Update _clients/logstash/index.md

Co-authored-by: Vijayan Balasubramanian <VijayanB@users.noreply.github.com>
2021-08-03 13:30:21 -07:00 · 2021-08-02 17:34:06 -07:00 · 2021-08-02 17:33:56 -07:00 · 2021-08-02 17:33:45 -07:00 · 2021-08-02 13:00:04 -07:00 · 2021-08-02 11:16:39 -07:00
215 changed files with 4207 additions and 1429 deletions
@@ -3,3 +3,4 @@ _site
 .jekyll-metadata
 .DS_Store
 Gemfile.lock
+.idea
@@ -1 +1 @@
-Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+Copyright 2021 OpenSearch contributors.
@@ -273,4 +273,4 @@ This project is licensed under the Apache-2.0 License.

 ## Copyright

-Copyright Amazon.com, Inc. or its affiliates. All rights reserved.
+Copyright 2021 OpenSearch contributors.
@@ -0,0 +1,53 @@
+---
+layout: default
+title: Agents and ingestion tools
+nav_order: 100
+has_children: false
+has_toc: false
+---
+
+# Agents and ingestion tools
+
+Historically, many multiple popular agents and ingestion tools have worked with Elasticsearch OSS, such as Beats, Logstash, Fluentd, FluentBit, and OpenTelemetry. OpenSearch aims to continue to support a broad set of agents and ingestion tools, but not all have been tested or have explicitly added OpenSearch compatibility.
+
+As an intermediate solution, we are adding a [version value](https://github.com/opensearch-project/OpenSearch/issues/693) to `opensearch.yml`. This change will let you set OpenSearch 1.x clusters to report version 7.10.2 (or any other arbitrary value). By reporting 7.10.2, the cluster will be able to connect with tools that check for a particular version number.
+
+For a longer term solution, we plan to create an OpenSearch output plugin for Logstash. This plugin *does not exist yet*, but we've included it in the compatibility matrices below based on its expected behavior.
+
+
+## Compatibility Matrices
+
+*Italicized* cells are untested, but indicate what a value theoretically should be based on existing information.
+
+
+### Compatibility Matrix for Logstash
+
+| | Logstash OSS 7.x to 7.11.x | Logstash OSS 7.12.x\* | Logstash 7.13.x without OpenSearch output plugin | Logstash 7.13.x with OpenSearch output plugin\*\* |
+| :---| :--- | :--- | :--- | :--- |
+| Elasticsearch OSS v7.x to v7.9.x | *Yes* | *Yes* | *No* | *Yes* |
+| Elasticsearch OSS v7.10.2 | *Yes* | *Yes* | *No* | *Yes* |
+| ODFE OSS v1.x to 1.12 | *Yes* | *Yes* | *No* | *Yes* |
+| ODFE 1.13 | *Yes* | *Yes* | *No* | *Yes* |
+| OpenSearch 1.0 | [Yes via version setting](https://github.com/opensearch-project/OpenSearch/issues/693) | [Yes via version setting](https://github.com/opensearch-project/OpenSearch/issues/693) | *No* | *Yes* |
+
+\* Most current compatible version with Elasticsearch OSS.
+
+\*\* Planning to build.
+
+
+### Compatibility Matrix for Beats
+
+| | Beats OSS 7.x to 7.11.x\*\* | Beats OSS 7.12.x\* | Beats 7.13.x |
+| :--- | :--- | :--- | :--- |
+| Elasticsearch OSS v7.x to v7.9.x | *Yes* | *Yes* | No |
+| Elasticsearch OSS v7.10.2 | *Yes* | *Yes* | No |
+| ODFE OSS v1.x to 1.12 | *Yes* | *Yes* | No |
+| ODFE 1.13 | *Yes* | *Yes* | No |
+| OpenSearch 1.0 | [Yes via version setting](https://github.com/opensearch-project/OpenSearch/issues/693) | [Yes via version setting](https://github.com/opensearch-project/OpenSearch/issues/693) | No |
+| Logstash OSS 7.x to 7.11.x | *Yes* | *Yes* | *Yes* |
+| Logstash OSS 7.12.x\* | *Yes* | *Yes* | *Yes* |
+| Logstash 7.13.x with OpenSearch output plugin | *Yes* | *Yes* | *Yes* |
+
+\* Most current compatible version with Elasticsearch OSS.
+
+\*\* Beats OSS includes all Apache 2.0 Beats agents (i.e. Filebeat, Metricbeat, Auditbeat, Heartbeat, Winlogbeat, Packetbeat).
@@ -3,13 +3,16 @@ layout: default
 title: OpenSearch CLI
 nav_order: 52
 has_children: false
+redirect_from:
+  - /docs/odfe-cli/
+  - /docs/cli/
 ---

 # OpenSearch CLI

 The OpenSearch CLI command line interface (opensearch-cli) lets you manage your OpenSearch cluster from the command line and automate tasks.

-Currently, opensearch-cli supports the [Anomaly Detection](../ad/) and [k-NN](../knn/) plugins, along with arbitrary REST API paths. Among other things, you can use opensearch-cli to create and delete detectors, start and stop them, and check k-NN statistics.
+Currently, opensearch-cli supports the [Anomaly Detection]({{site.url}}{{site.baseurl}}/monitoring-plugins/ad/) and [k-NN]({{site.url}}{{site.baseurl}}/search-plugins/knn/) plugins, along with arbitrary REST API paths. Among other things, you can use opensearch-cli to create and delete detectors, start and stop them, and check k-NN statistics.

 Profiles let you easily access different clusters or sign requests with different credentials. opensearch-cli supports unauthenticated requests, HTTP basic signing, and IAM signing for Amazon Web Services.

@@ -0,0 +1,246 @@
+---
+layout: default
+title: Advanced configurations
+parent: Logstash
+nav_order: 230
+---
+
+# Advanced configurations
+
+This section describes how to set up advanced configuration options, like referencing field values and conditional statements, for Logstash.
+
+## Referencing field values
+
+To get access to a field, use the `- field` syntax.
+You can also surround the field name by square brackets `- [field]` which makes it more explicit that you're referring to a field.
+
+
+For example, if you have the following event:
+
+```bash
+{
+  "request": "/products/view/123",
+  "verb": "GET",
+  "response": 200,
+  "headers": {
+  "request_path" => "/"
+  }
+}
+```
+
+To access the `request` field, use `- request` or `- [request]`.
+
+If you want to reference nested fields, use the square brackets syntax and specify the path to the field. With each level being enclosed within square brackets: `- [headers][request_path]`.
+
+You can reference fields using the `sprintf` format. This is also called string expansion. You need to add a % sign and then wrap the field reference within curly brackets.
+
+You need to reference field values when using conditional statements.
+
+For example, you can make the file name dynamic and contain the type of the processed events - either `access` or `error`. The `type` option is mainly used for conditionally applying filter plugins based on the type of events being processed.
+
+Let's add a `type` option and specify a value of `access`.
+
+
+```yml
+input {
+  file {
+    path => ""
+  start_position => "beginning"
+  type => "access"
+  }
+  http {
+    type => "access"
+  }
+}
+
+filter {
+  mutate {
+    remove_field => {"host"}
+  }
+}
+
+output {
+  stdout {
+    codec => rubydebug
+  }
+file {
+  path => "%{[type]}.log"
+  }
+}
+```
+
+Start Logstash and send an HTTP request. The processed event is output in the terminal. The event now includes a field named `type`.
+
+You'll see the `access.log` file created within the Logstash directory.
+
+## Conditional statements
+
+You can use conditional statements to control the flow of code execution based on some conditions.
+
+Syntax:
+
+```yml
+if EXPR {
+  ...
+} else if EXPR {
+  ...
+} else {
+  ...
+}
+```
+
+`EXPR` is any valid Logstash syntax that evaluates to a boolean value.
+For example, you can check if an event type is set to `access` or `error` and perform some action based on that:
+
+```yml
+if [type] == "access" {
+...
+} else if [type] == "error" {
+file { .. }
+} else {
+...
+}
+```
+
+You can compare a field value to some arbitrary value:
+
+```yml
+if [headers][content_length] >= 1000 {
+...
+}
+```
+
+You can regex:
+
+```yml
+if [some_field =~ /[0-9]+/ {
+  //some field only contains digits
+}
+```
+
+You can use arrays:
+
+```yml
+if [some_field] in ["one", "two", "three"] {
+  some field is either "one", "two", or "three"
+}
+```
+
+You can use boolean operators:
+
+```yml
+if [type] == "access" or [type] == "error" {
+  ...
+}
+```
+
+
+## Formatting dates
+
+You can use the `sprintf` format or string expansion to format dates.
+For example, you might want the current date to be part of the filename.
+
+To format the date, add a plus sign in curly brackets followed by the date format - `%{+yyyy-MM-dd}`.
+
+```yml
+file {
+  path => "%{[type]}_%{+yyyy_MM_dd}.log"
+}
+```
+
+This is the date stored within the @timestamp fields, which is the time and date of the event.
+Send a request to the pipeline and verify that a filename is outputted that contains the events date.
+
+You can embed the date in other outputs as well, for example into the index name in OpenSearch.
+
+## Sending time information
+
+You can set the time of events.
+
+Logstash already sets the time when the event is received by the input plugin within the @timestamp field.
+In some scenarios, you might need to use a different timestamp.
+For example, if you have an eCommerce store and you process the orders daily at midnight. When Logstash receives the events at midnight, it sets the timestamp to the current time.
+But you want it to be the time when the order is placed and not when Logstash received the event.
+
+Let's change the event timestamp to the date the request is received by the web server. You can do this using a filter plugin named `dates`.
+The `dates` filter passes a `date` or `datetime` value from a field and uses the results as the event timestamp.
+
+Add the `date` plugin at the bottom of the `filter` block:
+
+```yml
+date {
+  match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
+}
+```
+
+timestamp is the field that the `grok` pattern creates.
+`Z` is the timezone. i.e., UTC offsets.
+
+Start Logstash and send an HTTP request.
+
+You can see that the filename contains the date of the request instead of the present date.
+
+If the passing of the date fails, the `filter` plugin adds a tag named `_datepassfailure` to the text field.
+
+After you have set the @timestamp field to a new value, you don't really need the other `timestamp` field anymore. You can remove it with the `remove_field` option.
+
+```yml
+date {
+  match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
+  remove_field => [ "timestamp" ]
+}
+```
+
+## Parsing user agents
+
+The user agent is the last part of a log entry that consists of the name of the browser, the browser version, and the OS of the device.
+
+Users might be using a wide range of browsers, devices, and OS's. Doing this manually is hard.
+
+You can't use `grok` patterns because the `grok` pattern only matches the usage in the string as whole and doesn't figure out which browser the visitor used for instance.
+
+Logstash ships with a file containing regular expressions for this purpose. This makes it really easy to extract user agent information, which you could send to OpenSearch and run aggregations on.
+
+To do this, add a `source` option that contains the name of the field. In this case, that's the `agent` field.
+By default the user agent plugin, adds a number of fields at the top-level of the event.
+Since that can get pretty confusing, we can add an option named `target` with a value of `ua`, short for user agent. What this does is that it nests the fields within an object named `ua`, making things more organized.
+
+```yml
+useragent {
+  source => "agent"
+  target => "ua"
+}
+```
+
+Start Logstah and send an HTTP request.
+
+You can see a field named `ua` with a number of keys including the browser name and version, the OS, and the device.
+
+You could OpenSearch Dashboards to create a pie chart that shows how many visitors are from mobile devices and how many are desktop users. Or, you could get statistics on which browser versions are popular.
+
+## Enriching geographical data
+
+You can take an IP address and perform geographical lookup to resolve the geographical location of the user using the `geoip` filter.
+
+The `geoip` filter plugin ships with a database called `geolite 2`, which is provided by a company named MaxMind. `geolite 2` is a popular source of geographical data and it's available for free.
+Add the `geoip` plugin at the bottom of the `else` block.
+
+The value of the `source` option is the name of the field containing the IP address, in this case that's `clientip`. You can make this field available using the `grok` pattern.
+
+```yml
+geoip {
+  source => "clientip"
+}
+```
+
+Start Logstash and send an HTTP request.
+
+Within the terminal, you see a new field named `geoip` that contains information such as the timezone, country, continent, city, postal code, and the latitude / longitude pair.
+
+If you only need the country name for instance, include an option named `fields` with an array of the field names that you want the `geoip` plugin to return.
+
+Some of the fields are not always available such as city name and region because translating IP addresses into geographical locations is generally not that accurate. If the `geoip` plugin fails to look up the geographical location, it adds a tag named `geoip_lookup_failure`.
+
+You can use the `geoip` plugin with the OpenSearch output because `location` object within the `geoip` object, is a standard format for representing geospatial data in JSON. This is the same format as OpenSearch uses for its `geo_point` data type.
+
+You can use the powerful geospatial queries of OpenSearch for working with geographical data.
@@ -0,0 +1,157 @@
+---
+layout: default
+title: Common filter plugins
+parent: Logstash
+nav_order: 220
+---
+
+# Common filter plugins
+
+This page contains a list of common filter plugins.
+
+## mutate
+
+You can use the `mutate` filter to change the data type of a field. For example, you can use the `mutate` filter if you're sending events to OpenSearch and you need to change the data type of a field to match any existing mappings.
+
+To convert the `quantity` field from a `string` type to an `integer` type:
+
+```yml
+input {
+  http {
+    host => "127.0.0.1"
+    port => 8080
+  }
+}
+
+filter {
+  mutate {
+   convert => {"quantity" => "integer"}
+  }
+}
+
+output {
+  file {
+    path => "output.txt"
+  }
+}
+```
+
+#### Sample output
+
+You can see that the type of the `quantity` field is changed from a `string` to an `integer`.
+
+```yml
+{
+  "quantity" => 3,
+  "host" => "127.0.0.1",
+  "@timestamp" => 2021-05-23T19:02:08.026Z,
+  "amount" => 10,
+  "@version" => "1",
+  "headers" => {
+    "request_path" => "/",
+    "connection" => "keep-alive",
+    "content_length" => "41",
+    "http_user_agent" => "PostmanRuntime/7.26.8",
+    "request_method" => "PUT",
+    "cache_control" => "no-cache",
+    "http_accept" => "*/*",
+    "content_type" => "application/json",
+    "http_version" => "HTTP/1.1",
+    "http_host" => "127.0.0.1:8080",
+    "accept_encoding" => "gzip, deflate, br",
+    "postman_token" => "ffd1cdcb-7a1d-4d63-90f8-0f2773069205"
+   }
+}
+```
+
+Other data types you can convert to are `float`, `string`, and `boolean` values. If you pass in an array, the `mutate` filter converts all the elements in the array. If you pass a `string` like "world" to cast to an `integer` type, the result is 0 and Logstash continues processing events.
+
+Logstash supports a few common options for all filter plugins:
+
+Option | Description
+:--- | :---
+`add_field` | Adds one or more fields to the event.
+`remove_field` | Removes one or more events from the field.
+`add_tag` | Adds one or more tags to the event. You can use tags to perform conditional processing on events depending on which tags they contain.
+`remove_tag` | Removes one or more tags from the event.
+
+For example, you can remove the `host` field from the event:
+
+```yml
+input {
+  http {
+    host => "127.0.0.1"
+    port => 8080
+  }
+}
+
+filter {
+  mutate {
+    remove_field => {"host"}
+  }
+}
+
+output {
+  file {
+    path => "output.txt"
+  }
+}
+```
+
+## grok
+
+With the `grok` filter, you can parse unstructured data and and structure it into fields. The `grok` filter uses text patterns to match text in your logs. You can think of text patterns as variables containing regular expressions.
+
+The format of a text pattern is as follows:
+
+```bash
+%{SYNTAX:SEMANTIC}
+```
+
+`SYNTAX` is the format a piece of text should be in for the pattern to match. You can enter any of `grok`'s predefined patterns. For example, you can use the email identifier to match an email address from a given piece of text.
+
+`SEMANTIC` is an arbitrary name for the matched text. For example, if you're using the email identifier syntax, you can name it “email.”
+
+The following request consists of the IP address of the visitor, name of the visitor, the timestamp of the request, the HTTP verb and URL, the HTTP status code, and the number of bytes:
+
+```bash
+184.252.108.229 - joe [20/Sep/2017:13:22:22 +0200] GET /products/view/123 200 12798
+```
+
+To split this request into different fields:
+
+```yml
+filter {
+  grok {
+   match => { "message" => " %{IP: ip_address} %{USER:identity}
+                             %{USER:auth} \[%{HTTPDATE:reg_ts}\]
+                             \"%{WORD:http_verb}
+                             %{URIPATHPARAM: req_path}
+                             \" %{INT:http_status:int}
+                             %{INT:num_bytes:int}"}
+  }
+}
+```
+
+where:
+
+- `IP`: matches the IP address field.
+- `USER`: matches the user name.
+- `WORD`: matches the HTTP verb.
+- `URIPATHPARAM`: matches the URI path.
+- `INT`: matches the HTTP status field.
+- `INT`: matches the number of bytes.
+
+This is what the event looks like after the `grok` filter breaks it down into individual fields:
+
+```yml
+ip_address: 184.252.108.229
+identity: joe
+reg_ts: 20/Sep/2017:13:22:22 +0200
+http_verb:GET
+req_path: /products/view/123
+http_status: 200
+num_bytes: 12798
+```
+
+For common log formats, you use the predefined patterns defined here⁠---[Logstash patterns](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/ecs-v1). You can make any adjustments to the results with the `mutate` filter.
@@ -0,0 +1,40 @@
+---
+layout: default
+title: Logstash execution model
+parent: Logstash
+nav_order: 210
+---
+
+# Logstash execution model
+
+Here's a brief introduction to how Logstash processes events internally.
+
+## Handling events concurrently
+
+You can configure Logstash to have a number of inputs listening for events. Each input runs in its own thread to avoid inputs blocking each other. If you have two incoming events at the same time, Logstash handles both events concurrently.
+
+After receiving an event and possibly applying an input codec, Logstash sends the event to a work queue. Pipeline workers or batchers perform the rest of the work involving filters and outputs along with any codec used at the output. Each pipeline worker also runs within its own thread meaning that Logstash processes multiple events simultaneously.
+
+## Processing events in batches
+
+A pipeline worker consumes events from the work queue in batches to optimize the throughput of the pipeline as a whole.
+
+One reason why Logstash works in batches is that some code needs to be executed regardless of how many events are processed at a time within the pipeline worker. Instead of executing that code 100 times for 100 events, it’s more efficient to execute it once for a batch of 100 events.
+
+Another reason is that a few output plugins group together events as batches. For example, if you send 100 requests to OpenSearch, the OpenSearch output plugin uses the bulk API to send a single request that groups together the 100 requests.
+
+Logstash determines the batch size by two configuration options⁠---a number representing the maximum batch size and the batch delay. The batch delay is how long Logstash waits before processing the unprocessed batch of events.
+If you set the maximum batch size to 50 and the batch delay to 100 ms, Logstash processes a batch if they're either 50 unprocessed events in the work queue or if one hundred milliseconds have elapsed.
+
+The reason that a batch is processed, even if the maximum batch size isn’t reached, is to reduce the delay in processing and to continue to process events in a timely manner. This works well for pipelines that process a low volume of events.
+
+Imagine that you’ve a pipeline that processes error logs from web servers and pushes them to OpenSearch. You’re using OpenSearch Dashboards to analyze the error logs. Because you’re possibly dealing with a fairly low number of events, it might take a long time to reach 50 events. Logstash processes the events before reaching this threshold because otherwise there would be a long delay before we see the errors appear in OpenSearch Dashboards.
+
+The default batch size and batch delay work for most cases. You don’t need to change the default values unless you need to minutely optimize the performance.
+
+## Optimizing based on CPU cores
+
+The number of pipeline workers are proportional to the number of CPU cores on the nodes.
+If you have 5 workers running on a server with 2 CPU cores, the 5 workers won't be able to process events concurrently. On the other hand, running 5 workers on a server running 10 CPU cores limits the throughput of a Logstash instance.
+
+Instead of running a fixed number of workers, which results in poor performance in some cases, Logstash examines the number of CPU cores of the instance and selects the number of pipeline workers to optimize its performance for the platform on which its running. For instance, your local development machine might not have the same processing power as a production server. So you don't need to manually configure Logstash for different machines.
@@ -0,0 +1,356 @@
+---
+layout: default
+title: Logstash
+nav_order: 200
+has_children: true
+has_toc: true
+---
+
+# Logstash
+
+Logstash is a real-time event processing engine. It's part of the OpenSearch stack which includes OpenSearch, Beats, and OpenSearch Dashboards.
+
+You can send events to Logstash from many different sources. Logstash processes the events and sends it one or more destinations. For example, you can send access logs from a web server to Logstash. Logstash extracts useful information from each log and sends it to a destination like OpenSearch.
+
+Sending events to Logstash lets you decouple event processing from your app. Your app only needs to send events to Logstash and doesn’t need to know anything about what happens to the events afterwards.
+
+The open-source community originally built Logstash for processing log data but now you can process any type of events, including events in XML or JSON format.
+
+## Structure of a pipeline
+
+The way that Logstash works is that you configure a pipeline that has three phases⁠---inputs, filters, and outputs.
+
+Each phase uses one or more plugins. Logstash has over 200 built-in plugins so chances are that you’ll find what you need. Apart from the built-in plugins, you can use plugins from the community or even write your own.
+
+The structure of a pipeline is as follows:
+
+```yml
+input {
+  input_plugin => {}
+}
+
+filter {
+  filter_plugin => {}
+}
+
+output {
+  output_plugin => {}
+}
+```
+
+where:
+
+* `input` receives events like logs from multiple sources simultaneously. Logstash supports a number of input plugins for TCP/UDP, files, syslog, Microsoft Windows EventLogs, stdin, HTTP, and so on. You can also use an open source collection of input tools called Beats to gather events. The input plugin sends the events to a filter.
+* `filter` parses and enriches the events in one way or the other. Logstash has a large collection of filter plugins that modify events and pass them on to an output. For example, a `grok` filter parses unstructured events into fields and a `mutate` filter changes fields. Filters are executed sequentially.
+* `output` ships the filtered events to one or more destinations. Logstash supports a wide range of output plugins for destinations like OpenSearch, TCP/UDP, emails, files, stdout, HTTP, Nagios, and so on.
+
+Both the input and output phases support codecs to process events as they enter or exit the pipeline.
+Some of the popular codecs are `json` and `multiline`. The `json` codec processes data that’s in JSON format and the `multiline` codec merges multiple line events into a single line.
+
+You can also write conditional statements within pipeline configurations to perform certain actions, if a certain criteria is met.
+
+## Install Logstash
+
+The OpenSearch Logstash plugin has two installation options at this time: Linux (ARM64/X64) and Docker (ARM64/X64).
+
+Make sure you have [Java Development Kit (JDK)](https://www.oracle.com/java/technologies/javase-downloads.html) version 8 or 11 installed.
+
+### Tarball
+
+1. Download the Logstash tarball from [OpenSearch downloads](https://opensearch.org/downloads.html).
+
+2. Navigate to the downloaded folder in the terminal and extract the files:
+
+     ```bash
+     tar -zxvf logstash-oss-with-opensearch-output-plugin-7.13.2-linux-x64.tar.gz
+     ```
+
+3. Navigate to the `logstash-7.13.2` directory.
+- You can add your pipeline configurations to the `config` directory. Logstash saves any data from the plugins in the `data` directory. The `bin` directory contains the binaries for starting Logstash and managing plugins.
+
+### Docker
+
+1. Pull the Logstash oss package with the OpenSearch output plugin image:
+
+```
+docker pull opensearchproject/logstash-oss-with-opensearch-output-plugin:7.13.2
+```
+
+1. Create a Docker network:
+
+```
+docker network create test
+```
+
+1. Start OpenSearch with this network:
+
+```
+docker run -p 9200:9200 -p 9600:9600 --name opensearch --net test -e "discovery.type=single-node" opensearchproject/opensearch:1.0.0
+```
+
+1. Start Logstash:
+
+```
+docker run -it --rm --name logstash --net test openserachproject/logstash-oss-with-opensearch-output-plugin:7.13.2 -e 'input { stdin { } } output {
+  opensearch {
+    hosts => ["https://opensearch:9200"]
+    index => "opensearch-logstash-docker-%{+YYYY.MM.dd}"
+    user => "admin"
+    password => "admin"
+    ssl => true
+    ssl_certificate_verification => false
+  }
+}'
+```
+
+## Process text from the terminal
+
+You can define a pipeline that listens for events on `stdin` and outputs events on `stdout`. `stdin` and `stdout` refer to the terminal in which you’re running Logstash.
+
+To enter some text in the terminal and see the event data in the output:
+
+1. Use the `-e` argument to pass a pipeline configuration directly to the Logstash binary. In this case, `stdin` is the input plugin and `stdout` is the output plugin:
+
+    ```bash
+    bin/logstash -e "input { stdin { } } output { stdout { } }"
+    ```
+    Add the `—debug` flag to see a more detailed output.
+
+2. Enter "hello world" in your terminal. Logstash processes the text and outputs it back to the terminal:
+
+    ```yml
+    {
+     "message" => "hello world",
+     "host" => "a483e711a548.ant.amazon.com",
+     "@timestamp" => 2021-05-30T05:15:56.816Z,
+     "@version" => "1"
+    }
+    ```
+
+    The `message` field contains your raw input. The `host` field is an IP address when you don’t run Logstash locally. `@timestamp` shows the date and time for when the event is processed. Logstash uses the `@version` field for internal processing.
+
+3. Press `Ctrl + C` to shut down Logstash.
+
+### Troubleshooting
+
+If you already have a Logstash process running, you’ll get an error. To fix this issue:
+
+1. Delete the `.lock` file from the `data` directory:
+
+    ```bash
+    cd data
+    rm -rf .lock
+    ```
+
+2. Restart Logstash.
+
+## Process JSON or HTTP input and output it to a file
+
+To define a pipeline that handles JSON requests:
+
+1. Open the `config/pipeline.conf` file in any text editor you like. You can create a pipeline configuration file with any extension, the `.conf` extension is a Logstash convention. Add the `json` codec to accept JSON as the input and the `file` plugin to output the processed events to a `.txt` file:
+
+    ```yml
+    input {
+      stdin {
+        codec => json
+      }
+    }
+    output {
+      file {
+        path => "output.txt"
+      }
+    }
+    ```
+
+    To process inputs from a file, add an input file to the `events-data` directory and then pass its path to the `file` plugin at the input:
+
+    ```yml
+    input {
+      file {
+        path => "events-data/input_data.log"
+      }
+    }
+    ```
+
+2. Start Logstash:
+
+    ```bash
+    $ bin/logstash -f config/pipeline.conf
+    ```
+
+    `config/pipeline.conf` is a relative path to the `pipeline.conf` file. You can use an absolute path as well.
+
+3. Add a JSON object in the terminal:
+
+    ```json
+    { "amount": 10, "quantity": 2}
+    ```
+
+    The pipeline only handles a single line of input. If you paste some JSON that spans multiple lines, you’ll get an error.
+
+4. Check that the fields from the JSON object are added to the `output.txt` file:
+
+    ```json
+    $ cat output.txt
+
+    {
+      "@version": "1",
+      "@timestamp": "2021-05-30T05:52:52.421Z",
+      "host": "a483e711a548.ant.amazon.com",
+      "amount": 10,
+      "quantity": 2
+    }
+    ```
+
+    If you type in some invalid JSON as the input, you'll see a JSON parsing error. Logstash doesn't discard the invalid JSON because you still might want to do something with it. For example, you can trigger an email or send a notification to a Slack channel.
+
+To define a pipeline that handles HTTP requests:
+
+1. Use the `http` plugin to send events to Logstash through HTTP:
+
+    ```yml
+    input {
+      http {
+        host => "127.0.0.1"
+        port => 8080
+      }
+    }
+
+    output {
+      file {
+        path => "output.txt"
+      }
+    }
+    ```
+
+    If you don’t specify any options, the `http` plugin binds to `localhost` and listens on port 8080.
+
+2. Start Logstash:
+
+    ```bash
+    $ bin/logstash -f config/pipeline.conf
+    ```
+
+3. Use Postman to send an HTTP request. Set `Content-Type` to an HTTP header with a value of `application/json`:
+
+    ```json
+    PUT 127.0.0.1:8080
+
+    {
+      "amount": 10,
+      "quantity": 2
+    }
+    ```
+
+    Or, you can use the `curl` command:
+
+    ```bash
+    curl -XPUT -H "Content-Type: application/json" -d ' {"amount": 7, "quantity": 3 }' http://localhost:8080 (http://localhost:8080/)
+    ```
+
+    Even though we haven't added the `json` plugin to the input, the pipeline configuration still works because the HTTP plugin automatically applies the appropriate codec based on the `Content-Type` header.
+    If you specify a value of `applications/json`, Logstash parses the request body as JSON.
+
+    The `headers` field contains the HTTP headers that Logstash receives:
+
+    ```json
+    {
+      "host": "127.0.0.1",
+      "quantity": "3",
+      "amount": 10,
+      "@timestamp": "2021-05-30T06:05:48.135Z",
+      "headers": {
+        "http_version": "HTTP/1.1",
+        "request_method": "PUT",
+        "http_user_agent": "PostmanRuntime/7.26.8",
+        "connection": "keep-alive",
+        "postman_token": "c6cd29cf-1b37-4420-8db3-9faec66b9e7e",
+        "http_host": "127.0.0.1:8080",
+        "cache_control": "no-cache",
+        "request_path": "/",
+        "content_type": "application/json",
+        "http_accept": "*/*",
+        "content_length": "41",
+        "accept_encoding": "gzip, deflate, br"
+      },
+    "@version": "1"
+    }
+    ```
+
+
+## Automatically reload the pipeline configuration
+
+You can configure Logstash to detect any changes to the pipeline configuration file or the input log file and automatically reload the configuration.
+
+The `stdin` plugin doesn’t supporting automatic reloading.
+{: .note }
+
+1. Add an option named `start_position` with a value of `beginning` to the input plugin:
+
+    ```yml
+    input {
+      file {
+        path => "/Users/<user>/Desktop/logstash7-12.1/events-data/input_file.log"
+        start_position => "beginning"
+      }
+    }
+    ```
+
+    Logstash only processes any new events added to the input file and ignores the ones that it has already processed to avoid processing the same event more than once on restart.
+
+    Logstash records its progress in a file that's referred to as a `sinceDB` file. Logstash creates a `sinceDB` file for each file that it watches for changes.
+
+2. Open the `sinceDB` file to check how much of the input files are processed:
+
+    ```bash
+    cd data/plugins/inputs/file/
+    ls -al
+
+    -rw-r--r--  1 user  staff   0 Jun 13 10:50 .sincedb_9e484f2a9e6c0d1bdfe6f23ac107ffc5
+
+    cat .sincedb_9e484f2a9e6c0d1bdfe6f23ac107ffc5
+
+    51575938 1 4 7727
+    ```
+
+    The last number in the `sinceDB` file (7727) is the byte offset of the last known event processed.
+
+5. To process the input file from the beginning, delete the `sinceDB` file:
+
+    ```yml
+    rm .sincedb_*
+    ```
+
+2. Start Logstash with a `—-config.reload.automatic` argument:
+
+    ```bash
+    bin/logstash -f config/pipeline.conf --config.reload.automatic
+    ```
+
+    The `reload` option only reloads if you add a new line at the end of the pipeline configuration file.
+
+    Sample output:
+
+    ```yml
+    {
+       "message" => "216.243.171.38 - - [20/Sep/2017:19:11:52 +0200] \"GET /products/view/123 HTTP/1.1\" 200 12798 \"https://codingexplained.com/products\" \"Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)\"",
+       "@version" => "1",
+          "host" => "a483e711a548.ant.amazon.com",
+          "path" => "/Users/kumarjao/Desktop/odfe1/logstash-7.12.1/events-data/input_file.log",
+       "@timestamp" => 2021-06-13T18:03:30.423Z
+    }
+    {
+       "message" => "91.59.108.75 - - [20/Sep/2017:20:11:43 +0200] \"GET /js/main.js HTTP/1.1\" 200 588 \"https://codingexplained.com/products/view/863\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0\"",
+      "@version" => "1",
+          "host" => "a483e711a548.ant.amazon.com",
+          "path" => "/Users/kumarjao/Desktop/odfe1/logstash-7.12.1/events-data/input_file.log",
+    "@timestamp" => 2021-06-13T18:03:30.424Z
+    }
+    ```
+
+7. Add a new line to the input file.
+    - Logstash immediately detects the change and processes the new line as an event.
+
+8. Make a change to the `pipeline.conf` file.
+    - Logstash immediately detects the change and reloads the modified pipeline.
@@ -0,0 +1,77 @@
+---
+layout: default
+title: Ship events to OpenSearch
+parent: Logstash
+nav_order: 220
+---
+
+# Ship events to OpenSearch
+
+You can Ship Logstash events to an OpenSearch cluster and then visualize your events with OpenSearch Dashboards.
+
+Make sure you have [Logstash]({{site.url}}{{site.baseurl}}/logstash/index/#install-logstash-on-mac--linux), [OpenSearch]({{site.url}}{{site.baseurl}}/opensearch/install/index/), and [OpenSearch Dashboards]({{site.url}}{{site.baseurl}}/dashboards/install/index/).
+{: .note }
+
+## OpenSearch output plugin
+
+To run the OpenSearch output plugin, add the following configuration in your `pipeline.conf` file:
+
+```yml
+output {
+  opensearch {
+    hosts       => "https://localhost:9200"
+    user        => "admin"
+    password    => "admin"
+    index       => "logstash-logs-%{+YYYY.MM.dd}"
+    ssl_certificate_verification => false
+  }
+}
+```
+
+
+## Sample walkthrough
+
+1.  Open the `config/pipeline.conf` file and add in the following configuration:
+
+    ```yml
+    input {
+      stdin {
+        codec => json
+      }
+    }
+
+    output {
+      opensearch {
+        hosts       => "https://localhost:9200"
+        user        => "admin"
+        password    => "admin"
+        index       => "logstash-logs-%{+YYYY.MM.dd}"
+        ssl_certificate_verification => false
+      }
+    }
+    ```
+
+    This Logstash pipeline accepts JSON input through the terminal and ships the events to an OpenSearch cluster running locally. Logstash writes the events to an index with the `logstash-logs-%{+YYYY.MM.dd}` naming convention.
+
+2. Start Logstash:
+
+    ```bash
+    $ bin/logstash -f config/pipeline.conf --config.reload.automatic
+    ```
+
+    `config/pipeline.conf` is a relative path to the `pipeline.conf` file. You can use an absolute path as well.
+
+3. Add a JSON object in the terminal:
+
+    ```json
+    { "amount": 10, "quantity": 2}
+    ```
+
+4. Start OpenSearch Dashboards and choose **Dev Tools**:
+
+    ```json
+    GET _cat/indices?v
+
+    health | status | index | uuid | pri | rep | docs.count | docs.deleted | store.size | pri.store.size
+    green | open | logstash-logs-2021.07.01 | iuh648LYSnmQrkGf70pplA | 1 | 1 | 1 | 0 | 10.3kb | 5.1kb
+    ```
@@ -1,26 +1,11 @@
-# Welcome to Jekyll!
-#
-# This config file is meant for settings that affect your whole blog, values
-# which you are expected to set up once and rarely edit after that. If you find
-# yourself editing this file very often, consider using Jekyll's data files
-# feature for the data you need to update frequently.
-#
-# For technical reasons, this file is *NOT* reloaded automatically when you use
-# 'bundle exec jekyll serve'. If you change this file, please restart the server process.
-
-# Site settings
-# These are used to personalize your new site. If you look in the HTML files,
-# you will see them accessed via {{ site.title }}, {{ site.email }}, and so on.
-# You can create any custom variable you would like, and they will be accessible
-# in the templates via {{ site.myvariable }}.
 title: OpenSearch documentation
 description: >- # this means to ignore newlines until "baseurl:"
  Documentation for OpenSearch, the Apache 2.0 search, analytics, and visualization suite with advanced security, alerting, SQL support, automated index management, deep performance analysis, and more.
 baseurl: "" # the subpath of your site, e.g. /blog
 url: "https://docs-beta.opensearch.org" # the base hostname & protocol for your site, e.g. http://example.com
-permalink: pretty
+permalink: /:path/

