Addressed comment and added note about users and roles

added gifs for notebooks

README.md

@@ -32,7 +32,7 @@ If you encounter problems or have questions when contributing to the documentati
 
 ## How the website works
 
-This repository contains many [Markdown](https://guides.github.com/features/mastering-markdown/) files in the `/docs` directory. Each Markdown file correlates with one page on the website.
+This repository contains many [Markdown](https://guides.github.com/features/mastering-markdown/) files organized into Jekyll "collections" (e.g. `_search-plugins`, `_opensearch`, etc.). Each Markdown file correlates with one page on the website.
 
 Using plain text on GitHub has many advantages:
 

_layouts/default.html

@@ -94,6 +94,9 @@ layout: table_wrappers
           {% endfor %}
         {% endif %}
       </nav>
+      <div class="site-footer">
+        <p class="text-small text-grey-dk-100">See a problem? Submit <a href="https://github.com/opensearch-project/documentation-website/issues">issues</a> or <a href="https://github.com/opensearch-project/documentation-website/edit/main/{{ page.path }}">edit this page</a> on <a href="https://github.com/opensearch-project/documentation-website/">GitHub</a>.</p>
+      </div>
     </div>
     <div class="copy-banner">
       <div class="container">

_opensearch/data-streams.md

@@ -23,7 +23,7 @@ Even after you perform all these operations, you’re still not enforcing the be
 
 Data streams abstract the complexity and enforce the best practices for managing time-series data.
 
-With data streams, you can store append-only time-series data across multiple indices with a single endpoint for ingesting and searching data. It replaces index aliases for time-series data.
+With data streams, you can store append-only time-series data across multiple indices with a single endpoint for ingesting and searching data. We recommend using data streams in place of index aliases for time-series data.
 
 ## About data streams
 

_opensearch/rest-api/document-apis/delete-document.md

@@ -0,0 +1,72 @@
+---
+layout: default
+title: Delete document
+parent: Document APIs
+nav_order: 10
+---
+
+# Get document
+
+If you no longer need a document in your index, you can use the delete document API operation to delete it.
+
+## Example
+
+```
+DELETE /sample-index1/_doc/1
+```
+
+## Path and HTTP methods
+
+```
+DELETE /<index-name>/_doc/<_id>
+```
+
+## URL parameters
+
+Parameter | Type | Description | Required
+:--- | :--- | :--- | :---
+&lt;index-name&gt; | String | The index to delete from. | Yes
+&lt;_id&gt; | String | The ID of the document to delete. | Yes
+if_seq_no | Integer | Only perform the delete operation if the document's version number matches the specified number. | No
+if_primary_term | Integer | Only perform the delete operation if the document has the specified primary term. | No
+refresh | Enum | If true, OpenSearch refreshes shards to make the operation visible to searching. Valid options are `true`, `false`, and `wait_for`, which tells OpenSearch to wait for a refresh before executing the operation. Default is false. | No
+routing | String | Value used to route the operation to a specific shard. | No
+timeout | Time | How long to wait for a response from the cluster. | No
+version | Integer | The version of the document to delete, which must match the last updated version of the document. | No
+version_type | Enum | Retrieves a specifically typed document. Available options are `external` (retrieve the document if the specified version number is greater than the document's current version) and `external_gte` (retrieve the document if the specified version number is greater than or equal to the document's current version). For example, to delete version 3 of a document, use `/_doc/1?version=3&version_type=external`. | No
+wait_for_active_shards | String | The number of active shards that must be available before OpenSearch processes the delete request. Default is 1 (only the primary shard). Set to `all` or a positive integer. Values greater than 1 require replicas. For example, if you specify a value of 3, the index must have two replicas distributed across two additional nodes for the operation to succeed. | No
+
+
+## Response
+```json
+{
+  "_index": "sample-index1",
+  "_type": "_doc",
+  "_id": "1",
+  "_version": 2,
+  "result": "deleted",
+  "_shards": {
+    "total": 2,
+    "successful": 2,
+    "failed": 0
+  },
+  "_seq_no": 1,
+  "_primary_term": 15
+}
+```
+
+## Response body fields
+
+Field | Description
+:--- | :---
+_index | The name of the index.
+_type | The document's type. OpenSearch only supports one type, which is `_doc`.
+_id | The document's ID.
+_version | The document's version.
+_result | The result of the delete operation.
+_shards | Detailed information about the cluster's shards.
+total | The total number of shards.
+successful | The number of shards OpenSearch succssfully deleted the document from.
+failed | The number of shards OpenSearch failed to delete the document from.
+_seq_no | The sequence number assigned when the document was indexed.
+_primary_term | The primary term assigned when the document was indexed.

