fd%7D%3E/_search
+```
+
+This date math expression is evaluated at runtime.

_opensearch/install/important-settings.md

@@ -7,13 +7,13 @@ nav_order: 70
 
 # Important settings
 
-For production workloads, make sure the [Linux setting](https://www.kernel.org/doc/Documentation/sysctl/vm.txt) `vm.max_map_count` is set to at least 262144. On the OpenSearch Docker image, this setting is the default. To check, start a Bash session in the container and run:
+For production workloads, make sure the [Linux setting](https://www.kernel.org/doc/Documentation/sysctl/vm.txt) `vm.max_map_count` is set to at least 262144. Even if you use the Docker image, set this value on the *host machine*. To check the current value, run this command:
 
 ```bash
 cat /proc/sys/vm/max_map_count
 ```
 
-To increase this value, you have to modify the Docker image. For other install types, add this setting to the host machine's `/etc/sysctl.conf` file with the following line:
+To increase the value, add the following line to `/etc/sysctl.conf`:
 
 ```
 vm.max_map_count=262144

_opensearch/rest-api/document-apis/delete-document.md

@@ -0,0 +1,72 @@
+---
+layout: default
+title: Delete document
+parent: Document APIs
+nav_order: 10
+---
+
+# Get document
+
+If you no longer need a document in your index, you can use the delete document API operation to delete it.
+
+## Example
+
+```
+DELETE /sample-index1/_doc/1
+```
+
+## Path and HTTP methods
+
+```
+DELETE /<index-name>/_doc/<_id>
+```
+
+## URL parameters
+
+Parameter | Type | Description | Required
+:--- | :--- | :--- | :---
+&lt;index-name&gt; | String | The index to delete from. | Yes
+&lt;_id&gt; | String | The ID of the document to delete. | Yes
+if_seq_no | Integer | Only perform the delete operation if the document's version number matches the specified number. | No
+if_primary_term | Integer | Only perform the delete operation if the document has the specified primary term. | No
+refresh | Enum | If true, OpenSearch refreshes shards to make the operation visible to searching. Valid options are `true`, `false`, and `wait_for`, which tells OpenSearch to wait for a refresh before executing the operation. Default is false. | No
+routing | String | Value used to route the operation to a specific shard. | No
+timeout | Time | How long to wait for a response from the cluster. | No
+version | Integer | The version of the document to delete, which must match the last updated version of the document. | No
+version_type | Enum | Retrieves a specifically typed document. Available options are `external` (retrieve the document if the specified version number is greater than the document's current version) and `external_gte` (retrieve the document if the specified version number is greater than or equal to the document's current version). For example, to delete version 3 of a document, use `/_doc/1?version=3&version_type=external`. | No
+wait_for_active_shards | String | The number of active shards that must be available before OpenSearch processes the delete request. Default is 1 (only the primary shard). Set to `all` or a positive integer. Values greater than 1 require replicas. For example, if you specify a value of 3, the index must have two replicas distributed across two additional nodes for the operation to succeed. | No
+
+
+## Response
+```json
+{
+  "_index": "sample-index1",
+  "_type": "_doc",
+  "_id": "1",
+  "_version": 2,
+  "result": "deleted",
+  "_shards": {
+    "total": 2,
+    "successful": 2,
+    "failed": 0
+  },
+  "_seq_no": 1,
+  "_primary_term": 15
+}
+```
+
+## Response body fields
+
+Field | Description
+:--- | :---
+_index | The name of the index.
+_type | The document's type. OpenSearch only supports one type, which is `_doc`.
+_id | The document's ID.
+_version | The document's version.
+_result | The result of the delete operation.
+_shards | Detailed information about the cluster's shards.
+total | The total number of shards.
+successful | The number of shards OpenSearch succssfully deleted the document from.
+failed | The number of shards OpenSearch failed to delete the document from.
+_seq_no | The sequence number assigned when the document was indexed.
+_primary_term | The primary term assigned when the document was indexed.

_opensearch/rest-api/document-apis/get-documents.md

@@ -2,7 +2,6 @@
 layout: default
 title: Get document
 parent: Document APIs
-grand_parent: REST API reference
 nav_order: 5
 ---
 
@@ -33,16 +32,16 @@ All get document URL parameters are optional.
 
 Parameter | Type | Description
 :--- | :--- | :---
-preference | string | Specifies a preference of which shard to retrieve results from. Available options are `_local`, which tells the operation to retrieve results from a locally allocated shard replica, and a custom string value assigned to a specific shard replica. By default, OpenSearch executes get document operations on random shards.