-opensearch_version: 1.0.0-beta1
+opensearch_version: 1.0.0-rc1
 opensearch_major_minor_version: 1.0

 # Build settings
@@ -39,6 +24,76 @@ aux_links:
    - "https://opensearch.org"
 color_scheme: opensearch

+# Define Jekyll collections
+collections:
+  # Define a collection named "tests", its documents reside in the "_tests" directory
+  migrate:
+    permalink: /:collection/:path/
+    output: true
+  opensearch:
+    permalink: /:collection/:path/
+    output: true
+  dashboards:
+    permalink: /:collection/:path/
+    output: true
+  security-plugin:
+    permalink: /:collection/:path/
+    output: true
+  search-plugins:
+    permalink: /:collection/:path/
+    output: true
+  im-plugin:
+    permalink: /:collection/:path/
+    output: true
+  monitoring-plugins:
+    permalink: /:collection/:path/
+    output: true
+  clients:
+    permalink: /:collection/:path/
+    output: true
+  troubleshoot:
+    permalink: /:collection/:path/
+    output: true
+  external_links:
+    permalink: /:collection/:path/
+    output: true
+
+just_the_docs:
+  # Define the collections used in the theme
+  collections:
+    migrate:
+      name: Migrate to OpenSearch
+      # nav_exclude: true
+      nav_fold: true
+      # search_exclude: true
+    opensearch:
+      name: OpenSearch
+      nav_fold: true
+    dashboards:
+      name: OpenSearch Dashboards
+      nav_fold: true
+    security-plugin:
+      name: Security plugin
+      nav_fold: true
+    search-plugins:
+      name: Search plugins
+      nav_fold: true
+    im-plugin:
+      name: Index management plugin
+      nav_fold: true
+    monitoring-plugins:
+      name: Monitoring plugins
+      nav_fold: true
+    clients:
+      name: Clients and tools
+      nav_fold: true
+    troubleshoot:
+      name: Troubleshooting
+      nav_fold: true
+    external_links:
+      name: External links
+
+
 # Enable or disable the site search
 # Supports true (default) or false
 search_enabled: true
@@ -0,0 +1,17 @@
+---
+layout: default
+title: Browser compatibility
+parent: OpenSearch Dashboards
+nav_order: 3
+---
+
+# Browser compatibility
+
+OpenSearch Dashboards supports the following web browsers:
+
+- Chrome
+- Firefox
+- Safari
+- Edge (Chromium)
+
+Other Chromium-based browsers might work, as well. Internet Explorer and Microsoft Edge Legacy are **not** supported.
@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Gantt charts
-parent: OpenSearch Dashboards
 nav_order: 10
 ---

@@ -21,6 +20,6 @@ To create a Gantt chart, perform the following steps:
 1. Choose **Panel settings** to adjust axis labels, time format, and colors.
 1. Choose **Update**.

-![Gantt Chart](../../images/gantt-chart.png)
+![Gantt Chart]({{site.url}}{{site.baseurl}}/images/gantt-chart.png)

 This Gantt chart displays the ID of each log on the y-axis. Each bar is a unique event that spans some amount of time. Hover over a bar to see the duration of that event.
@@ -1,9 +1,13 @@
 ---
 layout: default
-title: OpenSearch Dashboards
-nav_order: 11
-has_children: true
+title: About Dashboards
+nav_order: 1
+has_children: false
 has_toc: false
+redirect_from:
+  - /docs/opensearch-dashboards/
+  - /opensearch-dashboards/
+  - /dashboards/
 ---

 # OpenSearch Dashboards
@@ -2,7 +2,6 @@
 layout: default
 title: Docker
 parent: Install OpenSearch Dashboards
-grand_parent: OpenSearch Dashboards
 nav_order: 1
 ---

@@ -12,13 +11,13 @@ You *can* start OpenSearch Dashboards using `docker run` after [creating a Docke

 1. Run `docker pull opensearchproject/opensearch-dashboards:{{site.opensearch_version}}`.

-1. Create a [`docker-compose.yml`](https://docs.docker.com/compose/compose-file/) file appropriate for your environment. A sample file that includes OpenSearch Dashboards is available on the OpenSearch [Docker installation page](../opensearch/docker/#sample-docker-compose-file).
+1. Create a [`docker-compose.yml`](https://docs.docker.com/compose/compose-file/) file appropriate for your environment. A sample file that includes OpenSearch Dashboards is available on the OpenSearch [Docker installation page]({{site.url}}{{site.baseurl}}/opensearch/install/docker#sample-docker-compose-file).

   Just like `opensearch.yml`, you can pass a custom `opensearch_dashboards.yml` to the container in the Docker Compose file.
   {: .tip }

 1. Run `docker-compose up`.

-   Wait for the containers to start. Then see the [OpenSearch Dashboards documentation](../../../opensearch-dashboards/).
+   Wait for the containers to start. Then see the [OpenSearch Dashboards documentation]({{site.url}}{{site.baseurl}}/).

 1. When finished, run `docker-compose down`.
@@ -2,8 +2,9 @@
 layout: default
 title: Install OpenSearch Dashboards
 nav_order: 1
-parent: OpenSearch Dashboards
 has_children: true
+redirect_from:
+  - /dashboards/install/
 ---

 # Install and configure OpenSearch Dashboards
@@ -2,7 +2,6 @@
 layout: default
 title: OpenSearch Dashboards plugins
 parent: Install OpenSearch Dashboards
-grand_parent: OpenSearch Dashboards
 nav_order: 50
 ---

@@ -29,11 +28,25 @@ If you don't want to use the all-in-one installation options, you can install th
    </tr>
  </thead>
  <tbody>
+  <tr>
+    <td>1.0.0-rc1</td>
+    <td>
+      <pre>alertingDashboards          1.0.0.0-rc1
+anomalyDetectionDashboards  1.0.0.0-rc1
+ganttChartDashboards        1.0.0.0-rc1
+indexManagementDashboards   1.0.0.0-rc1
+notebooksDashboards         1.0.0.0-rc1
+queryWorkbenchDashboards    1.0.0.0-rc1
+reportsDashboards           1.0.0.0-rc1
+securityDashboards          1.0.0.0-rc1
+traceAnalyticsDashboards    1.0.0.0-rc1
+</pre>
+    </td>
+  </tr>
  <tr>
    <td>1.0.0-beta1</td>
    <td>
-      <pre>
-alertingDashboards          1.0.0.0-beta1
+      <pre>alertingDashboards          1.0.0.0-beta1
 anomalyDetectionDashboards  1.0.0.0-beta1
 ganttChartDashboards        1.0.0.0-beta1
 indexManagementDashboards   1.0.0.0-beta1
@@ -52,14 +65,15 @@ traceAnalyticsDashboards    1.0.0.0-beta1
 ## Prerequisites

 - A compatible OpenSearch cluster
- The corresponding OpenSearch plugins [installed on that cluster](../../install/plugins)
- The corresponding version of [OpenSearch Dashboards](../) (e.g. OpenSearch Dashboards 1.0.0 works with OpenSearch 1.0.0)
+- The corresponding OpenSearch plugins [installed on that cluster]({{site.url}}{{site.baseurl}}/opensearch/install/plugins/)
+- The corresponding version of [OpenSearch Dashboards]({{site.url}}{{site.baseurl}}/) (e.g. OpenSearch Dashboards 1.0.0 works with OpenSearch 1.0.0)


 ## Install

 Navigate to the OpenSearch Dashboards home directory (likely `/usr/share/opensearch-dashboards`) and run the install command for each plugin.

+{% comment %}

 #### Security OpenSearch Dashboards

@@ -146,6 +160,7 @@ sudo bin/opensearch-dashboards-plugin install https://d3g5vo6xdbdb9a.cloudfront.

 This plugin adds a new Gantt chart visualization.

+{% endcomment %}

 ## List installed plugins

@@ -164,6 +179,8 @@ To remove a plugin:
 sudo bin/opensearch-dashboards-plugin remove <plugin-name>
 ```

+Then remove all associated entries from `opensearch_dashboards.yml`.
+
 For certain plugins, you must also remove the "optimze" bundle. This is a sample command for the Anomaly Detection plugin:

 ```bash
@@ -2,7 +2,6 @@
 layout: default
 title: Tarball
 parent: Install OpenSearch Dashboards
-grand_parent: OpenSearch Dashboards
 nav_order: 30
 ---

@@ -28,4 +27,4 @@ nav_order: 30
   ./bin/opensearch-dashboards
   ```

-1. See the [OpenSearch Dashboards documentation](../../opensearch-dashboards/).
+1. See the [OpenSearch Dashboards documentation]({{site.url}}{{site.baseurl}}/opensearch-dashboards/).
@@ -1,7 +1,6 @@
 ---
 layout: default
 title: WMS map server
-parent: OpenSearch Dashboards
 nav_order: 5
 ---

@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Notebooks (experimental)
-parent: OpenSearch Dashboards
 nav_order: 50
 redirect_from: /docs/notebooks/
 has_children: false
@@ -9,7 +8,7 @@ has_children: false

 # OpenSearch Dashboards notebooks (experimental)

-Notebooks have a known issue with [tenants](../../security/access-control/multi-tenancy/). If you open a notebook and can't see its visualizations, you might be under the wrong tenant, or you might not have access to the tenant at all.
+Notebooks have a known issue with [tenants]({{site.url}}{{site.baseurl}}/security-plugin/access-control/multi-tenancy/). If you open a notebook and can't see its visualizations, you might be under the wrong tenant, or you might not have access to the tenant at all.
 {: .warning }

 An OpenSearch Dashboards notebook is an interface that lets you easily combine live visualizations and narrative text in a single notebook interface.
@@ -46,7 +45,7 @@ Paragraphs combine text and visualizations for describing data.
 1. To add text, choose **Add markdown paragraph**.
 1. Add rich text with markdown syntax.

-![Markdown paragraph](../../images/markdown-notebook.png)
+![Markdown paragraph]({{site.url}}{{site.baseurl}}/images/markdown-notebook.png)


 #### Add a visualization paragraph
@@ -1,14 +1,13 @@
 ---
 layout: default
 title: Reporting
-parent: OpenSearch Dashboards
 nav_order: 20
 ---


 # Reporting

-You can use OpenSearch Dashboards to create PNG, PDF, and CSV reports. To create reports, you must have the correct permissions. For a summary of the predefined roles and the permissions they grant, see the [security plugin](../../security/access-control/users-roles/#predefined-roles).
+You can use OpenSearch Dashboards to create PNG, PDF, and CSV reports. To create reports, you must have the correct permissions. For a summary of the predefined roles and the permissions they grant, see the [security plugin]({{site.url}}{{site.baseurl}}/security-plugin/access-control/users-roles#predefined-roles).


 ## Create reports from Discovery, Visualize, or Dashboard
@@ -36,7 +35,7 @@ Definitions let you generate reports on a periodic schedule.
 1. (Optional) Add a header or footer to the report. Headers and footers are only available for dashboard or visualization reports.
 1. Under **Report trigger**, choose either **On-demand** or **Schedule**.

-   For scheduled reports, select either **Recurring** or **Cron based**. You can receive reports daily or at some other time interval. Cron expressions give you even more flexiblity. See [Cron expression reference](../../alerting/cron/) for more information.
+   For scheduled reports, select either **Recurring** or **Cron based**. You can receive reports daily or at some other time interval. Cron expressions give you even more flexiblity. See [Cron expression reference]({{site.url}}{{site.baseurl}}/monitoring-plugins/alerting/cron/) for more information.

 1. Choose **Create**.

@@ -46,7 +45,7 @@ Definitions let you generate reports on a periodic schedule.

 While creating a report for dashboards or visualizations, you might see a the following error:

-![OpenSearch Dashboards reporting pop-up error message](../../images/reporting-error.png)
+![OpenSearch Dashboards reporting pop-up error message]({{site.url}}{{site.baseurl}}/images/reporting-error.png)

 This problem can occur for two reasons:

@@ -0,0 +1,7 @@
+---
+layout: default
+title: Javadoc
+nav_order: 1
+permalink: /javadoc/
+redirect_to: https://opensearch.org/docs/javadocs/
+---
@@ -1,14 +1,13 @@
 ---
 layout: default
-title: Index Rollups
+title: Index rollups
 nav_order: 35
-parent: Index management
 has_children: true
 redirect_from: /docs/ism/index-rollups/
 has_toc: false
 ---

-# Index Rollups
+# Index rollups

 Time series data increases storage costs, strains cluster health, and slows down aggregations over time. Index rollup lets you periodically reduce data granularity by rolling up old data into summarized indices.

@@ -52,7 +51,7 @@ The order in which you select attributes is critical. A city followed by a demog
 Specify a schedule to roll up your indices as it’s being ingested. The index rollup job is enabled by default.

 1. Specify if the data is continuous or not.
-3. For roll up execution frequency, select **Define by fixed interval** and specify the **Rollup interval** and the time unit or **Define by cron expression** and add in a cron expression to select the interval. To learn how to define a cron expression, see [Alerting](../alerting/cron/).
+3. For roll up execution frequency, select **Define by fixed interval** and specify the **Rollup interval** and the time unit or **Define by cron expression** and add in a cron expression to select the interval. To learn how to define a cron expression, see [Alerting]({{site.url}}{{site.baseurl}}/monitoring-plugins/alerting/cron/).
 4. Specify the number of pages per execution process. A larger number means faster execution and more cost for memory.
 5. (Optional) Add a delay to the roll up executions. This is the amount of time the job waits for data ingestion to accommodate any processing time. For example, if you set this value to 10 minutes, an index rollup that executes at 2 PM to roll up 1 PM to 2 PM of data starts at 2:10 PM.
 6. Choose **Next**.
@@ -63,7 +62,7 @@ Review your configuration and select **Create**.

 ### Step 5: Search the target index

-You can use the standard `_search` API to search the target index. Make sure that the query matches the constraints of the target index. For example, if don’t set up terms aggregations on a field, you don’t receive results for terms aggregations. If you don’t set up the maximum aggregations, you don’t receive results for maximum aggregations.
+You can use the standard `_search` API to search the target index. Make sure that the query matches the constraints of the target index. For example, if you don’t set up terms aggregations on a field, you don’t receive results for terms aggregations. If you don’t set up the maximum aggregations, you don’t receive results for maximum aggregations.

 You can’t access the internal structure of the data in the target index because the plugin automatically rewrites the query in the background to suit the target index. This is to make sure you can use the same query for the source and target index.

@@ -219,7 +218,7 @@ Create an index rollup job.
 This example picks the `order_date`, `customer_gender`, `geoip.city_name`, `geoip.region_name`, and `day_of_week` fields and rolls them into an `example_rollup` target index:

 ```json
-PUT _opensearch/_rollup/jobs/example
+PUT _plugins/_rollup/jobs/example
 {
  "rollup": {
    "enabled": true,
@@ -1,13 +1,12 @@
 ---
 layout: default
-title: Index Rollups API
-parent: Index Rollups
-grand_parent: Index management
+title: Index rollups API
+parent: Index rollups
 redirect_from: /docs/ism/rollup-api/
 nav_order: 9
 ---

-# Index Rollups API
+# Index rollups API

 Use the index rollup operations to programmatically work with index rollup jobs.