_opensearch/rest-api/document-apis/get-documents.md

@@ -2,7 +2,6 @@
 layout: default
 title: Get document
 parent: Document APIs
-grand_parent: REST API reference
 nav_order: 5
 ---
 
@@ -33,16 +32,16 @@ All get document URL parameters are optional.
 
 Parameter | Type | Description
 :--- | :--- | :---
-preference | string | Specifies a preference of which shard to retrieve results from. Available options are `_local`, which tells the operation to retrieve results from a locally allocated shard replica, and a custom string value assigned to a specific shard replica. By default, OpenSearch executes get document operations on random shards.
-realtime | boolean | Specifies whether the operation should run in realtime. If false, the operation waits for the index to refresh to analyze the source to retrieve data, which makes the operation near-realtime. Default is true.
-refresh | boolean | If true, OpenSearch refreshes shards to make the operation visible to searching. Default is false.
-routing | string | A value used to route the operation to a specific shard.
-stored_fields | boolean | If true, the operation retrieves document fields stored in the index rather than the document's `_source`. Default is false.
-_source | string | Whether to include the `_source` field in the response body. Default is true.
-_source_excludes | string | A comma-separated list of source fields to exclude in the query response.
-_source_includes | string | A comma-separated list of source fields to include in the query response.
-version | integer | The version of the document to return, which must match the current version of the document.
-version_type | enum | Retrieves a specifically typed document. Available options are `external` (retrieve the document if the specified version number is greater than the document's current version) and `external_gte` (retrieve the document if the specified version number is greater than or equal to the document's current verison). For example, to retrieve version 3 of a document, use `/_doc/1?version=3&version_type=external`.
+preference | String | Specifies a preference of which shard to retrieve results from. Available options are `_local`, which tells the operation to retrieve results from a locally allocated shard replica, and a custom string value assigned to a specific shard replica. By default, OpenSearch executes get document operations on random shards.
+realtime | Boolean | Specifies whether the operation should run in realtime. If false, the operation waits for the index to refresh to analyze the source to retrieve data, which makes the operation near-realtime. Default is true.
+refresh | Boolean | If true, OpenSearch refreshes shards to make the operation visible to searching. Default is false.
+routing | String | A value used to route the operation to a specific shard.
+stored_fields | Boolean | If true, the operation retrieves document fields stored in the index rather than the document's `_source`. Default is false.
+_source | String | Whether to include the `_source` field in the response body. Default is true.
+_source_excludes | String | A comma-separated list of source fields to exclude in the query response.
+_source_includes | String | A comma-separated list of source fields to include in the query response.
+version | Integer | The version of the document to return, which must match the current version of the document.
+version_type | Enum | Retrieves a specifically typed document. Available options are `external` (retrieve the document if the specified version number is greater than the document's current version) and `external_gte` (retrieve the document if the specified version number is greater than or equal to the document's current version). For example, to retrieve version 3 of a document, use `/_doc/1?version=3&version_type=external`.
 
 
 ## Response
@@ -67,7 +66,7 @@ Field | Description
 :--- | :---
 _index | The name of the index.
 _type | The document's type. OpenSearch only supports one type, which is `_doc`.
-_id | The document's id.
+_id | The document's ID.
 _version | The document's version number. Updated whenever the document changes.
 _seq_no | The sequnce number assigned when the document is indexed.
 primary_term | The primary term assigned when the document is indexed.