-realtime | boolean | Specifies whether the operation should run in realtime. If false, the operation waits for the index to refresh to analyze the source to retrieve data, which makes the operation near-realtime. Default is true.
-refresh | boolean | If true, OpenSearch refreshes shards to make the operation visible to searching. Default is false.
-routing | string | A value used to route the operation to a specific shard.
-stored_fields | boolean | If true, the operation retrieves document fields stored in the index rather than the document's `_source`. Default is false.
-_source | string | Whether to include the `_source` field in the response body. Default is true.
-_source_excludes | string | A comma-separated list of source fields to exclude in the query response.
-_source_includes | string | A comma-separated list of source fields to include in the query response.
-version | integer | The version of the document to return, which must match the current version of the document.
-version_type | enum | Retrieves a specifically typed document. Available options are `external` (retrieve the document if the specified version number is greater than the document's current version) and `external_gte` (retrieve the document if the specified version number is greater than or equal to the document's current verison). For example, to retrieve version 3 of a document, use `/_doc/1?version=3&version_type=external`.
+preference | String | Specifies a preference of which shard to retrieve results from. Available options are `_local`, which tells the operation to retrieve results from a locally allocated shard replica, and a custom string value assigned to a specific shard replica. By default, OpenSearch executes get document operations on random shards.
+realtime | Boolean | Specifies whether the operation should run in realtime. If false, the operation waits for the index to refresh to analyze the source to retrieve data, which makes the operation near-realtime. Default is true.
+refresh | Boolean | If true, OpenSearch refreshes shards to make the operation visible to searching. Default is false.
+routing | String | A value used to route the operation to a specific shard.
+stored_fields | Boolean | If true, the operation retrieves document fields stored in the index rather than the document's `_source`. Default is false.
+_source | String | Whether to include the `_source` field in the response body. Default is true.
+_source_excludes | String | A comma-separated list of source fields to exclude in the query response.
+_source_includes | String | A comma-separated list of source fields to include in the query response.
+version | Integer | The version of the document to return, which must match the current version of the document.
+version_type | Enum | Retrieves a specifically typed document. Available options are `external` (retrieve the document if the specified version number is greater than the document's current version) and `external_gte` (retrieve the document if the specified version number is greater than or equal to the document's current version). For example, to retrieve version 3 of a document, use `/_doc/1?version=3&version_type=external`.
 
 
 ## Response
@@ -67,7 +66,7 @@ Field | Description
 :--- | :---
 _index | The name of the index.
 _type | The document's type. OpenSearch only supports one type, which is `_doc`.
-_id | The document's id.
+_id | The document's ID.
 _version | The document's version number. Updated whenever the document changes.
 _seq_no | The sequnce number assigned when the document is indexed.
 primary_term | The primary term assigned when the document is indexed.

_security-plugin/configuration/disable.md

@@ -38,7 +38,7 @@ If you disable the security plugin in `opensearch.yml` (or delete the plugin ent
 
    ```
    FROM opensearchproject/opensearch-dashboards:{{site.opensearch_version}}
-   RUN /usr/share/opensearch-dashboards/bin/opensearch-dashboards-plugin remove security-dashboards
+   RUN /usr/share/opensearch-dashboards/bin/opensearch-dashboards-plugin remove securityDashboards
    COPY --chown=opensearch-dashboards:opensearch-dashboards opensearch_dashboards.yml /usr/share/opensearch-dashboards/config/
    ```
 

_security-plugin/configuration/openid-connect.md

@@ -77,9 +77,9 @@ jwks_uri: "https://keycloak.example.com:8080/auth/realms/master/protocol/openid-
 ```
 
 ```
-{  
-   keys:[  
-      {  
+{
+   keys:[
+      {
          kid:"V-diposfUJIk5jDBFi_QRouiVinG5PowskcSWy5EuCo",
          kty:"RSA",
          alg:"RS256",
@@ -148,8 +148,9 @@ Use the following parameters to enable TLS for connecting to your IdP:
 