@@ -28,8 +27,8 @@ You must provide the `seq_no` and `primary_term` parameters.
 #### Request

 ```json
-PUT _opensearch/_rollup/jobs/<rollup_id> // Create
-PUT _opensearch/_rollup/jobs/<rollup_id>?if_seq_no=1&if_primary_term=1 // Update
+PUT _plugins/_rollup/jobs/<rollup_id> // Create
+PUT _plugins/_rollup/jobs/<rollup_id>?if_seq_no=1&if_primary_term=1 // Update
 {
  "rollup": {
    "source_index": "nyc-taxi-data",
@@ -141,7 +140,7 @@ Returns all information about an index rollup job based on the `rollup_id`.
 #### Request

 ```json
-GET _opensearch/_rollup/jobs/<rollup_id>
+GET _plugins/_rollup/jobs/<rollup_id>
 ```


@@ -166,7 +165,7 @@ Deletes an index rollup job based on the `rollup_id`.
 #### Request

 ```json
-DELETE _opensearch/_rollup/jobs/<rollup_id>
+DELETE _plugins/_rollup/jobs/<rollup_id>
 ```

 #### Sample response
@@ -185,8 +184,8 @@ Start or stop an index rollup job.
 #### Request

 ```json
-POST _opensearch/_rollup/jobs/<rollup_id>/_start
-POST _opensearch/_rollup/jobs/<rollup_id>/_stop
+POST _plugins/_rollup/jobs/<rollup_id>/_start
+POST _plugins/_rollup/jobs/<rollup_id>/_stop
 ```


@@ -206,7 +205,7 @@ Returns detailed metadata information about the index rollup job and its current
 #### Request

 ```json
-GET _opensearch/_rollup/jobs/<rollup_id>/_explain
+GET _plugins/_rollup/jobs/<rollup_id>/_explain
 ```


@@ -0,0 +1,156 @@
+---
+layout: default
+title: Index transforms
+nav_order: 20
+has_children: true
+redirect_from: /docs/im/index-transforms/
+has_toc: false
+---
+
+# Index transforms
+
+Whereas index rollup jobs let you reduce data granularity by rolling up old data into condensed indices, transform jobs let you create a different, summarized view of your data centered around certain fields, so you can visualize or analyze the data in different ways.
+
+For example, suppose that you have airline data that’s scattered across multiple fields and categories, and you want to view a summary of the data that’s organized by airline, quarter, and then price. You can use a transform job to create a new, summarized index that’s organized by those specific categories.
+
+You can use transform jobs in two ways:
+
+1. Use the OpenSearch Dashboards UI to specify the index you want to transform and any optional data filters you want to use to filter the original index. Then select the fields you want to transform and the aggregations to use in the transformation. Finally, define a schedule for your job to follow.
+2. Use the transforms API to specify all the details about your job: the index you want to transform, target groups you want the transformed index to have, any aggregations you want to use to group columns, and a schedule for your job to follow.
+
+OpenSearch Dashboards provides a detailed summary of the jobs you created and their relevant information, such as associated indices and job statuses. You can review and edit your job’s details and selections before creation, and even preview a transformed index’s data as you’re choosing which fields to transform. However, you can also use the REST API to create transform jobs and preview transform job results, but you must know all of the necessary settings and parameters to submit them as part of the HTTP request body. Submitting your transform job configurations as JSON scripts offers you more portability, allowing you to share and replicate your transform jobs, which is harder to do using OpenSearch Dashboards.
+
+Your use cases will help you decide which method to use to create transform jobs.
+
+## Create a transform job
+
+If you don't have any data in your cluster, you can use the sample flight data within OpenSearch Dashboards to try out transform jobs. Otherwise, after launching OpenSearch Dashboards, choose **Index Management**. Select **Transform Jobs**, and choose **Create Transform Job**.
+
+### Step 1: Choose indices
+
+1. In the **Job name and description** section, specify a name and an optional description for your job.
+2. In the **Indices** section, select the source and target index. You can either select an existing target index or create a new one by entering a name for your new index. If you want to transform just a subset of your source index, choose **Add Data Filter**, and use the OpenSearch query DSL to specify a subset of your source index. For more information about the OpenSearch query DSL, see [query DSL]({{site.url}}{{site.baseurl}}/opensearch/query-dsl/).
+3. Choose **Next**.
+
+### Step 2: Select fields to transform
+
+After specifying the indices, you can select the fields you want to use in your transform job, as well as whether to use groupings or aggregations.
+
+You can use groupings to place your data into separate buckets in your transformed index. For example, if you want to group all of the airport destinations within the sample flight data, you can group the `DestAirportID` field into a target field of `DestAirportID_terms` field, and you can find the grouped airport IDs in your transformed index after the transform job finishes.
+
+On the other hand, aggregations let you perform simple calculations. For example, you can include an aggregation in your transform job to define a new field of `sum_of_total_ticket_price` that calculates the sum of all airplane tickets, and then analyze the newly summer data within your transformed index.
+
+1. In the data table, select the fields you want to transform and expand the drop-down menu within the column header to choose the grouping or aggregation you want to use.
+
+    Currently, transform jobs support histogram, date_histogram, and terms groupings. For more information about groupings, see [Bucket Aggregations]({{site.url}}{{site.baseurl}}/opensearch/bucket-agg/). In terms of aggregations, you can select from `sum`, `avg`, `max`, `min`, `value_count`, `percentiles`, and `scripted_metric`. For more information about aggregations, see [Metric Aggregations]({{site.url}}{{site.baseurl}}/opensearch/metric-agg/).
+
+2. Repeat step 1 for any other fields that you want to transform.
+3. After selecting the fields that you want to transform and verifying the transformation, choose **Next**.
+
+### Step 3: Specify a schedule
+
+You can configure transform jobs to run once or multiple times on a schedule. Transform jobs are enabled by default.
+
+1. For **transformation execution frequency**, select **Define by fixed interval** and specify a **transform interval**.
+2. Under **Advanced**, specify an optional amount for **Pages per execution**. A larger number means more data is processed in each search request, but also uses more memory and causes higher latency. Exceeding allowed memory limits can cause exceptions and errors to occur.
+3. Choose **Next**.
+
+### Step 4: Review and confirm details
+
+After confirming your transform job’s details are correct, choose **Create Transform Job**. If you want to edit any part of the job, choose **Edit** of the section you want to change, and make the necessary changes. You can’t change aggregations or groupings after creating a job.
+
+### Step 5: Search through the transformed index.
+
+Once the transform job finishes, you can use the `_search` API operation to search the target index.
+
+```json
+GET <target_index>/_search
+```
+
+For example, after running a transform job that transforms the flight data based on a `DestAirportID` field, you can run the following request that returns all of the fields that have a value of `SFO`.
+
+**Sample Request**
+
+```json
+GET finished_flight_job/_search
+{
+  "query": {
+    "match": {
+      "DestAirportID_terms" : "SFO"
+    }
+  }
+}
+```
+
+**Sample Response**
+
+```json
+{
+  "took" : 3,
+  "timed_out" : false,
+  "_shards" : {
+    "total" : 5,
+    "successful" : 5,
+    "skipped" : 0,
+    "failed" : 0
+  },
+  "hits" : {
+    "total" : {
+      "value" : 4,
+      "relation" : "eq"
+    },
+    "max_score" : 3.845883,
+    "hits" : [
+      {
+        "_index" : "finished_flight_job",
+        "_type" : "_doc",
+        "_id" : "dSNKGb8U3OJOmC4RqVCi1Q",
+        "_score" : 3.845883,
+        "_source" : {
+          "transform._id" : "sample_flight_job",
+          "transform._doc_count" : 14,
+          "Carrier_terms" : "Dashboards Airlines",
+          "DestAirportID_terms" : "SFO"
+        }
+      },
+      {
+        "_index" : "finished_flight_job",
+        "_type" : "_doc",
+        "_id" : "_D7oqOy7drx9E-MG96U5RA",
+        "_score" : 3.845883,
+        "_source" : {
+          "transform._id" : "sample_flight_job",
+          "transform._doc_count" : 14,
+          "Carrier_terms" : "Logstash Airways",
+          "DestAirportID_terms" : "SFO"
+        }
+      },
+      {
+        "_index" : "finished_flight_job",
+        "_type" : "_doc",
+        "_id" : "YuZ8tOt1OsBA54e84WuAEw",
+        "_score" : 3.6988301,
+        "_source" : {
+          "transform._id" : "sample_flight_job",
+          "transform._doc_count" : 11,
+          "Carrier_terms" : "ES-Air",
+          "DestAirportID_terms" : "SFO"
+        }
+      },
+      {
+        "_index" : "finished_flight_job",
+        "_type" : "_doc",
+        "_id" : "W_-e7bVmH6eu8veJeK8ZxQ",
+        "_score" : 3.6988301,
+        "_source" : {
+          "transform._id" : "sample_flight_job",
+          "transform._doc_count" : 10,
+          "Carrier_terms" : "JetBeats",
+          "DestAirportID_terms" : "SFO"
+        }
+      }
+    ]
+  }
+}
+
+```
@@ -0,0 +1,713 @@
+---
+layout: default
+title: Transforms APIs
+nav_order: 45
+parent: Index transforms
+has_toc: true
+---
+
+# Transforms APIs
+
+Aside from using OpenSearch Dashboards, you can also use the REST API to create, start, stop, and complete other operations relative to transform jobs.
+
+#### Table of contents
+- TOC
+{:toc}
+
+## Create a transform job
+
+Creates a transform job.
+
+**Sample Request**
+
+```json
+PUT _plugins/_transform/<transform_id>
+
+{
+  "transform": {
+  "enabled": true,
+  "schedule": {
+    "interval": {
+    "period": 1,
+    "unit": "Minutes",
+    "start_time": 1602100553
+    }
+  },
+  "description": "Sample transform job",
+  "source_index": "sample_index",
+  "target_index": "sample_target",
+  "data_selection_query": {
+    "match_all": {}
+  },
+  "page_size": 1,
+  "groups": [
+    {
+    "terms": {
+      "source_field": "customer_gender",
+      "target_field": "gender"
+    }
+    },
+    {
+    "terms": {
+      "source_field": "day_of_week",
+      "target_field": "day"
+    }
+    }
+  ],
+  "aggregations": {
+    "quantity": {
+    "sum": {
+      "field": "total_quantity"
+    }
+    }
+  }
+  }
+}
+```
+
+**Sample Response**
+
+```json
+{
+  "_id": "sample",
+  "_version": 7,
+  "_seq_no": 13,
+  "_primary_term": 1,
+  "transform": {
+    "transform_id": "sample",
+    "schema_version": 7,
+    "schedule": {
+      "interval": {
+        "start_time": 1621467964243,
+        "period": 1,
+        "unit": "Minutes"
+      }
+    },
+    "metadata_id": null,
+    "updated_at": 1621467964243,
+    "enabled": true,
+    "enabled_at": 1621467964243,
+    "description": "Sample transform job",
+    "source_index": "sample_index",
+    "data_selection_query": {
+      "match_all": {
+        "boost": 1.0
+      }
+    },
+    "target_index": "sample_target",
+    "roles": [],
+    "page_size": 1,
+    "groups": [
+      {
+        "terms": {
+          "source_field": "customer_gender",
+          "target_field": "gender"
+        }
+      },
+      {
+        "terms": {
+          "source_field": "day_of_week",
+          "target_field": "day"
+        }
+      }
+    ],
+    "aggregations": {
+      "quantity": {
+        "sum": {
+          "field": "total_quantity"
+        }
+      }
+    }
+  }
+}
+```
+You can specify the following options in the HTTP request body:
+
+Option | Data Type | Description | Required
+:--- | :--- | :--- | :---
+enabled | Boolean | If true, the transform job is enabled at creation. | No
+schedule | JSON | The schedule the transform job runs on. | Yes
+start_time | Integer | The Unix epoch time of the transform job's start time. | Yes
+description | String | Describes the transform job. | No
+metadata_id | String | Any metadata to be associated with the transform job. | No
+source_index | String | The source index whose data to transform. | Yes
+target_index | String | The target index the newly transformed data is added into. You can create a new index or update an existing one. | Yes
+data_selection_query | JSON | The query DSL to use to filter a subset of the source index for the transform job. See [query DSL]({{site.url}}{{site.baseurl}}/opensearch/query-dsl) for more information. | Yes
+page_size | Integer | The number of fields to transform at a time. Higher number means higher performance but requires more memory and can cause higher latency. (Default: 1) | Yes
+groups | Array | Specifies the grouping(s) to use in the transform job. Supported groups are `terms`, `histogram`, and `date_histogram`. For more information, see [Bucket Aggregations]({{site.url}}{{site.baseurl}}/opensearch/bucket-agg). | Yes if not using aggregations
+source_field | String | The field(s) to transform | Yes
+aggregations | JSON | The aggregations to use in the transform job. Supported aggregations are: `sum`, `max`, `min`, `value_count`, `avg`, `scripted_metric`, and `percentiles`. For more information, see [Metric Aggregations]({{site.url}}{{site.baseurl}}/opensearch/metric-agg). | Yes if not using groups
+
+## Update a transform job
+
+Updates a transform job if `transform_id` already exists.
+
+**Sample Request**
+
+```json
+PUT _plugins/_transform/<transform_id>
+
+{
+  "transform": {
+  "enabled": true,
+  "schedule": {
+    "interval": {
+    "period": 1,
+    "unit": "Minutes",
+    "start_time": 1602100553
+    }
+  },
+  "description": "Sample transform job",
+  "source_index": "sample_index",
+  "target_index": "sample_target",
+  "data_selection_query": {
+    "match_all": {}
+  },
+  "page_size": 1,
+  "groups": [
+    {
+    "terms": {
+      "source_field": "customer_gender",
+      "target_field": "gender"
+    }
+    },
+    {
+    "terms": {
+      "source_field": "day_of_week",
+      "target_field": "day"
+    }
+    }
+  ],
+  "aggregations": {
+    "quantity": {
+    "sum": {
+      "field": "total_quantity"
+    }
+    }
+  }
+  }
+}
+```
+
+**Sample Response**
+
+```json
+{
+  "_id": "sample",
+  "_version": 2,
+  "_seq_no": 14,
+  "_primary_term": 1,
+  "transform": {
+    "transform_id": "sample",
+    "schema_version": 7,
+    "schedule": {
+      "interval": {
+        "start_time": 1602100553,
+        "period": 1,
+        "unit": "Minutes"
+      }
+    },
+    "metadata_id": null,
+    "updated_at": 1621889843874,
+    "enabled": true,
+    "enabled_at": 1621889843874,
+    "description": "Sample transform job",
+    "source_index": "sample_index",
+    "data_selection_query": {
+      "match_all": {
+        "boost": 1.0
+      }
+    },
+    "target_index": "sample_target",
+    "roles": [],
+    "page_size": 1,
+    "groups": [
+      {
+        "terms": {
+          "source_field": "customer_gender",
+          "target_field": "gender"
+        }
+      },
+      {
+        "terms": {
+          "source_field": "day_of_week",
+          "target_field": "day"
+        }
+      }
+    ],
+    "aggregations": {
+      "quantity": {
+        "sum": {
+          "field": "total_quantity"
+        }
+      }
+    }
+  }
+}
+```
+
+The `Update` operation supports the following URL parameters:
+
+Parameter | Description | Required
+:---| :--- | :---
+`if_seq_no` | Only perform the transform operation if the last operation that changed the transform job has the specified sequence number. | No
+`if_primary_term` | Only perform the transform operation if the last operation that changed the transform job has the specified sequence term. | No
+
+## Get a transform job's details
+
+Returns a transform job's details.
+
+**Sample Request**
+
+```json
+GET _plugins/_transform/<transform_id>
+```
+
+**Sample Response**
+
+```json
+{
+  "_id": "sample",
+  "_version": 7,
+  "_seq_no": 13,
+  "_primary_term": 1,
+  "transform": {
+    "transform_id": "sample",
+    "schema_version": 7,
+    "schedule": {
+      "interval": {
+        "start_time": 1621467964243,
+        "period": 1,
+        "unit": "Minutes"
+      }
+    },
+    "metadata_id": null,
+    "updated_at": 1621467964243,
+    "enabled": true,
+    "enabled_at": 1621467964243,
+    "description": "Sample transform job",
+    "source_index": "sample_index",
+    "data_selection_query": {
+      "match_all": {
+        "boost": 1.0
+      }
+    },
+    "target_index": "sample_target",
+    "roles": [],
+    "page_size": 1,
+    "groups": [
+      {
+        "terms": {
+          "source_field": "customer_gender",
+          "target_field": "gender"
+        }
+      },
+      {
+        "terms": {
+          "source_field": "day_of_week",
+          "target_field": "day"
+        }
+      }
+    ],
+    "aggregations": {
+      "quantity": {
+        "sum": {
+          "field": "total_quantity"
+        }
+      }
+    }
+  }
+}
+```
+
+You can also get details of all transform jobs by omitting `transform_id`.
+
+**Sample Request**
+
+```json
+GET _plugins/_transform/
+```
+
+**Sample Response**
+
+```json
+{
+  "total_transforms": 1,
+  "transforms": [
+    {
+      "_id": "sample",
+      "_seq_no": 13,
+      "_primary_term": 1,
+      "transform": {
+        "transform_id": "sample",
+        "schema_version": 7,
+        "schedule": {
+          "interval": {
+            "start_time": 1621467964243,
+            "period": 1,
+            "unit": "Minutes"
+          }
+        },
+        "metadata_id": null,
+        "updated_at": 1621467964243,
+        "enabled": true,
+        "enabled_at": 1621467964243,
+        "description": "Sample transform job",
+        "source_index": "sample_index",
+        "data_selection_query": {
+          "match_all": {
+            "boost": 1.0
+          }
+        },
+        "target_index": "sample_target",
+        "roles": [],
+        "page_size": 1,
+        "groups": [
+          {
+            "terms": {
+              "source_field": "customer_gender",
+              "target_field": "gender"
+            }
+          },
+          {
+            "terms": {
+              "source_field": "day_of_week",
+              "target_field": "day"
+            }
+          }
+        ],
+        "aggregations": {
+          "quantity": {
+            "sum": {
+              "field": "total_quantity"
+            }
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+You can specify these options as the `GET` API operation’s URL parameters to filter results:
+
+Parameter | Description | Required
+:--- | :--- | :---
+from | The starting index to search from. (Default: 0) | No
+size | Specifies the amount of results to return (Default: 10) | No
+search |The search term to use to filter results. | No
+sortField | The field to sort results with. | No
+sortDirection | Specifies the direction to sort results in. Can be `ASC` or `DESC`. (Default: ASC) | No
+
+For example, this request returns two results starting from the eighth index.
+
+**Sample Request**
+
+```json
+GET _plugins/_transform?size=2&from=8
+```
+
+**Sample Response**
+
+```json
+{
+  "total_transforms": 18,
+  "transforms": [
+    {
+      "_id": "sample8",
+      "_seq_no": 93,
+      "_primary_term": 1,
+      "transform": {
+        "transform_id": "sample8",
+        "schema_version": 7,
+        "schedule": {
+          "interval": {
+            "start_time": 1622063596812,
+            "period": 1,
+            "unit": "Minutes"
+          }
+        },
+        "metadata_id": "y4hFAB2ZURQ2dzY7BAMxWA",
+        "updated_at": 1622063657233,
+        "enabled": false,
+        "enabled_at": null,
+        "description": "Sample transform job",
+        "source_index": "sample_index3",
+        "data_selection_query": {
+          "match_all": {
+            "boost": 1.0
+          }
+        },
+        "target_index": "sample_target3",
+        "roles": [],
+        "page_size": 1,
+        "groups": [
+          {
+            "terms": {
+              "source_field": "customer_gender",
+              "target_field": "gender"
+            }
+          },
+          {
+            "terms": {
+              "source_field": "day_of_week",
+              "target_field": "day"
+            }
+          }
+        ],
+        "aggregations": {
+          "quantity": {
+            "sum": {
+              "field": "total_quantity"
+            }
+          }
+        }
+      }
+    },
+    {
+      "_id": "sample9",
+      "_seq_no": 98,
+      "_primary_term": 1,
+      "transform": {
+        "transform_id": "sample9",
+        "schema_version": 7,
+        "schedule": {
+          "interval": {
+            "start_time": 1622063598065,
+            "period": 1,
+            "unit": "Minutes"
+          }
+        },
+        "metadata_id": "x8tCIiYMTE3veSbIJkit5A",
+        "updated_at": 1622063658388,
+        "enabled": false,
+        "enabled_at": null,
+        "description": "Sample transform job",
+        "source_index": "sample_index4",
+        "data_selection_query": {
+          "match_all": {
+            "boost": 1.0
+          }
+        },
+        "target_index": "sample_target4",
+        "roles": [],
+        "page_size": 1,
+        "groups": [
+          {
+            "terms": {
+              "source_field": "customer_gender",
+              "target_field": "gender"
+            }
+          },
+          {
+            "terms": {
+              "source_field": "day_of_week",
+              "target_field": "day"
+            }
+          }
+        ],
+        "aggregations": {
+          "quantity": {
+            "sum": {
+              "field": "total_quantity"
+            }
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+## Start a transform job
+
+Transform jobs created using the API are automatically enabled, but if you ever need to enable a job, you can use the `start` API operation.
+
+**Sample Request**
+
+```json
+POST _plugins/_transform/<transform_id>/_start
+```
+
+**Sample Response**
+
+```json
+{
+  "acknowledged": true
+}
+```
+
+## Stop a transform job
+
+Stops/disables a transform job.
+
+**Sample Request**
+
+```json
+POST _plugins/_transform/<transform_id>/_stop
+```
+
+**Sample Response**
+
+```json
+{
+  "acknowledged": true
+}
+```
+
+## Get the status of a transform job
+
+Returns the status and metadata of a transform job.
+
+**Sample Request**
+
+```json
+GET _plugins/_transform/<transform_id>/_explain
+```
+
+**Sample Response**
+
+```json
+{
+  "sample": {
+    "metadata_id": "PzmjweME5xbgkenl9UpsYw",
+    "transform_metadata": {
+      "transform_id": "sample",
+      "last_updated_at": 1621883525873,
+      "status": "finished",
+      "failure_reason": "null",
+      "stats": {
+        "pages_processed": 0,
+        "documents_processed": 0,
+        "documents_indexed": 0,
+        "index_time_in_millis": 0,
+        "search_time_in_millis": 0
+      }
+    }
+  }
+}
+```
+
+## Preview a transform job's results
+
+Returns a preview of what a transformed index would look like.
+
+**Sample Request**
+
+```json
+POST _plugins/_transform/_preview
+
+{
+  "transform": {
+  "enabled": false,
+  "schedule": {
+    "interval": {
+    "period": 1,
+    "unit": "Minutes",
+    "start_time": 1602100553
+    }
+  },
+  "description": "test transform",
+  "source_index": "sample_index",
+  "target_index": "sample_target",
+  "data_selection_query": {
+    "match_all": {}
+  },
+  "page_size": 10,
+  "groups": [
+    {
+    "terms": {
+      "source_field": "customer_gender",
+      "target_field": "gender"
+    }
+    },
+    {
+    "terms": {
+      "source_field": "day_of_week",
+      "target_field": "day"
+    }
+    }
+  ],
+  "aggregations": {
+    "quantity": {
+    "sum": {
+      "field": "total_quantity"
+    }
+    }
+  }
+  }
+}
+```
+
+**Sample Response**
+
+```json
+{
+  "documents" : [
+  {
+    "quantity" : 862.0,
+    "gender" : "FEMALE",
+    "day" : "Friday"
+  },
+  {
+    "quantity" : 682.0,
+    "gender" : "FEMALE",
+    "day" : "Monday"
+  },
+  {
+    "quantity" : 772.0,
+    "gender" : "FEMALE",
+    "day" : "Saturday"
+  },
+  {
+    "quantity" : 669.0,
+    "gender" : "FEMALE",
+    "day" : "Sunday"
+  },
+  {
+    "quantity" : 887.0,
+    "gender" : "FEMALE",
+    "day" : "Thursday"
+  }
+  ]
+}
+```
+
+## Delete a transform job
+
+Deletes a transform job. This operation does not delete the source or target indices.
+
+**Sample Request**
+
+```json
+DELETE _plugins/_transform/<transform_id>
+```
+
+**Sample Response**
+
+```json
+{
+  "took": 205,
+  "errors": false,
+  "items": [
+    {
+      "delete": {
+        "_index": ".opensearch-ism-config",
+        "_type": "_doc",
+        "_id": "sample",
+        "_version": 4,
+        "result": "deleted",
+        "forced_refresh": true,
+        "_shards": {
+          "total": 2,
+          "successful": 1,
+          "failed": 0
+        },
+        "_seq_no": 6,
+        "_primary_term": 1,
+        "status": 200
+      }
+    }
+  ]
+}
+```
@@ -1,11 +1,13 @@
 ---
 layout: default
-title: Index management
-nav_order: 30
-has_children: true
+title: About Index Management
+nav_order: 1
+has_children: false
+redirect_from:
+  - /im-plugin/
 ---

-# Index Management
+# About Index Management
 OpenSearch Dashboards
 {: .label .label-yellow :}

@@ -2,7 +2,6 @@
 layout: default
 title: ISM API
 parent: Index State Management
-grand_parent: Index management
 redirect_from: /docs/ism/api/
 nav_order: 5
 ---
@@ -28,7 +27,7 @@ Creates a policy.
 #### Request

 ```json
-PUT _opensearch/_ism/policies/policy_1
+PUT _plugins/_ism/policies/policy_1
 {
  "policy": {
    "description": "ingesting logs",
@@ -145,7 +144,7 @@ Adds a policy to an index. This operation does not change the policy if the inde
 #### Request

 ```json
-POST _opensearch/_ism/add/index_1
+POST _plugins/_ism/add/index_1
 {
  "policy_id": "policy_1"
 }
@@ -171,7 +170,7 @@ Updates a policy. Use the `seq_no` and `primary_term` parameters to update an ex
 #### Request

 ```json
-PUT _opensearch/_ism/policies/policy_1?if_seq_no=7&if_primary_term=1
+PUT _plugins/_ism/policies/policy_1?if_seq_no=7&if_primary_term=1
 {
  "policy": {
    "description": "ingesting logs",
@@ -288,7 +287,7 @@ Gets the policy by `policy_id`.
 #### Request

 ```json
-GET _opensearch/_ism/policies/policy_1
+GET _plugins/_ism/policies/policy_1
 ```


@@ -358,7 +357,7 @@ Removes any ISM policy from the index.
 #### Request

 ```json
-POST _opensearch/_ism/remove/index_1
+POST _plugins/_ism/remove/index_1
 ```


@@ -385,7 +384,7 @@ In this example, the policy applied on the `index_1` index is changed to `policy
 #### Request

 ```json
-POST _opensearch/_ism/change_policy/index_1
+POST _plugins/_ism/change_policy/index_1
 {
  "policy_id": "policy_1",
  "state": "delete",
@@ -417,7 +416,7 @@ Retries the failed action for an index. For the retry call to succeed, ISM must
 #### Request

 ```json
-POST _opensearch/_ism/retry/index_1
+POST _plugins/_ism/retry/index_1
 {
  "state": "delete"
 }
@@ -443,7 +442,7 @@ Gets the current state of the index. You can use index patterns to get the statu
 #### Request

 ```json
-GET _opensearch/_ism/explain/index_1
+GET _plugins/_ism/explain/index_1
 ```


@@ -452,13 +451,12 @@ GET _opensearch/_ism/explain/index_1
 ```json
 {
  "index_1": {
-    "index.opendistro.index_state_management.policy_id": "policy_1"
+    "index.plugins.index_state_management.policy_id": "policy_1"
  }
 }
 ```

-The `opendistro.index_state_management.policy_id` setting is deprecated starting from version 1.13.0.
-We retain this field in the response API for consistency. 
+The `plugins.index_state_management.policy_id` setting is deprecated starting from ODFE version 1.13.0. We retain this field in the response API for consistency.