_security-plugin/configuration/openid-connect.md

@@ -77,9 +77,9 @@ jwks_uri: "https://keycloak.example.com:8080/auth/realms/master/protocol/openid-
 ```
 
 ```
-{  
-   keys:[  
-      {  
+{
+   keys:[
+      {
          kid:"V-diposfUJIk5jDBFi_QRouiVinG5PowskcSWy5EuCo",
          kty:"RSA",
          alg:"RS256",
@@ -148,8 +148,9 @@ Use the following parameters to enable TLS for connecting to your IdP:
 
 ```yml
 config:
-  enable_ssl: <true|false>
-  verify_hostnames: <true|false>
+  openid_connect_idp:
+    enable_ssl: <true|false>
+    verify_hostnames: <true|false>
 ```
 
 Name | Description
@@ -164,16 +165,20 @@ To validate the TLS certificate of your IdP, configure either the path to the Id
 
 ```yml
 config:
-  pemtrustedcas_filepath: /path/to/trusted_cas.pem
+  openid_connect_idp:
+    enable_ssl: true
+    pemtrustedcas_filepath: /full/path/to/trusted_cas.pem
 ```
 
 ```yml
 config:
-  pemtrustedcas_content: |-
-    MIID/jCCAuagAwIBAgIBATANBgkqhkiG9w0BAQUFADCBjzETMBEGCgmSJomT8ixk
-    ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
-    bGUgQ29tIEluYy4xITAfBgNVBAsMGEV4YW1wbGUgQ29tIEluYy4gUm9vdCBDQTEh
-    ...
+  openid_connect_idp:
+    enable_ssl: true
+    pemtrustedcas_content: |-
+      MIID/jCCAuagAwIBAgIBATANBgkqhkiG9w0BAQUFADCBjzETMBEGCgmSJomT8ixk
+      ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
+      bGUgQ29tIEluYy4xITAfBgNVBAsMGEV4YW1wbGUgQ29tIEluYy4gUm9vdCBDQTEh
+      ...
 ```
 
 
@@ -189,23 +194,27 @@ To use TLS client authentication, configure the PEM certificate and private key
 
 ```yml
 config:
-  pemkey_filepath: /path/to/private.key.pem
-  pemkey_password: private_key_password
-  pemcert_filepath: /path/to/certificate.pem
+  openid_connect_idp:
+    enable_ssl: true
+    pemkey_filepath: /full/path/to/private.key.pem
+    pemkey_password: private_key_password
+    pemcert_filepath: /full/path/to/certificate.pem
 ```
 
 ```yml
 config:
-  pemkey_content: |-
-    MIID2jCCAsKgAwIBAgIBBTANBgkqhkiG9w0BAQUFADCBlTETMBEGCgmSJomT8ixk
-    ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
-    bGUgQ29tIEluYy4xJDAiBgNVBAsMG0V4YW1wbGUgQ29tIEluYy4gU2lnbmluZyBD
+  openid_connect_idp:
+    enable_ssl: true
+    pemkey_content: |-
+      MIID2jCCAsKgAwIBAgIBBTANBgkqhkiG9w0BAQUFADCBlTETMBEGCgmSJomT8ixk
+      ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
+      bGUgQ29tIEluYy4xJDAiBgNVBAsMG0V4YW1wbGUgQ29tIEluYy4gU2lnbmluZyBD
     ...
-  pemkey_password: private_key_password
-  pemcert_content: |-
-    MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCHRZwzwGlP2FvL
-    oEzNeDu2XnOF+ram7rWPT6fxI+JJr3SDz1mSzixTeHq82P5A7RLdMULfQFMfQPfr
-    WXgB4qfisuDSt+CPocZRfUqqhGlMG2l8LgJMr58tn0AHvauvNTeiGlyXy0ShxHbD
+    pemkey_password: private_key_password
+    pemcert_content: |-
+      MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCHRZwzwGlP2FvL
+      oEzNeDu2XnOF+ram7rWPT6fxI+JJr3SDz1mSzixTeHq82P5A7RLdMULfQFMfQPfr
+      WXgB4qfisuDSt+CPocZRfUqqhGlMG2l8LgJMr58tn0AHvauvNTeiGlyXy0ShxHbD
     ...
 ```
 

