minor fix

added ISM warning

_im-plugin/ism/api.md

@@ -160,6 +160,10 @@ POST _plugins/_ism/add/index_1
 }
 ```
 
+If you use a wildcard `*` while adding a policy to an index, the ISM plugin interprets `*` as all indices, including system indices like `.opendistro-security`, which stores users, roles, and tenants. A delete action in your policy might accidentally delete all user roles and tenants in your cluster.
+Don't use the broad `*` wildcard, and instead add a prefix, such as `my-logs*`, when specifying indices with the `_ism/add` API.
+{: .warning }
+
 ---
 
 

_opensearch/data-streams.md

@@ -12,16 +12,7 @@ If you're ingesting continuously generated time-series data such as logs, events
 - You don’t need to update older documents.
 - Your searches generally target the newer documents.
 
-A typical workflow to manage time-series data is as follows:
-
-- To split your data into an index for each day, use the rollover operation.
-- To perform searches on a virtual index name that gets expanded to the underlying indices, create an [index alias]({{site.url}}{{site.baseurl}}/opensearch/index-alias/).
-- To perform a write operation on an index alias, configure the latest index as the write index.
-- To configure new indices, extract common mappings and settings into an [index template]({{site.url}}{{site.baseurl}}/opensearch/index-templates/).
-
-Even after you perform all these operations, you’re still not enforcing the best practices when dealing with time-series data. For example, you can modify the indices directly. You’re able to ingest documents without a timestamp field, which might result in slower queries.
-
-Data streams abstract the complexity and enforce the best practices for managing time-series data.
+A typical workflow to manage time-series data consists of setting up an alias, configuring a rollover operation, defining a write index, and creating common mapping fields in an index template. Data streams simplifies this process.
 
 With data streams, you can store append-only time-series data across multiple indices with a single endpoint for ingesting and searching data. We recommend using data streams in place of index aliases for time-series data.
 
@@ -276,7 +267,7 @@ To manage data streams from OpenSearch Dashboards, open **OpenSearch Dashboards*
 You see a toggle switch for data streams that you can use to show or hide indices belonging to a data stream.
 
 When you enable this switch, you see a data stream multi-select dropdown menu that you can use for filtering data streams.
-You also see a data stream column that shows you the name of the parent data stream the index is contained in.
+You also see a data stream column that shows you the name of the data stream the index is contained in.
 
 ![data stream toggle]({{site.url}}{{site.baseurl}}/images/data_streams_toggle.png)
 

_security-plugin/configuration/yaml.md

@@ -121,59 +121,8 @@ If you want to run your users' passwords against some validation, specify a regu
 Note that OpenSearch validates only users and passwords created through OpenSearch Dashboards or the REST API.
 
 ```yml
-plugins.security.restapi.password_validation_regex: '(?=.*[A-Z])(?=.*[^a-zA-Z\d])(?=.*[0-9])(?=.*[a-z]).{8,}'
-plugins.security.restapi.password_validation_error_message: "Password must be minimum 8 characters long and must contain at least one uppercase letter, one lowercase letter, one digit, and one special character."
-```
-
-## whitelist.yml
-
-You can use `whitelist.yml` to allow list any endpoints and HTTP requests. If enabled, all users except the SuperAdmin are allowed access to only the specified endpoints and HTTP requests, and all other HTTP requests associated with the endpoint are denied. For example, if GET `_cluster/settings` is allow listed, users cannot submit PUT requests to `_cluster/settings` to update cluster settings.
-
-Note that while you can configure access to endpoints this way, for most cases, it is still best to configure permissions using the security plugin's users and roles, which have more granular settings.
-
-```yml
----
-_meta:
-  type: "whitelist"
-  config_version: 2
-
-# Description:
-# enabled - feature flag.
-# if enabled is false, all endpoints are accessible.
-# if enabled is true, all users except the SuperAdmin can only submit the allowed requests to the specified endpoints.
-# SuperAdmin can access all APIs.
-# SuperAdmin is defined by the SuperAdmin certificate, which is configured with the opensearch.yml setting plugins.security.authcz.admin_dn:
-# Refer to the example setting in opensearch.yml to learn more about configuring SuperAdmin.
-#
-# requests - map of allow listed endpoints and HTTP requests
-
-#this name must be config
-config:
-  enabled: true
-  requests:
-    /_cluster/settings:
-      - GET
-    /_cat/nodes:
-      - GET
-```
-
-To enable PUT requests to cluster settings, add PUT to the list of allowed operations under `/_cluster/settings`.
-
-```yml
-requests:
-  /_cluster/settings:
-    - GET
-    - PUT
-```
-
-You can also allow list custom indices. `whitelist.yml` doesn't support wildcards, so you must manually specify all of the indices you want to allow list.
-
-```yml
-requests: # Only allow GET requests to /sample-index1/_doc/1 and /sample-index2/_doc/1
-  /sample-index1/_doc/1:
-    - GET
-  /sample-index2/_doc/1:
-    - GET
+plugins.restapi.password_validation_regex: '(?=.*[A-Z])(?=.*[^a-zA-Z\d])(?=.*[0-9])(?=.*[a-z]).{8,}'
+plugins.restapi.password_validation_error_message: "Password must be minimum 8 characters long and must contain at least one uppercase letter, one lowercase letter, one digit, and one special character."
 ```