 ---

@@ -469,7 +467,7 @@ Deletes the policy by `policy_id`.
 #### Request

 ```json
-DELETE _opensearch/_ism/policies/policy_1
+DELETE _plugins/_ism/policies/policy_1
 ```


@@ -2,9 +2,10 @@
 layout: default
 title: Index State Management
 nav_order: 3
-parent: Index management
 has_children: true
-redirect_from: /docs/ism/
+redirect_from:
+  - /docs/im/ism/
+  - /docs/ism/
 has_toc: false
 ---

@@ -20,7 +21,7 @@ For example, you can define a policy that moves your index into a `read_only` st

 You might want to perform an index rollover after a certain amount of time or run a `force_merge` operation on an index during off-peak hours to improve search performance during peak hours.

-To use the ISM plugin, your user role needs to be mapped to the `all_access` role that gives you full access to the cluster. To learn more, see [Users and roles](../security/access-control/users-roles/).
+To use the ISM plugin, your user role needs to be mapped to the `all_access` role that gives you full access to the cluster. To learn more, see [Users and roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/users-roles/).
 {: .note }

 ## Get started with ISM
@@ -29,7 +30,7 @@ To get started, choose **Index Management** in OpenSearch Dashboards.

 ### Step 1: Set up policies

-A policy is a set of rules that describes how an index should be managed. For information about creating a policy, see [Policies](policies/).
+A policy is a set of rules that describes how an index should be managed. For information about creating a policy, see [Policies]({{site.url}}{{site.baseurl}}/im-plugin/ism/policies/).

 1. Choose the **Index Policies** tab.
 2. Choose **Create policy**.
@@ -41,7 +42,7 @@ After you create a policy, your next step is to attach this policy to an index o
 You can set up an `ism_template` in the policy so when you create an index that matches the ISM template pattern, the index will have this policy attached to it:

 ```json
-PUT _opensearch/_ism/policies/policy_id
+PUT _plugins/_ism/policies/policy_id
 {
  "policy": {
    "description": "Example policy.",
@@ -55,7 +56,7 @@ PUT _opensearch/_ism/policies/policy_id
 }
 ```

-For an example ISM template policy, see [Sample policy with ISM template](policies/#sample-policy-with-ism-template).
+For an example ISM template policy, see [Sample policy with ISM template]({{site.url}}{{site.baseurl}}/im-plugin/ism/policies#sample-policy-with-ism-template).

 Older versions of the plugin include the `policy_id` in an index template, so when an index is created that matches the index template pattern, the index will have the policy attached to it:

@@ -84,20 +85,20 @@ The `opendistro.index_state_management.policy_id` setting is deprecated. You can
 4. From the **Policy ID** menu, choose the policy that you created.
 You can see a preview of your policy.
 5. If your policy includes a rollover operation, specify a rollover alias.
-Make sure that the alias that you enter already exists. For more information about the rollover operation, see [rollover](policies/#rollover).
+Make sure that the alias that you enter already exists. For more information about the rollover operation, see [rollover]({{site.url}}{{site.baseurl}}/im-plugin/ism/policies#rollover).
 6. Choose **Apply**.

-After you attach a policy to an index, ISM creates a job that runs every 5 minutes by default to perform policy actions, check conditions, and transition the index into different states. To change the default time interval for this job, see [Settings](settings/).
+After you attach a policy to an index, ISM creates a job that runs every 5 minutes by default to perform policy actions, check conditions, and transition the index into different states. To change the default time interval for this job, see [Settings]({{site.url}}{{site.baseurl}}/im-plugin/ism/settings/).

-If you want to use an OpenSearch operation to create an index with a policy already attached to it, see [create index](api/#create-index).
+If you want to use an OpenSearch operation to create an index with a policy already attached to it, see [create index]({{site.url}}{{site.baseurl}}/im-plugin/ism/api#create-index).

 ### Step 3: Manage indices

 1. Choose **Managed Indices**.
-2. To change your policy, see [Change Policy](managedindices/#change-policy).
+2. To change your policy, see [Change Policy]({{site.url}}{{site.baseurl}}/im-plugin/ism/managedindices#change-policy).
 3. To attach a rollover alias to your index, select your policy and choose **Add rollover alias**.
-Make sure that the alias that you enter already exists. For more information about the rollover operation, see [rollover](policies/#rollover).
+Make sure that the alias that you enter already exists. For more information about the rollover operation, see [rollover]({{site.url}}{{site.baseurl}}/im-plugin/ism/policies#rollover).
 4. To remove a policy, choose your policy, and then choose **Remove policy**.
 5. To retry a policy, choose your policy, and then choose **Retry policy**.

-For information about managing your policies, see [Managed Indices](managedindices/).
+For information about managing your policies, see [Managed Indices]({{site.url}}{{site.baseurl}}/im-plugin/ism/managedindices/).
@@ -3,7 +3,6 @@ layout: default
 title: Managed Indices
 nav_order: 3
 parent: Index State Management
-grand_parent: Index management
 redirect_from: /docs/ism/managedindices/
 has_children: false
 ---
@@ -3,7 +3,6 @@ layout: default
 title: Policies
 nav_order: 1
 parent: Index State Management
-grand_parent: Index management
 redirect_from: /docs/ism/policies/
 has_children: false
 ---
@@ -89,7 +88,7 @@ The following example action has a timeout period of one hour. The policy retrie
 }
 ```

-For a list of available unit types, see [Supported units](../../../opensearch/units/).
+For a list of available unit types, see [Supported units]({{site.url}}{{site.baseurl}}/opensearch/units/).

 ## ISM supported operations

@@ -160,7 +159,7 @@ Parameter | Description | Type | Required
 }
 ```

-For information about setting replicas, see [Primary and replica shards](../../../opensearch/#primary-and-replica-shards).
+For information about setting replicas, see [Primary and replica shards]({{site.url}}{{site.baseurl}}/opensearch#primary-and-replica-shards).

 ### close

@@ -201,7 +200,7 @@ Deletes a managed index.
 Rolls an alias over to a new index when the managed index meets one of the rollover conditions.

 The index format must match the pattern: `^.*-\d+$`. For example, `(logs-000001)`.
-Set `index.opendistro.index_state_management.rollover_alias` as the alias to rollover.
+Set `index.plugins.index_state_management.rollover_alias` as the alias to rollover.

 Parameter | Description | Type | Example | Required
 :--- | :--- |:--- |:--- |
@@ -309,7 +308,7 @@ Parameter | Description | Type

 ### snapshot

-Backup your cluster’s indices and state. For more information about snapshots, see [Take and restore snapshots](../../../opensearch/snapshot-restore/).
+Backup your cluster’s indices and state. For more information about snapshots, see [Take and restore snapshots]({{site.url}}{{site.baseurl}}/opensearch/snapshot-restore/).

 The `snapshot` operation has the following parameters:

@@ -436,7 +435,7 @@ Note that this condition does not execute at exactly 5:00 PM; the job still exec

 A window of an hour, which this example uses, is generally sufficient, but you might increase it to 2--3 hours to avoid missing the window and having to wait a week for the transition to occur. Alternately, you could use a broader expression such as `* * * * SAT,SUN` to have the transition occur at any time during the weekend.

-For information on writing cron expressions, see [Cron expression reference](../../../alerting/cron/).
+For information on writing cron expressions, see [Cron expression reference]({{site.url}}{{site.baseurl}}/monitoring-plugins/alerting/cron/).

 ---

@@ -526,7 +525,7 @@ The following sample template policy is for a rollover use case.
 1. Create a policy with an `ism_template` field:

   ```json
-   PUT _opensearch/_ism/policies/rollover_policy
+   PUT _plugins/_ism/policies/rollover_policy
   {
     "policy": {
       "description": "Example rollover policy.",
@@ -561,7 +560,7 @@ The following sample template policy is for a rollover use case.
   {
     "index_patterns": ["log*"],
     "settings": {
-       "opendistro.index_state_management.rollover_alias": "log"
+       "plugins.index_state_management.rollover_alias": "log"
     }
   }
   ```
@@ -663,4 +662,4 @@ After 30 days, the policy moves this index into a `delete` state. The service se

 This diagram shows the `states`, `transitions`, and `actions` of the above policy as a finite-state machine. For more information about finite-state machines, see [Wikipedia](https://en.wikipedia.org/wiki/Finite-state_machine).  

-![Policy State Machine](../../images/ism.png)
+![Policy State Machine]({{site.baseurl}}/images/ism.png)
@@ -0,0 +1,49 @@
+---
+layout: default
+title: Settings
+parent: Index State Management
+redirect_from: /docs/ism/settings/
+nav_order: 4
+---
+
+# ISM settings
+
+We don't recommend changing these settings; the defaults should work well for most use cases.
+
+Index State Management (ISM) stores its configuration in the `.opendistro-ism-config` index. Don't modify this index without using the [ISM API operations]({{site.url}}{{site.baseurl}}/im-plugin/ism/api/).
+
+All settings are available using the OpenSearch `_cluster/settings` operation. None require a restart, and all can be marked `persistent` or `transient`.
+
+Setting | Default | Description
+:--- | :--- | :---
+`plugins.index_state_management.enabled` | True | Specifies whether ISM is enabled or not.
+`plugins.index_state_management.job_interval` | 5 minutes | The interval at which the managed index jobs are run.
+`plugins.index_state_management.coordinator.sweep_period` | 10 minutes | How often the routine background sweep is run.
+`plugins.index_state_management.coordinator.backoff_millis` | 50 milliseconds | The backoff time between retries for failures in the `ManagedIndexCoordinator` (such as when we update managed indices).
+`plugins.index_state_management.coordinator.backoff_count` | 2 | The count of retries for failures in the `ManagedIndexCoordinator`.
+`plugins.index_state_management.history.enabled` | True | Specifies whether audit history is enabled or not. The logs from ISM are automatically indexed to a logs document.
+`plugins.index_state_management.history.max_docs` | 2,500,000 | The maximum number of documents before rolling over the audit history index.
+`plugins.index_state_management.history.max_age` | 24 hours | The maximum age before rolling over the audit history index.
+`plugins.index_state_management.history.rollover_check_period` | 8 hours | The time between rollover checks for the audit history index.
+`plugins.index_state_management.history.rollover_retention_period` | 30 days | How long audit history indices are kept.
+`plugins.index_state_management.allow_list` | All actions | List of actions that you can use.
+
+
+## Audit history indices
+
+If you don't want to disable ISM audit history or shorten the retention period, you can create an [index template]({{site.url}}{{site.baseurl}}/opensearch/index-templates/) to reduce the shard count of the history indices:
+
+```json
+PUT _index_template/ism_history_indices
+{
+  "index_patterns": [
+    ".opendistro-ism-managed-index-history-*"
+  ],
+  "template": {
+    "settings": {
+      "number_of_shards": 1,
+      "number_of_replicas": 0
+    }
+  }
+}
+```
@@ -1,8 +1,7 @@
 ---
 layout: default
-title: Refresh Search Analyzer
+title: Refresh search analyzer
 nav_order: 40
-parent: Index management
 has_children: false
 redirect_from: /docs/ism/refresh-analyzer/
 has_toc: false
@@ -13,7 +12,7 @@ has_toc: false
 With ISM installed, you can refresh search analyzers in real time with the following API:

 ```json
-POST /_opensearch/_refresh_search_analyzers/<index or alias or wildcard>
+POST /_plugins/_refresh_search_analyzers/<index or alias or wildcard>
 ```
 For example, if you change the synonym list in your analyzer, the change takes effect without you needing to close and reopen the index.

@@ -60,7 +60,7 @@
  {%- for node in pages_list -%}
    {%- if node.parent == nil -%}
      {%- unless node.nav_exclude -%}
-      <li class="nav-list-item{% if page.url == node.url or page.parent == node.title or page.grand_parent == node.title %} active{% endif %}">
+      <li class="nav-list-item{% if page.collection == include.key and page.url == node.url or page.parent == node.title or page.grand_parent == node.title %} active{% endif %}">
        {%- if node.has_children -%}
          <a href="#" class="nav-list-expander"><svg viewBox="0 0 24 24"><use xlink:href="#svg-arrow-right"></use></svg></a>
        {%- endif -%}
@@ -90,14 +90,36 @@
            </li>
            {%- endunless -%}
          {%- endfor -%}
-
          </ul>
        {%- endif -%}
      </li>
      {%- endunless -%}
    {%- endif -%}
  {%- endfor -%}
-  <li class="nav-list-item">
-    <a href="https://opensearch.org/docs/javadocs/" target="_blank" class="nav-list-link">Javadoc <svg class="external-arrow" width="16" height="16" fill="#002A3A"><use xlink:href="#external-arrow"></use></svg></a>
-  </li>
 </ul>
+
+{%- if page.collection == include.key -%}
+
+  {%- for node in pages_list -%}
+    {%- if node.parent == nil -%}
+      {%- if page.parent == node.title or page.grand_parent == node.title -%}
+        {%- assign first_level_url = node.url | absolute_url -%}
+      {%- endif -%}
+      {%- if node.has_children -%}
+        {%- assign children_list = pages_list | where: "parent", node.title -%}
+        {%- for child in children_list -%}
+          {%- if child.has_children -%}
+            {%- if page.url == child.url or page.parent == child.title and page.grand_parent == child.parent -%}
+              {%- assign second_level_url = child.url | absolute_url -%}
+            {%- endif -%}
+          {%- endif -%}
+        {%- endfor -%}
+      {%- endif -%}
+    {%- endif -%}
+  {%- endfor -%}
+
+  {% if page.has_children == true and page.has_toc != false %}
+    {%- assign toc_list = pages_list | where: "parent", page.title | where: "grand_parent", page.parent -%}
+  {%- endif -%}
+
+{%- endif -%}
@@ -38,13 +38,6 @@ layout: table_wrappers
        <path d="M13 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V9z"></path><polyline points="13 2 13 9 20 9"></polyline>
      </svg>
    </symbol>
-    <symbol id="external-arrow" viewBox="0 0 16 16">
-      <title>External</title>
-      <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16">
-        <path fill-rule="evenodd" d="M8.636 3.5a.5.5 0 0 0-.5-.5H1.5A1.5 1.5 0 0 0 0 4.5v10A1.5 1.5 0 0 0 1.5 16h10a1.5 1.5 0 0 0 1.5-1.5V7.864a.5.5 0 0 0-1 0V14.5a.5.5 0 0 1-.5.5h-10a.5.5 0 0 1-.5-.5v-10a.5.5 0 0 1 .5-.5h6.636a.5.5 0 0 0 .5-.5z"/>
-        <path fill-rule="evenodd" d="M16 .5a.5.5 0 0 0-.5-.5h-5a.5.5 0 0 0 0 1h3.793L6.146 9.146a.5.5 0 1 0 .708.708L15 1.707V5.5a.5.5 0 0 0 1 0v-5z"/>
-      </svg>
-    </symbol>
  </svg>

  <div class="side-bar">
@@ -55,6 +48,14 @@ layout: table_wrappers
      </a>
    </div>
    <nav role="navigation" aria-label="Main" id="site-nav" class="site-nav">
+      {% assign pages_top_size = site.html_pages
+          | where_exp:"item", "item.title != nil"
+          | where_exp:"item", "item.parent == nil"
+          | where_exp:"item", "item.nav_exclude != true"
+          | size %}
+      {% if pages_top_size > 0 %}
+        {% include nav.html pages=site.html_pages key=nil %}
+      {% endif %}
      {% if site.just_the_docs.collections %}
        {% assign collections_size = site.just_the_docs.collections | size %}
        {% for collection_entry in site.just_the_docs.collections %}
@@ -62,19 +63,31 @@ layout: table_wrappers
          {% assign collection_value = collection_entry[1] %}
          {% assign collection = site[collection_key] %}
          {% if collection_value.nav_exclude != true %}
-            {% if collections_size > 1 %}
-              <div class="nav-category">{{ collection_value.name }}</div>
+            {% if collections_size > 1 or pages_top_size > 0 %}
+              {% if collection_value.nav_fold == true %}
+                <ul class="nav-list nav-category-list">
+                  <li class="nav-list-item{% if page.collection == collection_key %} active{% endif %}">
+                    {%- if collection.size > 0 -%}
+                    <a href="#" class="nav-list-expander"><svg viewBox="0 0 24 24"><use xlink:href="#svg-arrow-right"></use></svg></a>
+                    {%- endif -%}
+                    <div class="nav-category">{{ collection_value.name }}</div>
+                    {% include nav.html pages=collection key=collection_key %}
+                  </li>
+                </ul>
+              {% else %}
+                <div class="nav-category">{{ collection_value.name }}</div>
+                {% include nav.html pages=collection key=collection_key %}
+              {% endif %}
+            {% else %}
+              {% include nav.html pages=collection key=collection_key %}
            {% endif %}
-            {% include nav.html pages=collection %}
          {% endif %}
        {% endfor %}
-      {% else %}
-        {% include nav.html pages=site.html_pages %}
      {% endif %}
    </nav>
    <footer class="site-footer">
-      <p class="text-small text-grey-dk-100">See a problem? Submit <a href="https://github.com/opensearch-project/documentation-website/issues">issues</a> or <a href="https://github.com/opensearch-project/documentation-website/edit/main/{{ page.path }}">edit this page</a> on GitHub.</p>
-      <p class="text-small text-grey-dk-100 mb-0">© Amazon Web Services, Inc. or its affiliates. All rights reserved.</p>
+      <p class="text-small text-grey-dk-100">See a problem? Submit <a href="https://github.com/opensearch-project/documentation-website/issues">issues</a> or <a href="https://github.com/opensearch-project/documentation-website/edit/main/{{ page.path }}">edit this page</a> on <a href="https://github.com/opensearch-project/documentation-website/">GitHub</a>.</p>
+      <p class="text-small text-grey-dk-100 mb-0">© 2021 OpenSearch contributors. This documentation is under the Apache License 2.0.</p>
    </footer>
  </div>
  <div class="main" id="top">
@@ -110,21 +123,6 @@ layout: table_wrappers
    <div id="main-content-wrap" class="main-content-wrap">
      {% unless page.url == "/" %}
        {% if page.parent %}
-          {%- for node in pages_list -%}
-            {%- if node.parent == nil -%}
-              {%- if page.parent == node.title or page.grand_parent == node.title -%}
-                {%- assign first_level_url = node.url | absolute_url -%}
-              {%- endif -%}
-              {%- if node.has_children -%}
-                {%- assign children_list = pages_list | where: "parent", node.title -%}
-                {%- for child in children_list -%}
-                  {%- if page.url == child.url or page.parent == child.title -%}
-                    {%- assign second_level_url = child.url | absolute_url -%}
-                  {%- endif -%}
-                {%- endfor -%}
-              {%- endif -%}
-            {%- endif -%}
-          {%- endfor -%}
          <nav aria-label="Breadcrumb" class="breadcrumb-nav">
            <ol class="breadcrumb-nav-list">
              {% if page.grand_parent %}
@@ -142,7 +140,7 @@ layout: table_wrappers
        {% if site.heading_anchors != false %}
          {% include vendor/anchor_headings.html html=content beforeHeading="true" anchorBody="<svg viewBox=\"0 0 16 16\" aria-hidden=\"true\"><use xlink:href=\"#svg-link\"></use></svg>" anchorClass="anchor-heading" anchorAttrs="aria-labelledby=\"%html_id%\"" %}
        {% else %}
-          <p class="warning" style="margin-top: 0">Like OpenSearch itself, this documentation is a beta. It has content gaps and might contain bugs.</p>
+          <p class="warning" style="margin-top: 0">This documentation remains in a beta state. It has content gaps and might contain bugs.</p>
          {{ content }}
        {% endif %}

@@ -150,8 +148,7 @@ layout: table_wrappers
          <hr>
          <h2 class="text-delta">Table of contents</h2>
          <ul>
-            {%- assign children_list = pages_list | where: "parent", page.title | where: "grand_parent", page.parent -%}
-            {% for child in children_list %}
+            {% for child in toc_list %}
              <li>
                <a href="{{ child.url | absolute_url }}">{{ child.title }}</a>{% if child.summary %} - {{ child.summary }}{% endif %}
              </li>
@@ -0,0 +1,13 @@
+---
+layout: default
+title: Docker migration
+nav_order: 25
+---
+
+# Docker migration
+
+If you use a container orchestration system like Kubernetes (or manage your containers manually) and want to avoid downtime, think of the process not as an upgrade of each node, but as a decommissioning and replacement of each node. One by one, add OpenSearch nodes to the cluster and remove Elasticsearch OSS nodes, allowing time for all indices to return to a green status prior to proceeding.
+
+If you use Docker Compose, we highly recommend that you perform what amounts to a [cluster restart upgrade]({{site.url}}{{site.baseurl}}/migrate/upgrade-migrate/). Update your cluster configuration with new images, new settings, and new environment variables, and test it. Then stop and start the cluster. This process requires downtime, but takes very few steps and lets you continue to treat the cluster as a single entity that you can reliably deploy and redeploy.
+
+The most important step is to leave your data volumes intact. **Don't** run `docker-compose down -v`.
@@ -0,0 +1,13 @@
+---
+layout: default
+title: About migrating
+nav_order: 1
+redirect_from: /migrate/
+---
+
+# About migrating
+
+The process of migrating from Elasticsearch OSS (including Open Distro for Elasticsearch) to OpenSearch varies depending on your current version of Elasticsearch OSS, install type, tolerance for downtime, and cost-sensitivity. Rather than concrete steps to cover every situation, we have general guidance for the process.
+
+To safeguard against data loss, we recommend that you take a [snapshot]({{site.url}}{{site.baseurl}}/opensearch/snapshot-restore/) of all indices prior to any migration.
+{: .tip }
@@ -0,0 +1,11 @@
+---
+layout: default
+title: Snapshot migration
+nav_order: 5
+---
+
+# Snapshot migration
+
+One popular approach is to take a [snapshot]({{site.url}}{{site.baseurl}}/opensearch/snapshot-restore/) of your Elasticsearch OSS 6.x or 7.x indices, [create an OpenSearch cluster]({{site.url}}{{site.baseurl}}/opensearch/install/), restore the snapshot on the new cluster, and point your clients to the new host.
+
+The snapshot approach can mean running two clusters in parallel, but lets you validate that the OpenSearch cluster is working in a way that meets your needs prior to modifying the Elasticsearch OSS cluster.
@@ -0,0 +1,172 @@
+---
+layout: default
+title: Upgrade from Elasticsearch OSS to OpenSearch
+nav_order: 15
+---
+
+# Upgrade from Elasticsearch OSS to OpenSearch (Linux)
+
+If you want to migrate an existing Elasticsearch OSS cluster to OpenSearch and find the [snapshot approach]({{site.url}}{{site.baseurl}}/migrate/snapshot-migrate/) unappealing, you can upgrade the cluster instead. The first step is to upgrade your Elasticsearch OSS cluster to version 6.x or 7.x.
+
+Elasticsearch OSS supports two types of upgrades: rolling and cluster restart.
+
+- Rolling upgrades let you shut down one node at a time for minimal disruption of service.
+
+  Rolling upgrades work between minor versions (e.g. 6.5 to 6.8) and also support a single path to the next major version (e.g. 6.8 to 7.10.2). Performing these upgrades might require intermediate upgrades to arrive at your desired version and can affect cluster performance as nodes leave and rejoin, but the cluster remains available throughout the process.
+
+- Cluster restart upgrades require you to shut down all nodes, perform the upgrade, and restart the cluster.
+
+  Cluster restart upgrades work between minor versions (e.g. 6.5 to 6.8) and the next major version (for example, 6.x to 7.10.2). Cluster restart upgrades are faster to perform and require fewer intermediate upgrades, but require downtime.
+
+
+## Upgrade paths
+
+Elasticsearch OSS version | Rolling upgrade path | Cluster restart upgrade path
+:--- | :--- | :---
+5.x | Upgrade to 5.6, upgrade to 6.8, reindex all 5.x indices, upgrade to 7.10.2, and upgrade to OpenSearch. | Upgrade to 6.8, reindex all 5.x indices, and upgrade to OpenSearch.
+6.x | Upgrade to 6.8, upgrade to 7.10.2, and upgrade to OpenSearch. | Upgrade to OpenSearch.
+7.x | Upgrade to OpenSearch. | Upgrade to OpenSearch.
+
+
+## Upgrade Elasticsearch OSS
+
+1. Disable shard allocation to prevent Elasticsearch OSS from replicating shards as you shut down nodes:
+
+   ```json
+   PUT _cluster/settings
+   {
+     "persistent": {
+       "cluster.routing.allocation.enable": "primaries"
+     }
+   }
+   ```
+
+1. Stop Elasticsearch OSS on one node (rolling upgrade) or all nodes (cluster restart upgrade).
+
+   On Linux distributions that use systemd, use this command:
+
+   ```bash
+   sudo systemctl stop elasticsearch.service
+   ```
+
+   For tarball installations, find the process ID (`ps aux`) and kill it (`kill <pid>`).
+
+1. Upgrade the node (rolling) or all nodes (cluster restart).
+
+   The exact command varies by package manager, but likely looks something like this:
+
+   ```bash
+   sudo yum install elasticsearch-oss-7.10.2 --enablerepo=elasticsearch
+   ```
+
+   For tarball installations, extract to a new directory to ensure you **do not overwrite** your `config`, `data`, and `logs` directories. Ideally, these directories should have their own, independent paths and *not* be colocated with the Elasticsearch application directory. Then set the `ES_PATH_CONF` environment variable to the directory that contains `elasticsearch.yml` (e.g. `/etc/elasticesarch/`). In `elasticsearch.yml`, set `path.data` and `path.logs` to your `data` and `logs` directories (e.g. `/var/lib/elasticsearch` and `/var/log/opensearch`).
+
+1. Restart Elasticsearch OSS on the node (rolling) or all nodes (cluster restart).
+
+   On Linux distributions that use systemd, use this command:
+
+   ```bash
+   sudo systemctl start elasticsearch.service
+   ```
+
+   For tarball installations, run `./bin/elasticsearch -d`.
+
+1. Wait for the node to rejoin the cluster (rolling) or for the cluster to start (cluster restart). Check the `_nodes` summary to verify that all nodes are available and running the expected version:
+
+   ```bash
+   # Elasticsearch OSS
+   curl -XGET 'localhost:9200/_nodes/_all?pretty=true'
+   # Open Distro for Elasticsearch with security plugin enabled
+   curl -XGET 'https://localhost:9200/_nodes/_all?pretty=true' -u 'admin:admin' -k
+   ```
+
+   Specifically, check the `nodes.<node-id>.version` portion of the response. Also check `_cat/indices?v` for a green status on all indices.
+
+1. (Rolling) Repeat steps 2--5 until all nodes are using the new version.
+
+1. After all nodes are using the new version, re-enable shard allocation:
+
+   ```json
+   PUT _cluster/settings
+   {
+     "persistent": {
+       "cluster.routing.allocation.enable": "all"
+     }
+   }
+   ```
+
+1. If you upgraded from 5.x to 6.x, [reindex]({{site.url}}{{site.baseurl}}/opensearch/reindex-data/) all indices.
+
+1. Repeat all steps as necessary until you arrive at your desired Elasticsearch OSS version.
+
+
+## Upgrade to OpenSearch
+
+1. Disable shard allocation to prevent Elasticsearch OSS from replicating shards as you shut down nodes:
+
+   ```json
+   PUT _cluster/settings
+   {
+     "persistent": {
+       "cluster.routing.allocation.enable": "primaries"
+     }
+   }
+   ```
+
+1. Stop Elasticsearch OSS on one node (rolling upgrade) or all nodes (cluster restart upgrade).
+
+   On Linux distributions that use systemd, use this command:
+
+   ```bash
+   sudo systemctl stop elasticsearch.service
+   ```
+
+   For tarball installations, find the process ID and kill it.
+
+1. Upgrade the node (rolling) or all nodes (cluster restart).
+
+   1. Extract the OpenSearch tarball to a new directory to ensure you **do not overwrite** your Elasticsearch OSS `config`, `data`, and `logs` directories.
+
+   1. (Optional) Copy or move your Elasticsearch OSS `data` and `logs` directories to new paths. For example, you might move `/var/lib/elasticsearch` to `/var/lib/opensearch`.
+
+   1. Set the `OPENSEARCH_PATH_CONF` environment variable to the directory that contains `opensearch.yml` (e.g. `/etc/opensearch`).
+
+   1. In `opensearch.yml`, set `path.data` and `path.logs`. You might also want to disable the security plugin for now. `opensearch.yml` might look something like this:
+
+      ```yml
+      path.data: /var/lib/opensearch
+      path.logs: /var/log/opensearch
+      plugins.security.disabled: true
+      ```
+
+   1. Port your settings from `elasticsearch.yml` to `opensearch.yml`. Most settings use the same names. At a minimum, specify `cluster.name`, `node.name`, `discovery.seed_hosts`, and `cluster.initial_master_nodes`.
+
+   1. (Optional) Add your certificates to your `config` directory, add them to `opensearch.yml`, and initialize the security plugin.
+
+1. Start OpenSearch on the node (rolling) or all nodes (cluster restart).
+
+   For the tarball, run `./bin/opensearch -d`.
+
+1. Wait for the OpenSearch node to rejoin the cluster (rolling) or for the cluster to start (cluster restart). Check the `_nodes` summary to verify that all nodes are available and running the expected version:
+
+   ```bash
+   # Security plugin disabled
+   curl -XGET 'localhost:9200/_nodes/_all?pretty=true'
+   # Security plugin enabled
+   curl -XGET -k -u 'admin:admin' 'https://localhost:9200/_nodes/_all?pretty=true'
+   ```
+
+   Specifically, check the `nodes.<node-id>.version` portion of the response. Also check `_cat/indices?v` for a green status on all indices.
+
+1. (Rolling) Repeat steps 2--5 until all nodes are using OpenSearch.
+
+1. After all nodes are using the new version, re-enable shard allocation:
+
+   ```json
+   PUT _cluster/settings
+   {
+     "persistent": {
+       "cluster.routing.allocation.enable": "all"
+     }
+   }
+   ```
@@ -28,7 +28,7 @@ This command creates a detector named `http_requests` that finds anomalies based
 #### Request

 ```json
-POST _opensearch/_anomaly_detection/detectors
+POST _plugins/_anomaly_detection/detectors
 {
  "name": "test-detector",
  "description": "Test detector",
@@ -143,7 +143,7 @@ To set a category field for high cardinality:
 #### Request