_security-plugin/configuration/yaml.md

@@ -121,8 +121,59 @@ If you want to run your users' passwords against some validation, specify a regu
 Note that OpenSearch validates only users and passwords created through OpenSearch Dashboards or the REST API.
 
 ```yml
-plugins.restapi.password_validation_regex: '(?=.*[A-Z])(?=.*[^a-zA-Z\d])(?=.*[0-9])(?=.*[a-z]).{8,}'
-plugins.restapi.password_validation_error_message: "Password must be minimum 8 characters long and must contain at least one uppercase letter, one lowercase letter, one digit, and one special character."
+plugins.security.restapi.password_validation_regex: '(?=.*[A-Z])(?=.*[^a-zA-Z\d])(?=.*[0-9])(?=.*[a-z]).{8,}'
+plugins.security.restapi.password_validation_error_message: "Password must be minimum 8 characters long and must contain at least one uppercase letter, one lowercase letter, one digit, and one special character."
+```
+
+## whitelist.yml
+
+You can use `whitelist.yml` to allow list any endpoints and HTTP requests. If enabled, all users except the SuperAdmin are allowed access to only the specified endpoints and HTTP requests, and all other HTTP requests associated with the endpoint are denied. For example, if GET `_cluster/settings` is allow listed, users cannot submit PUT requests to `_cluster/settings` to update cluster settings.
+
+Note that while you can configure access to endpoints this way, for most cases, it is still best to configure permissions using the security plugin's users and roles, which have more granular settings.
+
+```yml
+---
+_meta:
+  type: "whitelist"
+  config_version: 2
+
+# Description:
+# enabled - feature flag.
+# if enabled is false, all endpoints are accessible.
+# if enabled is true, all users except the SuperAdmin can only submit the allowed requests to the specified endpoints.
+# SuperAdmin can access all APIs.
+# SuperAdmin is defined by the SuperAdmin certificate, which is configured with the opensearch.yml setting plugins.security.authcz.admin_dn:
+# Refer to the example setting in opensearch.yml to learn more about configuring SuperAdmin.
+#
+# requests - map of allow listed endpoints and HTTP requests
+
+#this name must be config
+config:
+  enabled: true
+  requests:
+    /_cluster/settings:
+      - GET
+    /_cat/nodes:
+      - GET
+```
+
+To enable PUT requests to cluster settings, add PUT to the list of allowed operations under `/_cluster/settings`.
+
+```yml
+requests:
+  /_cluster/settings:
+    - GET
+    - PUT
+```
+
+You can also allow list custom indices. `whitelist.yml` doesn't support wildcards, so you must manually specify all of the indices you want to allow list.
+
+```yml
+requests: # Only allow GET requests to /sample-index1/_doc/1 and /sample-index2/_doc/1
+  /sample-index1/_doc/1:
+    - GET
+  /sample-index2/_doc/1:
+    - GET
 ```
 
 

_upgrade-to/upgrade-to.md

@@ -29,6 +29,9 @@ Elasticsearch OSS version | Rolling upgrade path | Cluster restart upgrade path
 6.x | Upgrade to 6.8, upgrade to 7.10.2, and upgrade to OpenSearch. | Upgrade to OpenSearch.
 7.x | Upgrade to OpenSearch. | Upgrade to OpenSearch.
 
+If you are upgrading an Open Distro for Elasticsearch cluster, we recommend first upgrading to ODFE 1.13 and then upgrading to OpenSearch.
+{: .note }
+
 
 ## Upgrade Elasticsearch OSS