 ```yml
 config:
-  enable_ssl: <true|false>
-  verify_hostnames: <true|false>
+  openid_connect_idp:
+    enable_ssl: <true|false>
+    verify_hostnames: <true|false>
 ```
 
 Name | Description
@@ -164,16 +165,20 @@ To validate the TLS certificate of your IdP, configure either the path to the Id
 
 ```yml
 config:
-  pemtrustedcas_filepath: /path/to/trusted_cas.pem
+  openid_connect_idp:
+    enable_ssl: true
+    pemtrustedcas_filepath: /full/path/to/trusted_cas.pem
 ```
 
 ```yml
 config:
-  pemtrustedcas_content: |-
-    MIID/jCCAuagAwIBAgIBATANBgkqhkiG9w0BAQUFADCBjzETMBEGCgmSJomT8ixk
-    ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
-    bGUgQ29tIEluYy4xITAfBgNVBAsMGEV4YW1wbGUgQ29tIEluYy4gUm9vdCBDQTEh
-    ...
+  openid_connect_idp:
+    enable_ssl: true
+    pemtrustedcas_content: |-
+      MIID/jCCAuagAwIBAgIBATANBgkqhkiG9w0BAQUFADCBjzETMBEGCgmSJomT8ixk
+      ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
+      bGUgQ29tIEluYy4xITAfBgNVBAsMGEV4YW1wbGUgQ29tIEluYy4gUm9vdCBDQTEh
+      ...
 ```
 
 
@@ -189,23 +194,27 @@ To use TLS client authentication, configure the PEM certificate and private key
 
 ```yml
 config:
-  pemkey_filepath: /path/to/private.key.pem
-  pemkey_password: private_key_password
-  pemcert_filepath: /path/to/certificate.pem
+  openid_connect_idp:
+    enable_ssl: true
+    pemkey_filepath: /full/path/to/private.key.pem
+    pemkey_password: private_key_password
+    pemcert_filepath: /full/path/to/certificate.pem
 ```
 
 ```yml
 config:
-  pemkey_content: |-
-    MIID2jCCAsKgAwIBAgIBBTANBgkqhkiG9w0BAQUFADCBlTETMBEGCgmSJomT8ixk
-    ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
-    bGUgQ29tIEluYy4xJDAiBgNVBAsMG0V4YW1wbGUgQ29tIEluYy4gU2lnbmluZyBD
+  openid_connect_idp:
+    enable_ssl: true
+    pemkey_content: |-
+      MIID2jCCAsKgAwIBAgIBBTANBgkqhkiG9w0BAQUFADCBlTETMBEGCgmSJomT8ixk
+      ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
+      bGUgQ29tIEluYy4xJDAiBgNVBAsMG0V4YW1wbGUgQ29tIEluYy4gU2lnbmluZyBD
     ...
-  pemkey_password: private_key_password
-  pemcert_content: |-
-    MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCHRZwzwGlP2FvL
-    oEzNeDu2XnOF+ram7rWPT6fxI+JJr3SDz1mSzixTeHq82P5A7RLdMULfQFMfQPfr
-    WXgB4qfisuDSt+CPocZRfUqqhGlMG2l8LgJMr58tn0AHvauvNTeiGlyXy0ShxHbD
+    pemkey_password: private_key_password
+    pemcert_content: |-
+      MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCHRZwzwGlP2FvL
+      oEzNeDu2XnOF+ram7rWPT6fxI+JJr3SDz1mSzixTeHq82P5A7RLdMULfQFMfQPfr
+      WXgB4qfisuDSt+CPocZRfUqqhGlMG2l8LgJMr58tn0AHvauvNTeiGlyXy0ShxHbD
     ...
 ```
 

_upgrade-to/upgrade-to.md

@@ -29,6 +29,9 @@ Elasticsearch OSS version | Rolling upgrade path | Cluster restart upgrade path
 6.x | Upgrade to 6.8, upgrade to 7.10.2, and upgrade to OpenSearch. | Upgrade to OpenSearch.
 7.x | Upgrade to OpenSearch. | Upgrade to OpenSearch.
 
+If you are upgrading an Open Distro for Elasticsearch cluster, we recommend first upgrading to ODFE 1.13 and then upgrading to OpenSearch.
+{: .note }
+
 
 ## Upgrade Elasticsearch OSS