 ```json
-POST _opensearch/_anomaly_detection/detectors
+POST _plugins/_anomaly_detection/detectors
 {
  "name": "Host OK Rate Detector",
  "description": "ok rate",
@@ -243,7 +243,7 @@ To create a historical detector:
 #### Request

 ```json
-POST _opensearch/_anomaly_detection/detectors
+POST _plugins/_anomaly_detection/detectors
 {
  "name": "test1",
  "description": "test historical detector",
@@ -312,7 +312,7 @@ Passes a date range to the anomaly detector to return any anomalies within that
 #### Request

 ```json
-POST _opensearch/_anomaly_detection/detectors/<detectorId>/_preview
+POST _plugins/_anomaly_detection/detectors/<detectorId>/_preview
 {
  "period_start": 1588838250000,
  "period_end": 1589443050000
@@ -452,7 +452,7 @@ Starts a real-time or historical anomaly detector job.
 #### Request

 ```json
-POST _opensearch/_anomaly_detection/detectors/<detectorId>/_start
+POST _plugins/_anomaly_detection/detectors/<detectorId>/_start
 ```

 #### Sample response
@@ -476,7 +476,7 @@ Stops a real-time or historical anomaly detector job.
 #### Request

 ```json
-POST _opensearch/_anomaly_detection/detectors/<detectorId>/_stop
+POST _plugins/_anomaly_detection/detectors/<detectorId>/_stop
 ```

 #### Sample response
@@ -494,8 +494,8 @@ Returns all results for a search query.
 #### Request

 ```json
-GET _opensearch/_anomaly_detection/detectors/results/_search
-POST _opensearch/_anomaly_detection/detectors/results/_search
+GET _plugins/_anomaly_detection/detectors/results/_search
+POST _plugins/_anomaly_detection/detectors/results/_search

 {
  "query": {
@@ -596,7 +596,7 @@ To see an ordered set of anomaly records for an entity with an anomaly within a
 #### Request

 ```json
-POST _opensearch/_anomaly_detection/detectors/results/_search
+POST _plugins/_anomaly_detection/detectors/results/_search
 {
  "query": {
    "bool": {
@@ -782,7 +782,7 @@ To get the latest task:
 #### Request

 ```json
-GET _opensearch/_anomaly_detection/detectors/<detector_id>?task=true
+GET _plugins/_anomaly_detection/detectors/<detector_id>?task=true
 ```

 To query the anomaly results with `task_id`:
@@ -790,7 +790,7 @@ To query the anomaly results with `task_id`:
 #### Request

 ```json
-GET _opensearch/_anomaly_detection/detectors/results/_search
+GET _plugins/_anomaly_detection/detectors/results/_search
 {
  "query": {
    "term": {
@@ -940,7 +940,7 @@ To delete a detector, you need to first stop the detector.
 #### Request

 ```json
-DELETE _opensearch/_anomaly_detection/detectors/<detectorId>
+DELETE _plugins/_anomaly_detection/detectors/<detectorId>
 ```


@@ -975,7 +975,7 @@ To update a detector, you need to first stop the detector.
 #### Request

 ```json
-PUT _opensearch/_anomaly_detection/detectors/<detectorId>
+PUT _plugins/_anomaly_detection/detectors/<detectorId>
 {
  "name": "test-detector",
  "description": "Test detector",
@@ -1091,7 +1091,7 @@ To update a historical detector:
 #### Request

 ```json
-PUT _opensearch/_anomaly_detection/detectors/<detectorId>
+PUT _plugins/_anomaly_detection/detectors/<detectorId>
 {
  "name": "test1",
  "description": "test historical detector",
@@ -1145,7 +1145,7 @@ Returns all information about a detector based on the `detector_id`.
 #### Request

 ```json
-GET _opensearch/_anomaly_detection/detectors/<detectorId>
+GET _plugins/_anomaly_detection/detectors/<detectorId>
 ```

 #### Sample response
@@ -1215,7 +1215,7 @@ Use `job=true` to get anomaly detection job information.
 #### Request

 ```json
-GET _opensearch/_anomaly_detection/detectors/<detectorId>?job=true
+GET _plugins/_anomaly_detection/detectors/<detectorId>?job=true
 ```

 #### Sample response
@@ -1304,7 +1304,7 @@ Use `task=true` to get historical detector task information.
 #### Request

 ```json
-GET _opensearch/_anomaly_detection/detectors/<detectorId>?task=true
+GET _plugins/_anomaly_detection/detectors/<detectorId>?task=true
 ```

 #### Sample response
@@ -1491,8 +1491,8 @@ Returns all anomaly detectors for a search query.
 #### Request

 ```json
-GET _opensearch/_anomaly_detection/detectors/_search
-POST _opensearch/_anomaly_detection/detectors/_search
+GET _plugins/_anomaly_detection/detectors/_search
+POST _plugins/_anomaly_detection/detectors/_search

 Sample Input:
 {
@@ -1597,10 +1597,10 @@ Provides information about how the plugin is performing.
 #### Request

 ```json
-GET _opensearch/_anomaly_detection/stats
-GET _opensearch/_anomaly_detection/<nodeId>/stats
-GET _opensearch/_anomaly_detection/<nodeId>/stats/<stat>
-GET _opensearch/_anomaly_detection/stats/<stat>
+GET _plugins/_anomaly_detection/stats
+GET _plugins/_anomaly_detection/<nodeId>/stats
+GET _plugins/_anomaly_detection/<nodeId>/stats/<stat>
+GET _plugins/_anomaly_detection/stats/<stat>
 ```

 #### Sample response
@@ -1697,7 +1697,7 @@ Create a monitor to set up alerts for the detector.
 #### Request

 ```json
-POST _opensearch/_alerting/monitors
+POST _plugins/_alerting/monitors
 {
  "type": "monitor",
  "name": "test-monitor",
@@ -1919,23 +1919,23 @@ It also helps track the initialization percentage, the required shingles, and th
 #### Request

 ```json
-GET _opensearch/_anomaly_detection/detectors/<detectorId>/_profile/
-GET _opensearch/_anomaly_detection/detectors/<detectorId>/_profile?_all=true
-GET _opensearch/_anomaly_detection/detectors/<detectorId>/_profile/<type>
-GET /_opensearch/_anomaly_detection/detectors/<detectorId>/_profile/<type1>,<type2>
+GET _plugins/_anomaly_detection/detectors/<detectorId>/_profile/
+GET _plugins/_anomaly_detection/detectors/<detectorId>/_profile?_all=true
+GET _plugins/_anomaly_detection/detectors/<detectorId>/_profile/<type>
+GET /_plugins/_anomaly_detection/detectors/<detectorId>/_profile/<type1>,<type2>
 ```

 #### Sample Responses

 ```json
-GET _opensearch/_anomaly_detection/detectors/<detectorId>/_profile
+GET _plugins/_anomaly_detection/detectors/<detectorId>/_profile

 {
    "state":"DISABLED",
    "error":"Stopped detector: AD models memory usage exceeds our limit."
 }

-GET _opensearch/_anomaly_detection/detectors/<detectorId>/_profile?_all=true&pretty
+GET _plugins/_anomaly_detection/detectors/<detectorId>/_profile?_all=true&pretty

 {
  "state": "RUNNING",
@@ -1970,7 +1970,7 @@ GET _opensearch/_anomaly_detection/detectors/<detectorId>/_profile?_all=true&pre
  }
 }

-GET _opensearch/_anomaly_detection/detectors/<detectorId>/_profile/total_size_in_bytes
+GET _plugins/_anomaly_detection/detectors/<detectorId>/_profile/total_size_in_bytes

 {
  "total_size_in_bytes" : 13369344
@@ -1984,7 +1984,7 @@ You can use this data to estimate how much memory is required for anomaly detect
 #### Request

 ```json
-GET /_opensearch/_anomaly_detection/detectors/<detectorId>/_profile?_all=true&pretty
+GET /_plugins/_anomaly_detection/detectors/<detectorId>/_profile?_all=true&pretty

 {
  "state": "RUNNING",
@@ -2043,7 +2043,7 @@ If there are no anomaly results for an entity, either the entity doesn't have an
 #### Request

 ```json
-GET /_opensearch/_anomaly_detection/detectors/<detectorId>/_profile?_all=true&entity=i-00f28ec1eb8997686
+GET /_plugins/_anomaly_detection/detectors/<detectorId>/_profile?_all=true&entity=i-00f28ec1eb8997686
 {
  "category_field": "host",
  "value": "i-00f28ec1eb8997686",
@@ -2067,8 +2067,8 @@ For a historical detector, specify `_all` or `ad_task` to see information about
 #### Request

 ```json
-GET _opensearch/_anomaly_detection/detectors/<detectorId>/_profile?_all
-GET _opensearch/_anomaly_detection/detectors/<detectorId>/_profile/ad_task
+GET _plugins/_anomaly_detection/detectors/<detectorId>/_profile?_all
+GET _plugins/_anomaly_detection/detectors/<detectorId>/_profile/ad_task
 ```

 #### Sample Responses
@@ -3,6 +3,8 @@ layout: default
 title: Anomaly detection
 nav_order: 46
 has_children: true
+redirect_from:
+  - /monitoring-plugins/ad/
 ---

 # Anomaly detection
@@ -13,7 +15,7 @@ It can be challenging to discover anomalies using conventional methods such as c

 Anomaly detection  automatically detects anomalies in your OpenSearch data in near real-time using the Random Cut Forest (RCF) algorithm. RCF is an unsupervised machine learning algorithm that models a sketch of your incoming data stream to compute an `anomaly grade` and `confidence score` value for each incoming data point. These values are used to differentiate an anomaly from normal variations. For more information about how RCF works, see [Random Cut Forests](https://pdfs.semanticscholar.org/8bba/52e9797f2e2cc9a823dbd12514d02f29c8b9.pdf?_ga=2.56302955.1913766445.1574109076-1059151610.1574109076).

-You can pair the anomaly detection plugin with the [alerting plugin](../alerting/) to notify you as soon as an anomaly is detected.
+You can pair the anomaly detection plugin with the [alerting plugin]({{site.url}}{{site.baseurl}}/monitoring-plugins/alerting/) to notify you as soon as an anomaly is detected.

 To use the anomaly detection plugin, your computer needs to have more than one CPU core.
 {: .note }
@@ -52,7 +54,7 @@ A feature is the field in your index that you want to check for anomalies. A det

 For example, if you choose `min()`, the detector focuses on finding anomalies based on the minimum values of your feature. If you choose `average()`, the detector finds anomalies based on the average values of your feature.

-A multi-feature model correlates anomalies across all its features. The [curse of dimensionality](https://en.wikipedia.org/wiki/Curse_of_dimensionality) makes it less likely for multi-feature models to identify smaller anomalies as compared to a single-feature model. Adding more features might negatively impact the [precision and recall](https://en.wikipedia.org/wiki/Precision_and_recall) of a model. A higher proportion of noise in your data might further amplify this negative impact. Selecting the optimal feature set is usually an iterative process. We recommend experimenting with a historical detector with different feature sets and checking the precision before moving on to real-time detectors. By default, the maximum number of features for a detector is 5. You can adjust this limit with the `opendistro.anomaly_detection.max_anomaly_features` setting.
+A multi-feature model correlates anomalies across all its features. The [curse of dimensionality](https://en.wikipedia.org/wiki/Curse_of_dimensionality) makes it less likely for multi-feature models to identify smaller anomalies as compared to a single-feature model. Adding more features might negatively impact the [precision and recall](https://en.wikipedia.org/wiki/Precision_and_recall) of a model. A higher proportion of noise in your data might further amplify this negative impact. Selecting the optimal feature set is usually an iterative process. We recommend experimenting with a historical detector with different feature sets and checking the precision before moving on to real-time detectors. By default, the maximum number of features for a detector is 5. You can adjust this limit with the `plugins.anomaly_detection.max_anomaly_features` setting.
 {: .note }

 1. On the **Model configuration** page, enter the **Feature name**.
@@ -100,11 +102,11 @@ Examine the sample preview and use it to fine-tune your feature configurations (
 Choose the **Anomaly results** tab. You need to wait for some time to see the anomaly results. If the detector interval is 10 minutes, the detector might take more than an hour to start, as it's waiting for sufficient data to generate anomalies.

 A shorter interval means the model passes the shingle process more quickly and starts to generate the anomaly results sooner.
-Use the [profile detector](./api#profile-detector) operation to make sure you have sufficient data points.
+Use the [profile detector]({{site.url}}{{site.baseurl}}/monitoring-plugins/ad/api#profile-detector) operation to make sure you have sufficient data points.

 If you see the detector pending in "initialization" for longer than a day, aggregate your existing data using the detector interval to check for any missing data points. If you find a lot of missing data points from the aggregated data, consider increasing the detector interval.

-![Anomaly detection results](../images/ad.png)
+![Anomaly detection results]({{site.url}}{{site.baseurl}}/images/ad.png)

 Analize anomalies with the following visualizations:

@@ -113,7 +115,7 @@ Analize anomalies with the following visualizations:
 - **Feature breakdown** - plots the features based on the aggregation method. You can vary the date-time range of the detector.
 - **Anomaly occurrence** - shows the `Start time`, `End time`, `Data confidence`, and `Anomaly grade` for each detected anomaly.

-`Anomaly grade` is a number between 0 and 1 that indicates how anomalous a data point is. An anomaly grade of 0 represents “not an anomaly,” and a non-zero value represents the relative severity of the anomaly. 
+`Anomaly grade` is a number between 0 and 1 that indicates how anomalous a data point is. An anomaly grade of 0 represents “not an anomaly,” and a non-zero value represents the relative severity of the anomaly.

 `Data confidence` is an estimate of the probability that the reported anomaly grade matches the expected anomaly grade. Confidence increases as the model observes more data and learns the data behavior and trends. Note that confidence is distinct from model accuracy.

@@ -124,7 +126,7 @@ Choose a filled rectangle to see a more detailed view of the anomaly.

 ### Step 4: Set up alerts

-Choose **Set up alerts** and configure a monitor to notify you when anomalies are detected. For steps to create a monitor and set up notifications based on your anomaly detector, see [Monitors](../alerting/monitors/).
+Choose **Set up alerts** and configure a monitor to notify you when anomalies are detected. For steps to create a monitor and set up notifications based on your anomaly detector, see [Monitors]({{site.url}}{{site.baseurl}}/monitoring-plugins/alerting/monitors/).

 If you stop or delete a detector, make sure to delete any monitors associated with it.

@@ -10,24 +10,24 @@ has_children: false

 You can use the security plugin with anomaly detection in OpenSearch to limit non-admin users to specific actions. For example, you might want some users to only be able to create, update, or delete detectors, while others to only view detectors.

-All anomaly detection indices are protected as system indices. Only a super admin user or an admin user with a TLS certificate can access system indices. For more information, see [System indices](../../security/configuration/system-indices/).
+All anomaly detection indices are protected as system indices. Only a super admin user or an admin user with a TLS certificate can access system indices. For more information, see [System indices]({{site.url}}{{site.baseurl}}/security-plugin/configuration/system-indices/).


-Security for anomaly detection works the same as [security for alerting](../../alerting/security/).
+Security for anomaly detection works the same as [security for alerting]({{site.url}}{{site.baseurl}}/monitoring-plugins/alerting/security/).

 ## Basic permissions

-As an admin user, you can use the security plugin to assign specific permissions to users based on which APIs they need access to. For a list of supported APIs, see [Anomaly detection API](../api/).
+As an admin user, you can use the security plugin to assign specific permissions to users based on which APIs they need access to. For a list of supported APIs, see [Anomaly detection API]({{site.url}}{{site.baseurl}}/monitoring-plugins/ad/api/).

-The security plugin has two built-in roles that cover most anomaly detection use cases: `anomaly_full_access` and `anomaly_read_access`. For descriptions of each, see [Predefined roles](../../security/access-control/users-roles/#predefined-roles).
+The security plugin has two built-in roles that cover most anomaly detection use cases: `anomaly_full_access` and `anomaly_read_access`. For descriptions of each, see [Predefined roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/users-roles#predefined-roles).

-If these roles don't meet your needs, mix and match individual anomaly detection [permissions](../../security/access-control/permissions/) to suit your use case. Each action corresponds to an operation in the REST API. For example, the `cluster:admin/opensearch/ad/detector/delete` permission lets you delete detectors.
+If these roles don't meet your needs, mix and match individual anomaly detection [permissions]({{site.url}}{{site.baseurl}}/security-plugin/access-control/permissions/) to suit your use case. Each action corresponds to an operation in the REST API. For example, the `cluster:admin/opensearch/ad/detector/delete` permission lets you delete detectors.

 ## (Advanced) Limit access by backend role

 Use backend roles to configure fine-grained access to individual detectors based on roles. For example, users of different departments in an organization can view detectors owned by their own department.

-First, make sure your users have the appropriate [backend roles](../../security/access-control/). Backend roles usually come from an [LDAP server](../../security/configuration/ldap/) or [SAML provider](../../security/configuration/saml/), but if you use the internal user database, you can use the REST API to [add them manually](../../security/access-control/api/#create-user).
+First, make sure your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/), but if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).

 Next, enable the following setting:

@@ -35,7 +35,7 @@ Next, enable the following setting:
 PUT _cluster/settings
 {
  "transient": {
-    "opendistro.anomaly_detection.filter_by_backend_roles": "true"
+    "plugins.anomaly_detection.filter_by_backend_roles": "true"
  }
 }
 ```
@@ -46,7 +46,7 @@ For example, consider two users: `alice` and `bob`.
 `alice` has an analyst backend role:

 ```json
-PUT _opensearch/_security/api/internalusers/alice
+PUT _plugins/_security/api/internalusers/alice
 {
  "password": "alice",
  "backend_roles": [
@@ -59,7 +59,7 @@ PUT _opensearch/_security/api/internalusers/alice
 `bob` has a human-resources backend role:

 ```json
-PUT _opensearch/_security/api/internalusers/bob
+PUT _plugins/_security/api/internalusers/bob
 {
  "password": "bob",
  "backend_roles": [
@@ -72,7 +72,7 @@ PUT _opensearch/_security/api/internalusers/bob
 Both `alice` and `bob` have full access to anomaly detection:

 ```json
-PUT _opensearch/_security/api/rolesmapping/anomaly_full_access
+PUT _plugins/_security/api/rolesmapping/anomaly_full_access
 {
  "backend_roles": [],
  "hosts": [],
@@ -0,0 +1,42 @@
+---
+layout: default
+title: Settings
+parent: Anomaly detection
+nav_order: 4
+---
+
+# Settings
+
+The anomaly detection plugin adds several settings to the standard OpenSearch cluster settings.
+The settings are dynamic, so you can change the default behavior of the plugin without restarting your cluster.
+You can mark settings as `persistent` or `transient`.
+
+For example, to update the retention period of the result index:
+
+```json
+PUT _cluster/settings
+{
+  "transient": {
+    "plugins.anomaly_detection.ad_result_history_retention_period": "5m"
+  }
+}
+```
+
+Setting | Default | Description
+:--- | :--- | :---
+`plugins.anomaly_detection.enabled` | True | Whether the anomaly detection plugin is enabled or not. If disabled, all detectors immediately stop running.
+`plugins.anomaly_detection.max_anomaly_detectors` | 1,000 | The maximum number of non-high cardinality detectors (no category field) users can create.
+`plugins.anomaly_detection.max_multi_entity_anomaly_detectors` | 10 | The maximum number of high cardinality detectors (with category field) in a cluster.
+`plugins.anomaly_detection.max_anomaly_features` | 5 | The maximum number of features for a detector.
+`plugins.anomaly_detection.ad_result_history_rollover_period` | 12h | How often the rollover condition is checked. If `true`, the plugin rolls over the result index to a new index.
+`plugins.anomaly_detection.ad_result_history_max_docs` | 250000000 | The maximum number of documents in one result index. The plugin only counts refreshed documents in the primary shards.
+`plugins.anomaly_detection.ad_result_history_retention_period` | 30d | The maximum age of the result index.  If its age exceeds the threshold, the plugin deletes the rolled over result index. If the cluster has only one result index, the plugin keeps the index even if it's older than its configured retention period.
+`plugins.anomaly_detection.max_entities_per_query` | 1,000 | The maximum unique values per detection interval for high cardinality detectors. By default, if the category field has more than 1,000 unique values in a detector interval, the plugin selects the top 1,000 values and orders them by `doc_count`.
+`plugins.anomaly_detection.max_entities_for_preview` | 30 | The maximum unique category field values displayed with the preview operation for high cardinality detectors. If the category field has more than 30 unique values, the plugin selects the top 30 values and orders them by `doc_count`.
+`plugins.anomaly_detection.max_primary_shards` | 10 | The maximum number of primary shards an anomaly detection index can have.
+`plugins.anomaly_detection.filter_by_backend_roles` | False | When you enable the security plugin and set this to `true`, the plugin filters results based on the user's backend role(s).
+`plugins.anomaly_detection.max_cache_miss_handling_per_second` | 100 | High cardinality detectors use a cache to store active models. In the event of a cache miss, the cache gets the models from the model checkpoint index. Use this setting to limit the rate of fetching models. Because the thread pool for a GET operation has a queue of 1,000, we recommend setting this value below 1,000.
+`plugins.anomaly_detection.max_batch_task_per_node` | 2 | Starting a historical detector triggers a batch task. This setting is the number of batch tasks that you can run per data node. You can tune this setting from 1 to 1000. If the data nodes can't support all batch tasks and you're not sure if the data nodes are capable of running more historical detectors, add more data nodes instead of changing this setting to a higher value.
+`plugins.anomaly_detection.max_old_ad_task_docs_per_detector` | 10 | You can run the same historical detector many times. For each run, the anomaly detection plugin creates a new task. This setting is the number of previous tasks the plugin keeps. Set this value to at least 1 to track its last run. You can keep a maximum of 1,000 old tasks to avoid overwhelming the cluster.
+`plugins.anomaly_detection.batch_task_piece_size` | 1000 | The date range for a historical task is split into smaller pieces and the anomaly detection plugin runs the task piece by piece. Each piece contains 1,000 detection intervals by default. For example, if detector interval is 1 minute and one piece is 1000 minutes, the feature data is queried every 1,000 minutes. You can change this setting from 1 to 10,000.
+`plugins.anomaly_detection.batch_task_piece_interval_seconds` | 5 | Add a time interval between historical detector tasks. This interval prevents the task from consuming too much of the available resources and starving other operations like search and bulk index. You can change this setting from 1 to 600 seconds.
@@ -24,7 +24,7 @@ Use the alerting API to programmatically manage monitors and alerts.
 #### Request

 ```json
-POST _opensearch/_alerting/monitors
+POST _plugins/_alerting/monitors
 {
  "type": "monitor",
  "name": "test-monitor",
@@ -174,7 +174,7 @@ If you use a custom webhook for your destination and need to embed JSON in the m
 }
 ```

-If you want to specify a timezone, you can do so by including a [cron expression](../cron/) with a timezone name in the `schedule` section of your request.
+If you want to specify a timezone, you can do so by including a [cron expression]({{site.url}}{{site.baseurl}}/monitoring-plugins/alerting/cron/) with a timezone name in the `schedule` section of your request.

 The following example creates a monitor that runs at 12:10 PM Pacific Time on the 1st day of every month.

@@ -252,7 +252,7 @@ When you update a monitor, include the current version number as a parameter. Op
 #### Request

 ```json
-PUT _opensearch/_alerting/monitors/<monitor_id>
+PUT _plugins/_alerting/monitors/<monitor_id>
 {
  "type": "monitor",
  "name": "test-monitor",
@@ -372,7 +372,7 @@ PUT _opensearch/_alerting/monitors/<monitor_id>
 #### Request

 ```
-GET _opensearch/_alerting/monitors/<monitor_id>
+GET _plugins/_alerting/monitors/<monitor_id>
 ```

 #### Sample response
@@ -439,15 +439,15 @@ GET _opensearch/_alerting/monitors/<monitor_id>

 ## Monitor stats

-Returns statistics about the alerting feature. Use `_opensearch/_alerting/stats` to find node IDs and metrics. Then you can drill down using those values.
+Returns statistics about the alerting feature. Use `_plugins/_alerting/stats` to find node IDs and metrics. Then you can drill down using those values.

 #### Request

 ```json
-GET _opensearch/_alerting/stats
-GET _opensearch/_alerting/stats/<metric>
-GET _opensearch/_alerting/<node-id>/stats
-GET _opensearch/_alerting/<node-id>/stats/<metric>
+GET _plugins/_alerting/stats
+GET _plugins/_alerting/stats/<metric>
+GET _plugins/_alerting/<node-id>/stats
+GET _plugins/_alerting/<node-id>/stats/<metric>
 ```

 #### Sample response
@@ -460,7 +460,7 @@ GET _opensearch/_alerting/<node-id>/stats/<metric>
    "failed": 0
  },
  "cluster_name": "475300751431:alerting65-dont-delete",
-  "opensearch.scheduled_jobs.enabled": true,
+  "plugins.scheduled_jobs.enabled": true,
  "scheduled_job_index_exists": true,
  "scheduled_job_index_status": "green",
  "nodes_on_schedule": 9,
@@ -631,7 +631,7 @@ GET _opensearch/_alerting/<node-id>/stats/<metric>
 #### Request

 ```
-DELETE _opensearch/_alerting/monitors/<monitor_id>
+DELETE _plugins/_alerting/monitors/<monitor_id>
 ```

 #### Sample response
@@ -662,7 +662,7 @@ DELETE _opensearch/_alerting/monitors/<monitor_id>
 #### Request

 ```json
-GET _opensearch/_alerting/monitors/_search
+GET _plugins/_alerting/monitors/_search
 {
  "query": {
    "match" : {
@@ -762,7 +762,7 @@ You can add the optional `?dryrun=true` parameter to the URL to show the results
 #### Request

 ```json
-POST _opensearch/_alerting/monitors/<monitor_id>/_execute
+POST _plugins/_alerting/monitors/<monitor_id>/_execute
 ```

 #### Sample response
@@ -793,7 +793,7 @@ Returns an array of all alerts.
 #### Request

 ```json
-GET _opensearch/_alerting/monitors/alerts
+GET _plugins/_alerting/monitors/alerts
 ```

 #### Response
@@ -862,7 +862,7 @@ GET _opensearch/_alerting/monitors/alerts
 #### Request

 ```json
-POST _opensearch/_alerting/monitors/<monitor-id>/_acknowledge/alerts
+POST _plugins/_alerting/monitors/<monitor-id>/_acknowledge/alerts
 {
  "alerts": ["eQURa3gBKo1jAh6qUo49"]
 }
@@ -886,7 +886,7 @@ POST _opensearch/_alerting/monitors/<monitor-id>/_acknowledge/alerts
 #### Requests

 ```json
-POST _opensearch/_alerting/destinations
+POST _plugins/_alerting/destinations
 {
  "name": "my-destination",
  "type": "slack",
@@ -895,7 +895,7 @@ POST _opensearch/_alerting/destinations
  }
 }

-POST _opensearch/_alerting/destinations
+POST _plugins/_alerting/destinations
 {
  "type": "custom_webhook",
  "name": "my-custom-destination",
@@ -939,7 +939,7 @@ POST _opensearch/_alerting/destinations
 #### Request

 ```json
-PUT _opensearch/_alerting/destinations/<destination-id>
+PUT _plugins/_alerting/destinations/<destination-id>
 {
  "name": "my-updated-destination",
  "type": "slack",
@@ -976,7 +976,7 @@ Retrieve one destination.
 #### Requests

 ```json
-GET _opensearch/_alerting/destinations/<destination-id>
+GET _plugins/_alerting/destinations/<destination-id>
 ```

 #### Sample response
@@ -1021,7 +1021,7 @@ Retrieve all destinations.
 #### Requests

 ```json
-GET _opensearch/_alerting/destinations
+GET _plugins/_alerting/destinations
 ```

 #### Sample response
@@ -1064,7 +1064,7 @@ GET _opensearch/_alerting/destinations
 #### Request

 ```
-DELETE _opensearch/_alerting/destinations/<destination-id>
+DELETE _plugins/_alerting/destinations/<destination-id>
 ```

 #### Sample response
@@ -1092,7 +1092,7 @@ DELETE _opensearch/_alerting/destinations/<destination-id>

 #### Request
 ```json
-POST _opensearch/_alerting/destinations/email_accounts
+POST _plugins/_alerting/destinations/email_accounts
 {
  "name": "example_account",
  "email": "example@email.com",
@@ -1124,7 +1124,7 @@ POST _opensearch/_alerting/destinations/email_accounts

 #### Request
 ```json
-PUT _opensearch/_alerting/destinations/email_accounts/<email_account_id>
+PUT _plugins/_alerting/destinations/email_accounts/<email_account_id>
 {
  "name": "example_account",
  "email": "example@email.com",
@@ -1155,7 +1155,7 @@ PUT _opensearch/_alerting/destinations/email_accounts/<email_account_id>

 #### Request
 ```json
-GET _opensearch/_alerting/destinations/email_accounts/<email_account_id>
+GET _plugins/_alerting/destinations/email_accounts/<email_account_id>
 {
  "name": "example_account",
  "email": "example@email.com",
@@ -1186,7 +1186,7 @@ GET _opensearch/_alerting/destinations/email_accounts/<email_account_id>

 #### Request
 ```
-DELETE _opensearch/_alerting/destinations/email_accounts/<email_account_id>
+DELETE _plugins/_alerting/destinations/email_accounts/<email_account_id>
 ```
 #### Sample response

@@ -1213,7 +1213,7 @@ DELETE _opensearch/_alerting/destinations/email_accounts/<email_account_id>
 #### Request

 ```json
-POST _opensearch/_alerting/destinations/email_accounts/_search
+POST _plugins/_alerting/destinations/email_accounts/_search
 {
  "from": 0,
  "size": 20,
@@ -1279,7 +1279,7 @@ POST _opensearch/_alerting/destinations/email_accounts/_search
 #### Request

 ```json
-POST _opensearch/_alerting/destinations/email_groups
+POST _plugins/_alerting/destinations/email_groups
 {
  "name": "example_email_group",
  "emails": [{
@@ -1313,7 +1313,7 @@ POST _opensearch/_alerting/destinations/email_groups
 #### Request

 ```json
-PUT _opensearch/_alerting/destinations/email_groups/<email_group_id>
+PUT _plugins/_alerting/destinations/email_groups/<email_group_id>
 {
  "name": "example_email_group",
  "emails": [{
@@ -1345,7 +1345,7 @@ PUT _opensearch/_alerting/destinations/email_groups/<email_group_id>

 #### Request
 ```json
-GET _opensearch/_alerting/destinations/email_groups/<email_group_id>
+GET _plugins/_alerting/destinations/email_groups/<email_group_id>
 {
  "name": "example_email_group",
  "emails": [{
@@ -1377,7 +1377,7 @@ GET _opensearch/_alerting/destinations/email_groups/<email_group_id>

 #### Request
 ```
-DELETE _opensearch/_alerting/destinations/email_groups/<email_group_id>
+DELETE _plugins/_alerting/destinations/email_groups/<email_group_id>
 ```
 #### Sample response

@@ -1404,7 +1404,7 @@ DELETE _opensearch/_alerting/destinations/email_groups/<email_group_id>
 #### Request

 ```json
-POST _opensearch/_alerting/destinations/email_groups/_search
+POST _plugins/_alerting/destinations/email_groups/_search
 {
  "from": 0,
  "size": 20,
@@ -4,6 +4,9 @@ title: Cron
 nav_order: 20
 parent: Alerting
 has_children: false
+redirect_from:
+  - /alerting/cron/
+  - /docs/alerting/cron/
 ---

 # Cron expression reference
@@ -61,4 +64,4 @@ Every three hours on the first day of every other month:

 ## API

-For an example of how to use a custom cron expression in an API call, see the [create monitor API operation](../api/#request-1).
+For an example of how to use a custom cron expression in an API call, see the [create monitor API operation]({{site.url}}{{site.baseurl}}/monitoring-plugins/alerting/api#request-1).
@@ -3,6 +3,8 @@ layout: default
 title: Alerting
 nav_order: 34
 has_children: true
+redirect_from:
+  - /monitoring-plugins/alerting/
 ---

 # Alerting
@@ -13,4 +15,4 @@ The alerting feature notifies you when data from one or more OpenSearch indices

 To get started, choose **Alerting** in OpenSearch Dashboards.

-![OpenSearch Dashboards side bar with link](../images/alerting.png)
+![OpenSearch Dashboards side bar with link]({{site.url}}{{site.baseurl}}/images/alerting.png)
@@ -78,8 +78,8 @@ You can enter individual email addresses or an email group in the **Recipients**
 If your email provider requires SSL or TLS, you must authenticate each sender account before you can send an email. Enter these credentials in the OpenSearch keystore using the CLI. Run the following commands (in your OpenSearch directory) to enter your username and password. The `<sender_name>` is the name you entered for **Sender** earlier.

 ```bash
-./bin/opensearch-keystore add opendistro.alerting.destination.email.<sender_name>.username
-./bin/opensearch-keystore add opendistro.alerting.destination.email.<sender_name>.password
+./bin/opensearch-keystore add plugins.alerting.destination.email.<sender_name>.username
+./bin/opensearch-keystore add plugins.alerting.destination.email.<sender_name>.password
 ```

 **Note**: Keystore settings are node-specific. You must run these commands on each node.
@@ -102,7 +102,7 @@ POST _nodes/reload_secure_settings
 1. Choose **Alerting**, **Monitors**, **Create monitor**.
 1. Specify a name for the monitor.

-The anomaly detection option is for pairing with the anomaly detection plugin. See [Anomaly Detection](../../ad/).
+The anomaly detection option is for pairing with the anomaly detection plugin. See [Anomaly Detection]({{site.url}}{{site.baseurl}}/monitoring-plugins/ad/).
 For anomaly detector, choose an appropriate schedule for the monitor based on the detector interval. Otherwise, the alerting monitor might miss reading the results.

 For example, assume you set the monitor interval and the detector interval as 5 minutes, and you start the detector at 12:00. If an anomaly is detected at 12:05, it might be available at 12:06 because of the delay between writing the anomaly and it being available for queries. The monitor reads the anomaly results between 12:00 and 12:05, so it does not get the anomaly results available at 12:06.
@@ -114,13 +114,13 @@ Whenever you update a detector’s interval, make sure to update the associated

 1. Choose one or more indices. You can also use `*` as a wildcard to specify an index pattern.

-   If you use the security plugin, you can only choose indices that you have permission to access. For details, see [Alerting security](../security/).
+   If you use the security plugin, you can only choose indices that you have permission to access. For details, see [Alerting security]({{site.url}}{{site.baseurl}}/security-plugin/).

 1. Define the monitor in one of three ways: visually, using a query, or using an anomaly detector.

   - Visual definition works well for monitors that you can define as "some value is above or below some threshold for some amount of time."

-   - Query definition gives you flexibility in terms of what you query for (using [the OpenSearch query DSL](../../opensearch/full-text)) and how you evaluate the results of that query (Painless scripting).
+   - Query definition gives you flexibility in terms of what you query for (using [the OpenSearch query DSL]({{site.url}}{{site.baseurl}}/opensearch/query-dsl/full-text)) and how you evaluate the results of that query (Painless scripting).

     This example averages the `cpu_usage` field:

@@ -172,12 +172,12 @@ Whenever you update a detector’s interval, make sure to update the associated

 1. To define a monitor visually, choose **Define using visual graph**. Then choose an aggregation (for example, `count()` or `average()`), a set of documents, and a timeframe. Visual definition works well for most monitors.

-   To use a query, choose **Define using extraction query**, add your query (using [the OpenSearch query DSL](../../opensearch/full-text/)), and test it using the **Run** button.
+   To use a query, choose **Define using extraction query**, add your query (using [the OpenSearch query DSL]({{site.url}}{{site.baseurl}}/opensearch/query-dsl/full-text/)), and test it using the **Run** button.

   The monitor makes this query to OpenSearch as often as the schedule dictates; check the **Query Performance** section and make sure you're comfortable with the performance implications.

   To use an anomaly detector, choose **Define using Anomaly detector** and select your **Detector**.
-1. Choose a frequency and timezone for your monitor. Note that you can only pick a timezone if you choose Daily, Weekly, Monthly, or [custom cron expression](../cron/) for frequency.
+1. Choose a frequency and timezone for your monitor. Note that you can only pick a timezone if you choose Daily, Weekly, Monthly, or [custom cron expression]({{site.url}}{{site.baseurl}}/monitoring-plugins/alerting/cron/) for frequency.
 1. Choose **Create**.


@@ -265,7 +265,7 @@ Below are some variables you can include in your message using Mustache template
 Variable | Data Type | Description
 :--- | :--- | :---
 `ctx.monitor` | JSON | Includes `ctx.monitor.name`, `ctx.monitor.type`, `ctx.monitor.enabled`, `ctx.monitor.enabled_time`, `ctx.monitor.schedule`, `ctx.monitor.inputs`, `triggers` and `ctx.monitor.last_update_time`.
-`ctx.monitor.user` | JSON | Includes information about the user who created the monitor. Includes `ctx.monitor.user.backend_roles` and `ctx.monitor.user.roles`, which are arrays that contain the backend roles and roles assigned to the user. See [alerting security](../security/) for more information.
+`ctx.monitor.user` | JSON | Includes information about the user who created the monitor. Includes `ctx.monitor.user.backend_roles` and `ctx.monitor.user.roles`, which are arrays that contain the backend roles and roles assigned to the user. See [alerting security]({{site.url}}{{site.baseurl}}/monitoring-plugins/alerting/security/) for more information.
 `ctx.monitor.enabled` | Boolean | Whether the monitor is enabled.
 `ctx.monitor.enabled_time` | Milliseconds | Unix epoch time of when the monitor was last enabled.
 `ctx.monitor.schedule` | JSON | Contains a schedule of how often or when the monitor should run.
@@ -1,6 +1,6 @@
 ---
 layout: default
-title: Alerting Security
+title: Alerting security
 nav_order: 10
 parent: Alerting
 has_children: false
@@ -13,9 +13,9 @@ If you use the security plugin alongside alerting, you might want to limit certa

 ## Basic permissions

-The security plugin has three built-in roles that cover most alerting use cases: `alerting_read_access`, `alerting_ack_alerts`, and `alerting_full_access`. For descriptions of each, see [Predefined roles](../../security/access-control/users-roles/#predefined-roles).
+The security plugin has three built-in roles that cover most alerting use cases: `alerting_read_access`, `alerting_ack_alerts`, and `alerting_full_access`. For descriptions of each, see [Predefined roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/users-roles#predefined-roles).

-If these roles don't meet your needs, mix and match individual alerting [permissions](../../security/access-control/permissions/) to suit your use case. Each action corresponds to an operation in the REST API. For example, the `cluster:admin/opensearch/alerting/destination/delete` permission lets you delete destinations.
+If these roles don't meet your needs, mix and match individual alerting [permissions]({{site.url}}{{site.baseurl}}/security-plugin/access-control/permissions/) to suit your use case. Each action corresponds to an operation in the REST API. For example, the `cluster:admin/opensearch/alerting/destination/delete` permission lets you delete destinations.


 ## How monitors access data
@@ -29,14 +29,14 @@ Later, the user `psantos` wants to edit the monitor to run every two hours, but
 - Update the monitor so that it only checks `store1-returns`.
 - Ask an administrator for read access to the other two indices.

-After making the change, the monitor now runs with the same permissions as `psantos`, including any [document-level security](../../security/access-control/document-level-security/) queries, [excluded fields](../../security/access-control/field-level-security/), and [masked fields](../../security/access-control/field-masking/). If you use an extraction query to define your monitor, use the **Run** button to ensure that the response includes the fields you need.
+After making the change, the monitor now runs with the same permissions as `psantos`, including any [document-level security]({{site.url}}{{site.baseurl}}/security-plugin/access-control/document-level-security/) queries, [excluded fields]({{site.url}}{{site.baseurl}}/security-plugin/access-control/field-level-security/), and [masked fields]({{site.url}}{{site.baseurl}}/security-plugin/access-control/field-masking/). If you use an extraction query to define your monitor, use the **Run** button to ensure that the response includes the fields you need.


 ## (Advanced) Limit access by backend role

 Out of the box, the alerting plugin has no concept of ownership. For example, if you have the `cluster:admin/opensearch/alerting/monitor/write` permission, you can edit *all* monitors, regardless of whether you created them. If a small number of trusted users manage your monitors and destinations, this lack of ownership generally isn't a problem. A larger organization might need to segment access by backend role.

-First, make sure that your users have the appropriate [backend roles](../../security/access-control/). Backend roles usually come from an [LDAP server](../../security/configuration/ldap/) or [SAML provider](../../security/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually](../../security/access-control/api/#create-user).
+First, make sure that your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).

 Next, enable the following setting:

@@ -44,7 +44,7 @@ Next, enable the following setting:
 PUT _cluster/settings
 {
  "transient": {
-    "opendistro.alerting.filter_by_backend_roles": "true"
+    "plugins.alerting.filter_by_backend_roles": "true"
  }
 }
 ```
@@ -58,7 +58,7 @@ If `jdoe` creates a monitor, `jroe` can see and modify it, but `psantos` can't.

 <!-- ## (Advanced) Limit access by individual

-If you only want users to be able to see and modify their own monitors and destinations, duplicate the `alerting_full_access` role and add the following [DLS query](../../security/access-control/document-level-security/) to it:
+If you only want users to be able to see and modify their own monitors and destinations, duplicate the `alerting_full_access` role and add the following [DLS query]({{site.url}}{{site.baseurl}}/security-plugin/access-control/document-level-security/) to it:

 ```json
 {
@@ -0,0 +1,59 @@
+---
+layout: default
+title: Management
+parent: Alerting
+nav_order: 5
+---
+
+# Management
+
+
+## Alerting indices
+
+The alerting feature creates several indices and one alias. The security plugin demo script configures them as [system indices]({{site.url}}{{site.baseurl}}/security-plugin/configuration/system-indices/) for an extra layer of protection. Don't delete these indices or modify their contents without using the alerting APIs.
+
+Index | Purpose
+:--- | :---
+`.opendistro-alerting-alerts` | Stores ongoing alerts.
+`.opendistro-alerting-alert-history-<date>` | Stores a history of completed alerts.
+`.opendistro-alerting-config` | Stores monitors, triggers, and destinations. [Take a snapshot]({{site.url}}{{site.baseurl}}/opensearch/snapshot-restore) of this index to back up your alerting configuration.
+`.opendistro-alerting-alert-history-write` (alias) | Provides a consistent URI for the `.opendistro-alerting-alert-history-<date>` index.
+
+All alerting indices are hidden by default. For a summary, make the following request:
+
+```
+GET _cat/indices?expand_wildcards=open,hidden
+```
+
+
+## Alerting settings
+
+We don't recommend changing these settings; the defaults should work well for most use cases.
+
+All settings are available using the OpenSearch `_cluster/settings` API. None require a restart, and all can be marked `persistent` or `transient`.
+
+Setting | Default | Description
+:--- | :--- | :---
+`plugins.scheduled_jobs.enabled` | true | Whether the alerting plugin is enabled or not. If disabled, all monitors immediately stop running.
+`plugins.alerting.index_timeout` | 60s | The timeout for creating monitors and destinations using the REST APIs.
+`plugins.alerting.request_timeout` | 10s | The timeout for miscellaneous requests from the plugin.
+`plugins.alerting.action_throttle_max_value` | 24h | The maximum amount of time you can set for action throttling. By default, this value displays as 1440 minutes in OpenSearch Dashboards.
+`plugins.alerting.input_timeout` | 30s | How long the monitor can take to issue the search request.
+`plugins.alerting.bulk_timeout` | 120s | How long the monitor can write alerts to the alert index.
+`plugins.alerting.alert_backoff_count` | 3 | The number of retries for writing alerts before the operation fails.
+`plugins.alerting.alert_backoff_millis` | 50ms | The amount of time to wait between retries---increases exponentially after each failed retry.
+`plugins.alerting.alert_history_rollover_period` | 12h | How frequently to check whether the `.opendistro-alerting-alert-history-write` alias should roll over to a new history index and whether the Alerting plugin should delete any history indices.
+`plugins.alerting.move_alerts_backoff_millis` | 250 | The amount of time to wait between retries---increases exponentially after each failed retry.
+`plugins.alerting.move_alerts_backoff_count` | 3 | The number of retries for moving alerts to a deleted state after their monitor or trigger has been deleted.
+`plugins.alerting.monitor.max_monitors` | 1000 | The maximum number of monitors users can create.
+`plugins.alerting.alert_history_max_age` | 30d | The oldest document to store in the `.opendistro-alert-history-<date>` index before creating a new index. If the number of alerts in this time period does not exceed `alert_history_max_docs`, alerting creates one history index per period (e.g. one index every 30 days).
+`plugins.alerting.alert_history_max_docs` | 1000 | The maximum number of alerts to store in the `.opendistro-alert-history-<date>` index before creating a new index.
+`plugins.alerting.alert_history_enabled` | true | Whether to create `.opendistro-alerting-alert-history-<date>` indices.
+`plugins.alerting.alert_history_retention_period` | 60d | The amount of time to keep history indices before automatically deleting them.
+`plugins.alerting.destination.allow_list` | ["chime", "slack", "custom_webhook", "email", "test_action"] | The list of allowed destinations. If you don't want to allow users to a certain type of destination, you can remove it from this list, but we recommend leaving this setting as-is.
+`plugins.alerting.filter_by_backend_roles` | "false" | Restricts access to monitors by backend role. See [Alerting security]({{site.url}}{{site.baseurl}}/monitoring-plugins/alerting/security/).
+`plugins.scheduled_jobs.sweeper.period` | 5m | The alerting feature uses its "job sweeper" component to periodically check for new or updated jobs. This setting is the rate at which the sweeper checks to see if any jobs (monitors) have changed and need to be rescheduled.
+`plugins.scheduled_jobs.sweeper.page_size` | 100 | The page size for the sweeper. You shouldn't need to change this value.
+`plugins.scheduled_jobs.sweeper.backoff_millis` | 50ms | The amount of time the sweeper waits between retries---increases exponentially after each failed retry.
+`plugins.scheduled_jobs.sweeper.retry_count` | 3 | The total number of times the sweeper should retry before throwing an error.
+`plugins.scheduled_jobs.request_timeout` | 10s | The timeout for the request that sweeps shards for jobs.
@@ -10,7 +10,7 @@ nav_order: 1
 Performance Analyzer uses a single HTTP method and URI for most requests:

 ```
-GET <endpoint>:9600/_opensearch/_performanceanalyzer/metrics
+GET <endpoint>:9600/_plugins/_performanceanalyzer/metrics
 ```

 Note the use of port 9600. Provide parameters for metrics, aggregations, dimensions, and nodes (optional):
@@ -19,13 +19,13 @@ Note the use of port 9600. Provide parameters for metrics, aggregations, dimensi
 ?metrics=<metrics>&agg=<aggregations>&dim=<dimensions>&nodes=all"
 ```

-For a full list of metrics, see [Metrics reference](../reference/). Performance Analyzer updates its data every five seconds. If you create a custom client, we recommend using that same interval for calls to the API.
+For a full list of metrics, see [Metrics reference]({{site.url}}{{site.baseurl}}/monitoring-plugins/pa/reference/). Performance Analyzer updates its data every five seconds. If you create a custom client, we recommend using that same interval for calls to the API.


 #### Sample request

 ```
-GET localhost:9600/_opensearch/_performanceanalyzer/metrics?metrics=Latency,CPU_Utilization&agg=avg,max&dim=ShardID&nodes=all
+GET localhost:9600/_plugins/_performanceanalyzer/metrics?metrics=Latency,CPU_Utilization&agg=avg,max&dim=ShardID&nodes=all
 ```


@@ -104,7 +104,7 @@ Performance Analyzer has one additional URI that returns the unit for each metri
 #### Sample request

 ```
-GET localhost:9600/_opensearch/_performanceanalyzer/metrics/units
+GET localhost:9600/_plugins/_performanceanalyzer/metrics/units
 ```


@@ -32,7 +32,7 @@ The best way to get started with building custom dashboards is to duplicate and

 PerfTop positions elements within a grid. For example, consider this 12 * 12 grid.

-![Dashboard grid](../../images/perftop-grid.png)
+![Dashboard grid]({{site.url}}{{site.baseurl}}/images/perftop-grid.png)

 The upper-left of the grid represents row 0, column 0, so the starting positions for the three boxes are:

@@ -95,7 +95,7 @@ At this point, however, all the JSON does is define the size and position of thr

 ## Add queries

-Queries use the same elements as the [REST API](../api/), just in JSON form:
+Queries use the same elements as the [REST API]({{site.url}}{{site.baseurl}}/monitoring-plugins/pa/api/), just in JSON form:

 ```json
 {
@@ -108,7 +108,7 @@ Queries use the same elements as the [REST API](../api/), just in JSON form:
 }
 ```

-For details on available metrics, see [Metrics reference](../reference/).
+For details on available metrics, see [Metrics reference]({{site.url}}{{site.baseurl}}/monitoring-plugins/pa/reference/).


 ## Add options
@@ -3,6 +3,8 @@ layout: default
 title: Performance Analyzer
 nav_order: 58
 has_children: true
+redirect_from:
+  - /monitoring-plugins/pa/
 ---

 # Performance Analyzer
@@ -17,7 +19,7 @@ You can also install it using [npm](https://www.npmjs.com/):
 npm install -g @aws/opensearch-perftop
 ```

-![PerfTop screenshot](../images/perftop.png)
+![PerfTop screenshot]({{site.url}}{{site.baseurl}}/images/perftop.png)


 ## Get started with PerfTop
@@ -25,28 +27,28 @@ npm install -g @aws/opensearch-perftop
 The basic syntax is:

 ```bash
-./perf-top-<operating_system> --dashboard <dashboard>.json --endpoint <endpoint>
+./opensearch-perf-top-<operating_system> --dashboard <dashboard>.json --endpoint <endpoint>
 ```

 If you're using npm, the syntax is similar:

 ```bash
-perf-top --dashboard <dashboard> --endpoint <endpoint>
+opensearch-perf-top --dashboard <dashboard> --endpoint <endpoint>
 ```

 If you're running PerfTop from a node (i.e. locally), specify port 9600:

 ```bash
-./perf-top-linux --dashboard dashboards/<dashboard>.json --endpoint localhost:9600
+./opensearch-perf-top-linux --dashboard dashboards/<dashboard>.json --endpoint localhost:9600
 ```

 Otherwise, just specify the OpenSearch endpoint:

 ```bash
-./perf-top-macos --dashboard dashboards/<dashboard>.json --endpoint my-cluster.my-domain.com
+./opensearch-perf-top-macos --dashboard dashboards/<dashboard>.json --endpoint my-cluster.my-domain.com
 ```

-PerfTop has four pre-built dashboards in the `dashboards` directory, but you can also [create your own](dashboards/).
+PerfTop has four pre-built dashboards in the `dashboards` directory, but you can also [create your own]({{site.url}}{{site.baseurl}}/dashboards/).

 You can also load the pre-built dashboards (ClusterOverview, ClusterNetworkMemoryAnalysis, ClusterThreadAnalysis, or NodeAnalysis) without the JSON files, such as `--dashboard ClusterThreadAnalysis`.

@@ -66,7 +68,7 @@ PerfTop has no interactivity. Start the application, monitor the dashboard, and

 Performance Analyzer uses `/dev/shm` for temporary storage. During heavy workloads on a cluster, Performance Analyzer can use up to 1 GB of space.

-Docker, however, has a default `/dev/shm` size of 64 MB. To change this value, you can use the `docker run --shm-size 1gb` flag or [a similar setting in Docker Compose](https://docs.docker.com/compose/compose-file/#shm_size).
+Docker, however, has a default `/dev/shm` size of 64 MB. To change this value, you can use the `docker run --shm-size 1gb` flag or [a similar setting in Docker Compose](https://docs.docker.com/compose/compose-file#shm_size).

 If you're not using Docker, check the size of `/dev/shm` using `df -h`. The default value is probably plenty, but if you need to change its size, add the following line to `/etc/fstab`:

@@ -83,10 +85,10 @@ mount -o remount /dev/shm

 ### Security

-Performance Analyzer supports encryption in transit for requests. It currently does *not* support client or server authentication for requests. To enable encryption in transit, edit `performance-analyzer.properties` in your `$ES_HOME` directory:
+Performance Analyzer supports encryption in transit for requests. It currently does *not* support client or server authentication for requests. To enable encryption in transit, edit `performance-analyzer.properties` in your `$OPENSEARCH_HOME` directory:

 ```bash
-vi $ES_HOME/plugins/opensearch_performance_analyzer/pa_config/performance-analyzer.properties
+vi $OPENSEARCH_HOME/plugins/opensearch-performance-analyzer/pa_config/performance-analyzer.properties
 ```

 Change the following lines to configure encryption in transit. Note that `certificate-file-path` must be a certificate for the server, not a root CA:
@@ -12,10 +12,10 @@ nav_order: 1

 ```
 # Request all available RCAs
-GET localhost:9600/_opensearch/_performanceanalyzer/rca
+GET localhost:9600/_plugins/_performanceanalyzer/rca

 # Request a specific RCA
-GET localhost:9600/_opensearch/_performanceanalyzer/rca?name=HighHeapUsageClusterRca
+GET localhost:9600/_plugins/_performanceanalyzer/rca?name=HighHeapUsageClusterRca
 ```


@@ -8,4 +8,4 @@ nav_order: 3

 # RCA reference

-You can find a reference of available RCAs and their purposes on [Github](https://github.com/opensearch-project/performance-analyzer-rca/tree/master/docs).
+You can find a reference of available RCAs and their purposes on [GitHub](https://github.com/opensearch-project/performance-analyzer-rca/tree/main/docs).
@@ -7,7 +7,7 @@ nav_order: 25

 # Data Prepper configuration reference

-This page lists all supported Data Prepper sources, buffers, preppers, and sinks, along with their associated options. For example configuration files, see [Data Prepper](../data-prepper/).
+This page lists all supported Data Prepper sources, buffers, preppers, and sinks, along with their associated options. For example configuration files, see [Data Prepper]({{site.url}}{{site.baseurl}}/monitoring-plugins/trace/data-prepper/).


 ## Data Prepper server options
@@ -149,7 +149,7 @@ aws_region | No | String, AWS region for the cluster (e.g. `"us-east-1"`) if you
 trace_analytics_raw | No | Boolean, default false. Whether to export as trace data to the `otel-v1-apm-span-*` index pattern (alias `otel-v1-apm-span`) for use with the Trace Analytics OpenSearch Dashboards plugin.
 trace_analytics_service_map | No | Boolean, default false. Whether to export as trace data to the `otel-v1-apm-service-map` index for use with the service map component of the Trace Analytics OpenSearch Dashboards plugin.
 index | No | String, name of the index to export to. Only required if you don't use the `trace_analytics_raw` or `trace_analytics_service_map` presets.
-template_file | No | String, the path to a JSON [index template](../../opensearch/index-templates/) file (e.g. `/your/local/template-file.json` if you do not use the `trace_analytics_raw` or `trace_analytics_service_map`. See [otel-v1-apm-span-index-template.json](https://github.com/opensearch-project/data-prepper/blob/main/data-prepper-plugins/opensearch/src/main/resources/otel-v1-apm-span-index-template.json) for an example.
+template_file | No | String, the path to a JSON [index template]({{site.url}}{{site.baseurl}}/opensearch/index-templates/) file (e.g. `/your/local/template-file.json` if you do not use the `trace_analytics_raw` or `trace_analytics_service_map`. See [otel-v1-apm-span-index-template.json](https://github.com/opensearch-project/data-prepper/blob/main/data-prepper-plugins/opensearch/src/main/resources/otel-v1-apm-span-index-template.json) for an example.
 document_id_field | No | String, the field from the source data to use for the OpenSearch document ID (e.g. `"my-field"`) if you don't use the `trace_analytics_raw` or `trace_analytics_service_map` presets.
 dlq_file | No | String, the path to your preferred dead letter queue file (e.g. `/your/local/dlq-file`). Data Prepper writes to this file when it fails to index a document on the OpenSearch cluster.
 bulk_size | No | Integer (long), default 5. The maximum size (in MiB) of bulk requests to the OpenSearch cluster. Values below 0 indicate an unlimited size. If a single document exceeds the maximum bulk request size, Data Prepper sends it individually.
@@ -105,7 +105,7 @@ service-map-pipeline:
        trace_analytics_service_map: true
 ```

-To learn more, see the [Data Prepper configuration reference](../data-prepper-reference/).
+To learn more, see the [Data Prepper configuration reference]({{site.url}}{{site.baseurl}}/monitoring-plugins/trace/data-prepper-reference/).

 ## Configure the Data Prepper server
 Data Prepper itself provides administrative HTTP endpoints such as `/list` to list pipelines and `/metrics/prometheus` to provide Prometheus-compatible metrics data. The port which serves these endpoints, as well as TLS configuration, is specified by a separate YAML file. Example:
@@ -12,7 +12,7 @@ OpenSearch Trace Analytics consists of two components---Data Prepper and the Tra

 ## Basic flow of data

-![Data flow diagram from a distributed application to OpenSearch](../../images/ta.svg)
+![Data flow diagram from a distributed application to OpenSearch]({{site.url}}{{site.baseurl}}/images/ta.svg)

 1. Trace Analytics relies on you adding instrumentation to your application and generating trace data. The [OpenTelemetry documentation](https://opentelemetry.io/docs/) contains example applications for many programming languages that can help you get started, including Java, Python, Go, and JavaScript.

@@ -20,9 +20,9 @@ OpenSearch Trace Analytics consists of two components---Data Prepper and the Tra

 1. The [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/getting-started/) receives data from the application and formats it into OpenTelemetry data.

-1. [Data Prepper](../data-prepper/) processes the OpenTelemetry data, transforms it for use in OpenSearch, and indexes it on an OpenSearch cluster.
+1. [Data Prepper]({{site.url}}{{site.baseurl}}/monitoring-plugins/trace/data-prepper/) processes the OpenTelemetry data, transforms it for use in OpenSearch, and indexes it on an OpenSearch cluster.

-1. The [Trace Analytics OpenSearch Dashboards plugin](../ta-opensearch-dashboards/) displays the data in near real-time as a series of charts and tables, with an emphasis on service architecture, latency, error rate, and throughput.
+1. The [Trace Analytics OpenSearch Dashboards plugin]({{site.url}}{{site.baseurl}}/monitoring-plugins/trace/ta-dashboards/) displays the data in near real-time as a series of charts and tables, with an emphasis on service architecture, latency, error rate, and throughput.


 ## Jaeger HotROD
@@ -39,7 +39,7 @@ Download or clone the [Data Prepper repository](https://github.com/opensearch-pr

 Close the file and run `docker-compose up --build`. After the containers start, navigate to `http://localhost:8080` in a web browser.

-![HotROD web interface](../../images/hot-rod.png)
+![HotROD web interface]({{site.url}}{{site.baseurl}}/images/hot-rod.png)

 Click one of the buttons in the web interface to send a request to the application. Each request starts a series of operations across the services that make up the application. From the console logs, you can see that these operations share the same `trace-id`, which lets you track all of the operations in the request as a single *trace*:

@@ -80,4 +80,4 @@ curl -X GET -u 'admin:admin' -k 'https://localhost:9200/otel-v1-apm-span-000001/

 Navigate to `http://localhost:5601` in a web browser and choose **Trace Analytics**. You can see the results of your single click in the Jaeger HotROD web interface: the number of traces per API and HTTP method, latency trends, a color-coded map of the service architecture, and a list of trace IDs that you can use to drill down on individual operations.

-If you don't see your trace, adjust the timeframe in OpenSearch Dashboards. For more information on using the plugin, see [OpenSearch Dashboards plugin](../ta-opensearch-dashboards/).
+If you don't see your trace, adjust the timeframe in OpenSearch Dashboards. For more information on using the plugin, see [OpenSearch Dashboards plugin]({{site.url}}{{site.baseurl}}/monitoring-plugins/trace/ta-dashboards/).
@@ -4,6 +4,8 @@ title: Trace analytics
 nav_order: 48
 has_children: true
 has_toc: false
+redirect_from:
+  - /monitoring-plugins/trace/
 ---

 # Trace Analytics
@@ -14,4 +16,4 @@ A single operation, such as a user clicking a button, can trigger an extended se

 Trace Analytics can help you visualize this flow of events and identify performance problems.

-![Detailed trace view](../images/ta-trace.png)
+![Detailed trace view]({{site.url}}{{site.baseurl}}/images/ta-trace.png)
@@ -7,16 +7,16 @@ nav_order: 50

 # Trace Analytics OpenSearch Dashboards plugin

-The Trace Analytics plugin for OpenSearch Dashboards provides at-a-glance visibility into your application performance, along with the ability to drill down on individual traces. For installation instructions, see [Standalone OpenSearch Dashboards plugin install](../../opensearch-dashboards/plugins/).
+The Trace Analytics plugin for OpenSearch Dashboards provides at-a-glance visibility into your application performance, along with the ability to drill down on individual traces. For installation instructions, see [Standalone OpenSearch Dashboards plugin install]({{site.url}}{{site.baseurl}}/dashboards/install/plugins/).

 The **Dashboard** view groups traces together by HTTP method and path so that you can see the average latency, error rate, and trends associated with a particular operation. For a more focused view, try filtering by trace group name.

-![Dashboard view](../../images/ta-dashboard.png)
+![Dashboard view]({{site.url}}{{site.baseurl}}/images/ta-dashboard.png)

 To drill down on the traces that make up a trace group, choose the number of traces in righthand column. Then choose an individual trace for a detailed summary.

-![Detailed trace view](../../images/ta-trace.png)
+![Detailed trace view]({{site.url}}{{site.baseurl}}/images/ta-trace.png)

 The **Services** view lists all services in the application, plus an interactive map that shows how the various services connect to each other. In contrast to the dashboard, which helps identify problems by operation, the service map helps identify problems by service. Try sorting by error rate or latency to get a sense of potential problem areas of your application.

-![Service view](../../images/ta-services.png)
+![Service view]({{site.url}}{{site.baseurl}}/images/ta-services.png)
@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Aggregations
-parent: OpenSearch
 nav_order: 13
 has_children: true
 ---
@@ -16,13 +15,13 @@ OpenSearch can perform aggregations on massive datasets in milliseconds. Compare

 ## Aggregations on text fields

-By default, OpenSearch doesn't support aggregations on a text field.
-Because text fields are tokenized, an aggregation on a text field has to reverse the tokenization process back to its original string and then formulate an aggregation based on that. Such an operation consumes significant memory and degrades cluster performance.
+By default, OpenSearch doesn't support aggregations on a text field. Because text fields are tokenized, an aggregation on a text field has to reverse the tokenization process back to its original string and then formulate an aggregation based on that. This kind of an operation consumes significant memory and degrades cluster performance.

 While you can enable aggregations on text fields by setting the `fielddata` parameter to `true` in the mapping, the aggregations are still based on the tokenized words and not on the raw text.

 We recommend keeping a raw version of the text field as a `keyword` field that you can aggregate on.
-In this case, you can perform aggregations on the `title.raw` field, instead of the `title` field:
+
+In this case, you can perform aggregations on the `title.raw` field, instead of on the `title` field:

 ```json
 PUT movies
@@ -61,15 +60,13 @@ GET _search

 If you’re only interested in the aggregation result and not in the results of the query, set `size` to 0.

-In the `aggs` property (you can use `aggregations` if you want), you can define any number of aggregations.
-Each aggregation is defined by its name and one of the types of aggregations that OpenSearch supports.
+In the `aggs` property (you can use `aggregations` if you want), you can define any number of aggregations. Each aggregation is defined by its name and one of the types of aggregations that OpenSearch supports.

-The name of the aggregation helps you to distinguish between different aggregations in the response.
-The `AGG_TYPE` property is where you specify the type of aggregation.
+The name of the aggregation helps you to distinguish between different aggregations in the response. The `AGG_TYPE` property is where you specify the type of aggregation.

 ## Sample aggregation

-This section uses the OpenSearch Dashboards sample e-commerce data and web log data. To add the sample data, log in to OpenSearch Dashboards, choose **Home** and **Try our sample data**. For **Sample eCommerce orders** and **Sample web logs**, choose **Add data**.
+This section uses the OpenSearch Dashboards sample ecommerce data and web log data. To add the sample data, log in to OpenSearch Dashboards, choose **Home**, and then choose **Try our sample data**. For **Sample eCommerce orders** and **Sample web logs**, choose **Add data**.

 ### avg

@@ -129,7 +126,7 @@ There are three main types of aggregations:

 ## Nested aggregations

-Aggregations within aggregations are called nested or sub aggregations.
+Aggregations within aggregations are called nested or subaggregations.

 Metric aggregations produce simple results and can't contain nested aggregations.

@@ -2,16 +2,15 @@
 layout: default
 title: Bucket Aggregations
 parent: Aggregations
-grand_parent: OpenSearch
 nav_order: 2
 has_children: false
 ---

-# Bucket Aggregations
+# Bucket aggregations

 Bucket aggregations categorize sets of documents as buckets. The type of bucket aggregation determines whether a given document falls into a bucket or not.

-You can use bucket aggregations to implement faceted navigation (usually placed as a sidebar on a search result landing page) to help you're users narrow down the results.
+You can use bucket aggregations to implement faceted navigation (usually placed as a sidebar on a search result landing page) to help your users narrow down the results.

 ## terms

@@ -1,7 +1,6 @@
 ---
 layout: default
 title: CAT API
-parent: OpenSearch
 nav_order:  20
 ---

@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Cluster formation
-parent: OpenSearch
 nav_order: 7
 ---

@@ -15,7 +14,7 @@ To create and deploy an OpenSearch cluster according to your requirements, it’

 There are many ways to design a cluster. The following illustration shows a basic architecture:

-![multi-node cluster architecture diagram](../../images/cluster.png)
+![multi-node cluster architecture diagram]({{site.url}}{{site.baseurl}}/images/cluster.png)

 This is a four-node cluster that has one dedicated master node, one dedicated coordinating node, and two data nodes that are master-eligible and also used for ingesting data.

@@ -37,7 +36,7 @@ This page demonstrates how to work with the different node types. It assumes tha

 ## Prerequisites

-Before you get started, you must install and configure OpenSearch on all of your nodes. For information about the available options, see [Install and configure OpenSearch](../../install/).
+Before you get started, you must install and configure OpenSearch on all of your nodes. For information about the available options, see [Install and configure OpenSearch]({{site.url}}{{site.baseurl}}/opensearch/install/).

 After you're done, use SSH to connect to each node, then open the `config/opensearch.yml` file. You can set all configurations for your cluster in this file.

@@ -189,7 +188,7 @@ x.x.x.x           34          38   0    0.12    0.07     0.06 md        -      o
 x.x.x.x           23          38   0    0.12    0.07     0.06 md        -      opensearch-c1
 ```

-To better understand and monitor your cluster, use the [cat API](../catapis/).
+To better understand and monitor your cluster, use the [cat API]({{site.url}}{{site.baseurl}}/opensearch/catapis/).


 ## (Advanced) Step 6: Configure shard allocation awareness or forced awareness
@@ -323,9 +322,9 @@ old_index 0     r      UNASSIGNED

 In this case, all primary shards are allocated to `opensearch-d2`. Again, all replica shards are unassigned because we only have one warm node.

-A popular approach is to configure your [index templates](../index-templates/) to set the `index.routing.allocation.require.temp` value to `hot`. This way, OpenSearch stores your most recent data on your hot nodes.
+A popular approach is to configure your [index templates]({{site.url}}{{site.baseurl}}/opensearch/index-templates/) to set the `index.routing.allocation.require.temp` value to `hot`. This way, OpenSearch stores your most recent data on your hot nodes.

-You can then use the [Index State Management (ISM)](../../ism/index/) plugin to periodically check the age of an index and specify actions to take on it. For example, when the index reaches a specific age, change the `index.routing.allocation.require.temp` setting to `warm` to automatically move your data from hot nodes to warm nodes.
+You can then use the [Index State Management (ISM)]({{site.url}}{{site.baseurl}}/im-plugin/) plugin to periodically check the age of an index and specify actions to take on it. For example, when the index reaches a specific age, change the `index.routing.allocation.require.temp` setting to `warm` to automatically move your data from hot nodes to warm nodes.


 ## Next steps
@@ -333,7 +332,7 @@ You can then use the [Index State Management (ISM)](../../ism/index/) plugin to
 If you are using the security plugin, the previous request to `_cat/nodes?v` might have failed with an initialization error. To initialize the plugin, run `opensearch/plugins/opensearch-security/tools/securityadmin.sh`. A sample command that uses the demo certificates might look like this:

 ```bash
-sudo ./securityadmin.sh -cd ../securityconfig/ -icl -nhnv -cacert /etc/opensearch/root-ca.pem -cert /etc/opensearch/kirk.pem -key /etc/opensearch/kirk-key.pem -h <private-ip>
+sudo ./securityadmin.sh -cd {{site.url}}{{site.baseurl}}/securityconfig/ -icl -nhnv -cacert /etc/opensearch/root-ca.pem -cert /etc/opensearch/kirk.pem -key /etc/opensearch/kirk-key.pem -h <private-ip>
 ```

-For full guidance around configuration options, see [Security configuration](../../security/configuration).
+For full guidance around configuration options, see [Security configuration]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/).
@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Common REST Parameters
-parent: OpenSearch
 nav_order: 93
 ---

@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Configuration
-parent: OpenSearch
 nav_order: 5
 ---

@@ -66,4 +65,4 @@ PUT /_cluster/settings

 You can find `opensearch.yml` in `/usr/share/opensearch/config/opensearch.yml` (Docker) or `/etc/opensearch/opensearch.yml` (RPM and DEB) on each node.

-The demo configuration includes a number of settings for the security plugin that you should modify before using OpenSearch for a production workload. To learn more, see [Security](../../security/).
+The demo configuration includes a number of settings for the security plugin that you should modify before using OpenSearch for a production workload. To learn more, see [Security]({{site.url}}{{site.baseurl}}/security-plugin/).
@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Index aliases
-parent: OpenSearch
 nav_order: 12
 ---

@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Index data
-parent: OpenSearch
 nav_order: 10
 ---

@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Index templates
-parent: OpenSearch
 nav_order: 14
 ---

@@ -1,18 +1,20 @@
 ---
 layout: default
-title: OpenSearch
-nav_order: 10
-has_children: true
+title: About OpenSearch
+nav_order: 1
+has_children: false
 has_toc: false
+redirect_from:
+  - /opensearch/
 ---

 # Introduction to OpenSearch

 OpenSearch is a distributed search and analytics engine based on [Apache Lucene](https://lucene.apache.org/). After adding your data to OpenSearch, you can perform full-text searches on it with all of the features you might expect: search by field, search multiple indices, boost fields, rank results by score, sort results by field, and aggregate results.

-Unsurprisingly, people often use OpenSearch as the backend for a search application---think [Wikipedia](https://en.wikipedia.org/wiki/Wikipedia:FAQ/Technical#What_software_is_used_to_run_Wikipedia?) or an online store. It offers excellent performance and can scale up and down as the needs of the application grow or shrink.
+Unsurprisingly, people often use search engines like OpenSearch as the backend for a search application---think [Wikipedia](https://en.wikipedia.org/wiki/Wikipedia:FAQ/Technical#What_software_is_used_to_run_Wikipedia?) or an online store. It offers excellent performance and can scale up and down as the needs of the application grow or shrink.

-An equally popular, but less obvious use case is log analytics, in which you take the logs from an application, feed them into OpenSearch, and use the rich search and visualization functionality to identify issues. For example, a malfunctioning web server might throw a 500 error 0.5% of the time, which can be hard to notice unless you have a real-time graph of all HTTP status codes that the server has thrown in the past four hours. You can use [OpenSearch Dashboards](../opensearch-dashboards/) to build these sorts of visualizations from data in OpenSearch.
+An equally popular, but less obvious use case is log analytics, in which you take the logs from an application, feed them into OpenSearch, and use the rich search and visualization functionality to identify issues. For example, a malfunctioning web server might throw a 500 error 0.5% of the time, which can be hard to notice unless you have a real-time graph of all HTTP status codes that the server has thrown in the past four hours. You can use [OpenSearch Dashboards]({{site.url}}{{site.baseurl}}/dashboards/) to build these sorts of visualizations from data in OpenSearch.


 ## Clusters and nodes
@@ -21,7 +23,7 @@ Its distributed design means that you interact with OpenSearch *clusters*. Each

 You can run OpenSearch locally on a laptop---its system requirements are minimal---but you can also scale a single cluster to hundreds of powerful machines in a data center.

-In a single node cluster, such as a laptop, one machine has to do everything: manage the state of the cluster, index and search data, and perform any preprocessing of data prior to indexing it. As a cluster grows, however, you can subdivide responsibilities. Nodes with fast disks and plenty of RAM might be great at indexing and searching data, whereas a node with plenty of CPU power and a tiny disk could manage cluster state. For more information on setting node types, see [Cluster formation](cluster/).
+In a single node cluster, such as a laptop, one machine has to do everything: manage the state of the cluster, index and search data, and perform any preprocessing of data prior to indexing it. As a cluster grows, however, you can subdivide responsibilities. Nodes with fast disks and plenty of RAM might be great at indexing and searching data, whereas a node with plenty of CPU power and a tiny disk could manage cluster state. For more information on setting node types, see [Cluster formation]({{site.url}}{{site.baseurl}}/opensearch/cluster/).


 ## Indices and documents
@@ -2,7 +2,6 @@
 layout: default
 title: Docker security configuration
 parent: Install OpenSearch
-grand_parent: OpenSearch
 nav_order: 5
 ---

@@ -26,7 +25,7 @@ services:
      - discovery.seed_hosts=opensearch-node1,opensearch-node2
      - cluster.initial_master_nodes=opensearch-node1,opensearch-node2
      - bootstrap.memory_lock=true # along with the memlock settings below, disables swapping
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m" # minimum and maximum Java heap size, recommend setting both to 50% of system RAM
+      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" # minimum and maximum Java heap size, recommend setting both to 50% of system RAM
      - network.host=0.0.0.0 # required if not using the demo security configuration
    ulimits:
      memlock:
@@ -62,7 +61,7 @@ services:
      - discovery.seed_hosts=opensearch-node1,opensearch-node2
      - cluster.initial_master_nodes=opensearch-node1,opensearch-node2
      - bootstrap.memory_lock=true
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
      - network.host=0.0.0.0
    ulimits:
      memlock:
@@ -109,32 +108,32 @@ networks:
  opensearch-net:
 ```

-Then make your changes to `opensearch.yml`. For a full list of settings, see [Security](../../../security/configuration/). This example adds (extremely) verbose audit logging:
+Then make your changes to `opensearch.yml`. For a full list of settings, see [Security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/). This example adds (extremely) verbose audit logging:

 ```yml
-opensearch_security.ssl.transport.pemcert_filepath: node.pem
-opensearch_security.ssl.transport.pemkey_filepath: node-key.pem
-opensearch_security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
-opensearch_security.ssl.transport.enforce_hostname_verification: false
-opensearch_security.ssl.http.enabled: true
-opensearch_security.ssl.http.pemcert_filepath: node.pem
-opensearch_security.ssl.http.pemkey_filepath: node-key.pem
-opensearch_security.ssl.http.pemtrustedcas_filepath: root-ca.pem
-opensearch_security.allow_default_init_securityindex: true
-opensearch_security.authcz.admin_dn:
+plugins.security.ssl.transport.pemcert_filepath: node.pem
+plugins.security.ssl.transport.pemkey_filepath: node-key.pem
+plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
+plugins.security.ssl.transport.enforce_hostname_verification: false
+plugins.security.ssl.http.enabled: true
+plugins.security.ssl.http.pemcert_filepath: node.pem
+plugins.security.ssl.http.pemkey_filepath: node-key.pem
+plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
+plugins.security.allow_default_init_securityindex: true
+plugins.security.authcz.admin_dn:
  - CN=A,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA
-opensearch_security.nodes_dn:
+plugins.security.nodes_dn:
  - 'CN=N,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
-opensearch_security.audit.type: internal_opensearch
-opensearch_security.enable_snapshot_restore_privilege: true
-opensearch_security.check_snapshot_restore_write_privileges: true
-opensearch_security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
+plugins.security.audit.type: internal_opensearch
+plugins.security.enable_snapshot_restore_privilege: true
+plugins.security.check_snapshot_restore_write_privileges: true
+plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
 cluster.routing.allocation.disk.threshold_enabled: false
-opensearch_security.audit.config.disabled_rest_categories: NONE
-opensearch_security.audit.config.disabled_transport_categories: NONE
+plugins.security.audit.config.disabled_rest_categories: NONE
+plugins.security.audit.config.disabled_transport_categories: NONE
 ```

-Use this same override process to specify new [authentication settings](../../../security/configuration/configuration/) in `/usr/share/opensearch/plugins/opensearch-security/securityconfig/config.yml`, as well as new default [internal users, roles, mappings, action groups, and tenants](../../../security/configuration/yaml/).
+Use this same override process to specify new [authentication settings]({{site.url}}{{site.baseurl}}/security-plugin/configuration/configuration/) in `/usr/share/opensearch/plugins/opensearch-security/securityconfig/config.yml`, as well as new default [internal users, roles, mappings, action groups, and tenants]({{site.url}}{{site.baseurl}}/security-plugin/configuration/yaml/).

 To start the cluster, run `docker-compose up`.

@@ -163,16 +162,16 @@ volumes:
 - ./custom-opensearch.yml: /full/path/to/custom-opensearch.yml
 ```

-Remember that the certificates you specify in your Docker Compose file must be the same as the certificates listed in your custom `opensearch.yml` file. At a minimum, you should replace the root, admin, and node certificates with your own. For more information about adding and using certificates, see [Configure TLS certificates](../security/configuration/tls.md).
+Remember that the certificates you specify in your Docker Compose file must be the same as the certificates listed in your custom `opensearch.yml` file. At a minimum, you should replace the root, admin, and node certificates with your own. For more information about adding and using certificates, see [Configure TLS certificates]({{site.url}}{{site.baseurl}}/security-plugin/configuration/tls).

 ```yml
-opensearch_security.ssl.transport.pemcert_filepath: new-node-cert.pem
-opensearch_security.ssl.transport.pemkey_filepath: new-node-cert-key.pem
-opensearch_security.ssl.transport.pemtrustedcas_filepath: new-root-ca.pem
-opensearch_security.ssl.http.pemcert_filepath: new-node-cert.pem
-opensearch_security.ssl.http.pemkey_filepath: new-node-cert-key.pem
-opensearch_security.ssl.http.pemtrustedcas_filepath: new-root-ca.pem
-opensearch_security.authcz.admin_dn:
+plugins.security.ssl.transport.pemcert_filepath: new-node-cert.pem
+plugins.security.ssl.transport.pemkey_filepath: new-node-cert-key.pem
+plugins.security.ssl.transport.pemtrustedcas_filepath: new-root-ca.pem
+plugins.security.ssl.http.pemcert_filepath: new-node-cert.pem
+plugins.security.ssl.http.pemkey_filepath: new-node-cert-key.pem
+plugins.security.ssl.http.pemtrustedcas_filepath: new-root-ca.pem
+plugins.security.authcz.admin_dn:
  - CN=admin,OU=SSL,O=Test,L=Test,C=DE
 ```

@@ -2,7 +2,6 @@
 layout: default
 title: Docker
 parent: Install OpenSearch
-grand_parent: OpenSearch
 nav_order: 1
 ---

@@ -15,7 +14,7 @@ docker pull opensearchproject/opensearch:{{site.opensearch_version}}
 docker pull opensearchproject/opensearch-dashboards:{{site.opensearch_version}}
 ```

-To check available versions, see [Docker Hub](https://hub.docker.com/u/opensearch).
+To check available versions, see [Docker Hub](https://hub.docker.com/u/opensearchproject).

 OpenSearch images use `centos:7` as the base image. If you run Docker locally, we recommend allowing Docker to use at least 4 GB of RAM in **Preferences** > **Resources**.

@@ -95,7 +94,7 @@ services:
      - discovery.seed_hosts=opensearch-node1,opensearch-node2
      - cluster.initial_master_nodes=opensearch-node1,opensearch-node2
      - bootstrap.memory_lock=true # along with the memlock settings below, disables swapping
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m" # minimum and maximum Java heap size, recommend setting both to 50% of system RAM
+      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" # minimum and maximum Java heap size, recommend setting both to 50% of system RAM
    ulimits:
      memlock:
        soft: -1
@@ -119,7 +118,7 @@ services:
      - discovery.seed_hosts=opensearch-node1,opensearch-node2
      - cluster.initial_master_nodes=opensearch-node1,opensearch-node2
      - bootstrap.memory_lock=true
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
@@ -149,7 +148,6 @@ volumes:

 networks:
  opensearch-net:
-
 ```

 If you override `opensearch_dashboards.yml` settings using environment variables, as seen above, use all uppercase letters and periods in place of underscores (e.g. for `opensearch.url`, specify `OPENSEARCH_URL`).
@@ -158,7 +156,7 @@ If you override `opensearch_dashboards.yml` settings using environment variables

 ## Configure OpenSearch

-You can pass a custom `opensearch.yml` file to the Docker container using the [`-v` flag](https://docs.docker.com/engine/reference/commandline/run/#mount-volume--v---read-only) for `docker run`:
+You can pass a custom `opensearch.yml` file to the Docker container using the [`-v` flag](https://docs.docker.com/engine/reference/commandline/run#mount-volume--v---read-only) for `docker run`:

 ```bash
 docker run \
@@ -185,7 +183,7 @@ services:
      - ./custom-opensearch_dashboards.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
 ```

-You can also configure `docker-compose.yml` and `opensearch.yml` [to take your own certificates](../docker-security/) for use with the [Security](../../security/configuration/) plugin.
+You can also configure `docker-compose.yml` and `opensearch.yml` [to take your own certificates]({{site.url}}{{site.baseurl}}/opensearch/install/docker-security/) for use with the [Security]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/) plugin.


 ### (Optional) Set up Performance Analyzer
@@ -193,25 +191,25 @@ You can also configure `docker-compose.yml` and `opensearch.yml` [to take your o
 1. Enable the Performance Analyzer plugin:

   ```bash
-   curl -XPOST localhost:9200/_opensearch/_performanceanalyzer/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}'
+   curl -XPOST localhost:9200/_plugins/_performanceanalyzer/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}'
   ```

   If you receive the `curl: (52) Empty reply from server` error, you are likely protecting your cluster with the security plugin and you need to provide credentials. Modify the following command to use your username and password:

   ```bash
-   curl -XPOST https://localhost:9200/_opensearch/_performanceanalyzer/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}' -u 'admin:admin' -k
+   curl -XPOST https://localhost:9200/_plugins/_performanceanalyzer/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}' -u 'admin:admin' -k
   ```

 1. Enable the Root Cause Analyzer (RCA) framework

   ```bash
-   curl -XPOST localhost:9200/_opensearch/_performanceanalyzer/rca/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}'
+   curl -XPOST localhost:9200/_plugins/_performanceanalyzer/rca/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}'
   ```

   Similar to step 1, if you run into `curl: (52) Empty reply from server`, run the command below to enable RCA

   ```bash
-   curl -XPOST https://localhost:9200/_opensearch/_performanceanalyzer/rca/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}' -u 'admin:admin' -k
+   curl -XPOST https://localhost:9200/_plugins/_performanceanalyzer/rca/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}' -u 'admin:admin' -k
   ```

 1. By default, Performance Analyzer's endpoints are not accessible from outside the Docker container.
@@ -300,7 +298,7 @@ docker build --tag=opensearch-custom-plugin .
 docker run -p 9200:9200 -p 9600:9600 -v /usr/share/opensearch/data opensearch-custom-plugin
 ```

-You can also use a `Dockerfile` to pass your own certificates for use with the [Security](../../../security/) plugin, similar to the `-v` argument in [Configure OpenSearch](#configure-opensearch):
+You can also use a `Dockerfile` to pass your own certificates for use with the [security]({{site.url}}{{site.baseurl}}/security-plugin/) plugin, similar to the `-v` argument in [Configure OpenSearch](#configure-opensearch):

 ```
 FROM opensearchproject/opensearch:{{site.opensearch_version}}
@@ -314,11 +312,11 @@ Alternately, you might want to remove a plugin. This `Dockerfile` removes the se

 ```
 FROM opensearchproject/opensearch:{{site.opensearch_version}}
-RUN /usr/share/opensearch/bin/opensearch-plugin remove opensearch_security
+RUN /usr/share/opensearch/bin/opensearch-plugin remove opensearch-security
 COPY --chown=opensearch:opensearch opensearch.yml /usr/share/opensearch/config/
 ```

-In this case, `opensearch.yml` is a "vanilla" version of the file with no OpenSearch entries. It might look like this:
+In this case, `opensearch.yml` is a "vanilla" version of the file with no plugin entries. It might look like this:

 ```yml
 cluster.name: "docker-cluster"
@@ -2,7 +2,6 @@
 layout: default
 title: Important settings
 parent: Install OpenSearch
-grand_parent: OpenSearch
 nav_order: 70
 ---

@@ -22,13 +21,13 @@ vm.max_map_count=262144

 Then run `sudo sysctl -p` to reload.

-The [sample docker-compose.yml](../docker/#sample-docker-compose-file) file also contains several key settings:
+The [sample docker-compose.yml]({{site.url}}{{site.baseurl}}/opensearch/install/docker#sample-docker-compose-file) file also contains several key settings:

 - `bootstrap.memory_lock=true`

  Disbles swapping (along with `memlock`). Swapping can dramatically decrease performance and stability, so you should ensure it is disabled on production clusters.

- `ES_JAVA_OPTS=-Xms512m -Xmx512m`
+- `OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m`

  Sets the size of the Java heap (we recommend half of system RAM).

@@ -1,9 +1,10 @@
 ---
 layout: default
 title: Install OpenSearch
-nav_order: 1
-parent: OpenSearch
-redirect_from: /docs/install/
+nav_order: 2
+redirect_from:
+  - /docs/install/
+  - /opensearch/install/
 has_children: true
 ---

@@ -2,7 +2,6 @@
 layout: default
 title: OpenSearch plugins
 parent: Install OpenSearch
-grand_parent: OpenSearch
 nav_order: 90
 ---

@@ -30,6 +29,23 @@ If you don't want to use the all-in-one OpenSearch installation options, you can
    </tr>
  </thead>
  <tbody>
+  <tr>
+    <td>1.0.0-rc1</td>
+    <td>
+      <pre>opensearch-alerting             1.0.0.0-rc1
+opensearch-anomaly-detection    1.0.0.0-rc1
+opensearch-asynchronous-search  1.0.0.0-rc1
+opensearch-index-management     1.0.0.0-rc1
+opensearch-job-scheduler        1.0.0.0-rc1
+opensearch-knn                  1.0.0.0-rc1
+opensearch-notebooks            1.0.0.0-rc1
+opensearch-performance-analyzer 1.0.0.0-rc1
+opensearch-reports-scheduler    1.0.0.0-rc1
+opensearch-security             1.0.0.0-rc1
+opensearch-sql                  1.0.0.0-rc1
+</pre>
+    </td>
+  </tr>
  <tr>
    <td>1.0.0-beta1</td>
    <td>
@@ -65,7 +81,7 @@ Then you can specify the version that you need:
 sudo yum install opensearch-oss-6.7.1
 ```

-{% endcomment %}
+


 ## Install plugins
@@ -79,9 +95,9 @@ Navigate to the OpenSearch home directory (most likely, it is `/usr/share/opense
 sudo bin/opensearch-plugin install https://d3g5vo6xdbdb9a.cloudfront.net/downloads/opensearch-plugins/opensearch-security/opensearch-security-{{site.opensearch_major_minor_version}}.1.0.zip
 ```

-After installing the security plugin, you can run `sudo sh /usr/share/opensearch/plugins/opensearch-security/tools/install_demo_configuration.sh` to quickly get started with demo certificates. Otherwise, you must configure it manually and run [securityadmin.sh](../../../security/configuration/security-admin/).
+After installing the security plugin, you can run `sudo sh /usr/share/opensearch/plugins/opensearch-security/tools/install_demo_configuration.sh` to quickly get started with demo certificates. Otherwise, you must configure it manually and run [securityadmin.sh]({{site.url}}{{site.baseurl}}/security-plugin/configuration/security-admin/).

-The security plugin has a corresponding [OpenSearch Dashboards plugin](../../../opensearch-dashboards/install/plugins) that you probably want to install as well.
+The security plugin has a corresponding [OpenSearch Dashboards plugin]({{site.url}}{{site.baseurl}}/opensearch-dashboards/install/plugins) that you probably want to install as well.


 ### Job scheduler
@@ -97,7 +113,7 @@ sudo bin/opensearch-plugin install https://d3g5vo6xdbdb9a.cloudfront.net/downloa
 sudo bin/opensearch-plugin install https://d3g5vo6xdbdb9a.cloudfront.net/downloads/opensearch-plugins/opensearch-alerting/opensearch-alerting-{{site.opensearch_major_minor_version}}.1.0.zip
 ```

-To install Alerting, you must first install the Job Scheduler plugin. Alerting has a corresponding [OpenSearch Dashboards plugin](../../../opensearch-dashboards/install/plugins/) that you probably want to install as well.
+To install Alerting, you must first install the Job Scheduler plugin. Alerting has a corresponding [OpenSearch Dashboards plugin]({{site.url}}{{site.baseurl}}/opensearch-dashboards/install/plugins/) that you probably want to install as well.


 ### SQL
@@ -120,7 +136,7 @@ sudo bin/opensearch-plugin install https://d3g5vo6xdbdb9a.cloudfront.net/downloa
 sudo bin/opensearch-plugin install https://d3g5vo6xdbdb9a.cloudfront.net/downloads/opensearch-plugins/opensearch-index-management/opensearch-index-management-{{site.opensearch_major_minor_version}}.2.0.zip
 ```

-To install Index State Management, you must first install the Job Scheduler plugin. ISM has a corresponding [OpenSearch Dashboards plugin](../../../opensearch-dashboards/install/plugins/) that you probably want to install as well.
+To install Index State Management, you must first install the Job Scheduler plugin. ISM has a corresponding [OpenSearch Dashboards plugin]({{site.url}}{{site.baseurl}}/opensearch-dashboards/install/plugins/) that you probably want to install as well.


 ### k-NN
@@ -227,9 +243,9 @@ Performance Analyzer requires some manual configuration after installing the plu
 1. Send a test request:

   ```bash
-   curl -XGET "localhost:9600/_opensearch/_performanceanalyzer/metrics?metrics=Latency,CPU_Utilization&agg=avg,max&dim=ShardID&nodes=all"
+   curl -XGET "localhost:9600/_plugins/_performanceanalyzer/metrics?metrics=Latency,CPU_Utilization&agg=avg,max&dim=ShardID&nodes=all"
   ```
-
+{% endcomment %}

 ## List installed plugins

@@ -2,7 +2,6 @@
 layout: default
 title: Tarball
 parent: Install OpenSearch
-grand_parent: OpenSearch
 nav_order: 50
 ---

@@ -46,7 +45,7 @@ You can modify `config/opensearch.yml` or specify environment variables as argum
 ./opensearch-tar-install.sh -Ecluster.name=opensearch-cluster -Enode.name=opensearch-node1 -Ehttp.host=0.0.0.0 -Ediscovery.type=single-node
 ```

-For other settings, see [Important settings](../important-settings/).
+For other settings, see [Important settings]({{site.url}}{{site.baseurl}}/opensearch/install/important-settings/).


 ### (Optional) Set up Performance Analyzer
@@ -118,31 +117,31 @@ In a tarball installation, Performance Analyzer collects data when it is enabled
 1. In a separate window, enable the Performance Analyzer plugin:

   ```bash
-   curl -XPOST localhost:9200/_opensearch/_performanceanalyzer/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}'
+   curl -XPOST localhost:9200/_plugins/_performanceanalyzer/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}'
   ```

   If you receive the `curl: (52) Empty reply from server` error, you are likely protecting your cluster with the security plugin and you need to provide credentials. Modify the following command to use your username and password:

   ```bash
-   curl -XPOST https://localhost:9200/_opensearch/_performanceanalyzer/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}' -u 'admin:admin' -k
+   curl -XPOST https://localhost:9200/_plugins/_performanceanalyzer/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}' -u 'admin:admin' -k
   ```

 1. Finally, enable the Root Cause Analyzer (RCA) framework

   ```bash
-   curl -XPOST localhost:9200/_opensearch/_performanceanalyzer/rca/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}'
+   curl -XPOST localhost:9200/_plugins/_performanceanalyzer/rca/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}'
   ```

   Similar to step 4, if you run into `curl: (52) Empty reply from server`, run the command below to enable RCA

   ```bash
-   curl -XPOST https://localhost:9200/_opensearch/_performanceanalyzer/rca/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}' -u 'admin:admin' -k
+   curl -XPOST https://localhost:9200/_plugins/_performanceanalyzer/rca/cluster/config -H 'Content-Type: application/json' -d '{"enabled": true}' -u 'admin:admin' -k
   ```

 {% comment %}

 ### (Optional) Removing Performance Analyzer

-See [Clean up Performance Analyzer files](../plugins/#optional-clean-up-performance-analyzer-files).
+See [Clean up Performance Analyzer files]({{site.url}}{{site.baseurl}}/plugins#optional-clean-up-performance-analyzer-files).

 {% endcomment %}
@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Logs
-parent: OpenSearch
 nav_order: 60
 ---

@@ -2,12 +2,11 @@
 layout: default
 title: Metric Aggregations
 parent: Aggregations
-grand_parent: OpenSearch
 nav_order: 1
 has_children: false
 ---

-# Metric Aggregations
+# Metric aggregations

 Metric aggregations let you perform simple calculations such as finding the minimum, maximum, and average values of a field.

@@ -2,12 +2,11 @@
 layout: default
 title: Pipeline Aggregations
 parent: Aggregations
-grand_parent: OpenSearch
 nav_order: 4
 has_children: false
 ---

-# Pipeline Aggregations
+# Pipeline aggregations

 With pipeline aggregations, you can chain aggregations by piping the results of one aggregation as an input to another for a more nuanced output.

@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Popular APIs
-parent: OpenSearch
 nav_order: 96
 ---

@@ -1,8 +1,9 @@
 ---
 layout: default
 title: Boolean queries
-parent: OpenSearch
+parent: Query DSL
 nav_order: 45
+redirect_from: /docs/opensearch/bool/
 ---

 # Boolean queries
@@ -1,14 +1,15 @@
 ---
 layout: default
 title: Full-text queries
-parent: OpenSearch
+parent: Query DSL
 nav_order: 40
+redirect_from:
+  - /docs/opensearch/full-text/
+  - /opensearch/full-text/
 ---

 # Full-text queries

-Although you can use HTTP request parameters to perform simple searches, the OpenSearch query domain-specific language (DSL) lets you specify the full range of search options. The query DSL uses the HTTP request body. Queries specified in this way have the added advantage of being more explicit in their intent and easier to tune over time.
-
 This page lists all full-text query types and common options. Given the sheer number of options and subtle behaviors, the best method of ensuring useful search results is to test different queries against representative indices and verify the output.


@@ -0,0 +1,122 @@
+---
+layout: default
+title: Query DSL
+nav_order: 27
+has_children: true
+redirect_from:
+  - /opensearch/query-dsl/
+---
+
+# Query DSL
+
+While you can use HTTP request parameters to perform simple searches, you can also use the OpenSearch query domain-specific language (DSL), which provides a wider range of search options. The query DSL uses the HTTP request body, so you can more easily customize your queries to get the exact results that you want.
+
+For example, the following request performs a simple search to search for a `speaker` field that has a value of `queen`.
+
+**Sample request**
+```json
+GET _search?q=speaker:queen
+```
+
+**Sample response**
+```
+{
+  "took": 87,
+  "timed_out": false,
+  "_shards": {
+  "total": 68,
+  "successful": 68,
+  "skipped": 0,
+  "failed": 0
+  },
+  "hits": {
+  "total": {
+    "value": 4080,
+    "relation": "eq"
+  },
+  "max_score": 4.4368687,
+  "hits": [
+    {
+    "_index": "new_shakespeare",
+    "_type": "_doc",
+    "_id": "28559",
+    "_score": 4.4368687,
+    "_source": {
+      "type": "line",
+      "line_id": 28560,
+      "play_name": "Cymbeline",
+      "speech_number": 20,
+      "line_number": "1.1.81",
+      "speaker": "QUEEN",
+      "text_entry": "No, be assured you shall not find me, daughter,"
+    }
+    }
+```
+
+With query DSL, however, you can include an HTTP request body to look for results more tailored to your needs. The following example shows how to search for `speaker` and `text_entry` fields that have a value of `QUEEN`.
+
+**Sample request**
+```json
+{
+  "query": {
+  "multi_match": {
+    "query": "QUEEN",
+    "fields": ["speaker", "text_entry"]
+    }
+  }
+}
+```
+
+**Sample Response**
+```json
+{
+  "took": 39,
+  "timed_out": false,
+  "_shards": {
+    "total": 68,
+    "successful": 68,
+    "skipped": 0,
+    "failed": 0
+  },
+  "hits": {
+    "total": {
+      "value": 5837,
+      "relation": "eq"
+    },
+    "max_score": 7.8623476,
+    "hits": [
+      {
+        "_index": "new_shakespeare",
+        "_type": "_doc",
+        "_id": "100763",
+        "_score": 7.8623476,
+        "_source": {
+          "type": "line",
+          "line_id": 100764,
+          "play_name": "Troilus and Cressida",
+          "speech_number": 43,
+          "line_number": "3.1.68",
+          "speaker": "PANDARUS",
+          "text_entry": "Sweet queen, sweet queen! thats a sweet queen, i faith."
+        }
+      },
+      {
+        "_index": "shakespeare",
+        "_type": "_doc",
+        "_id": "28559",
+        "_score": 5.8923807,
+        "_source": {
+          "type": "line",
+          "line_id": 28560,
+          "play_name": "Cymbeline",
+          "speech_number": 20,
+          "line_number": "1.1.81",
+          "speaker": "QUEEN",
+          "text_entry": "No, be assured you shall not find me, daughter,"
+        }
+      }
+    ]
+  }
+}
+```
+The OpenSearch query DSL comes in three varieties: term-level queries, full-text queries, and boolean queries. You can even perform more complicated searches by using different elements from each variety to find whatever data you need.
@@ -1,8 +1,9 @@
 ---
 layout: default
 title: Term-level queries
-parent: OpenSearch
+parent: Query DSL
 nav_order: 30
+redirect_from: /docs/opensearch/term/
 ---

 # Term-level queries
@@ -144,7 +145,7 @@ The search query “To be, or not to be” is analyzed and tokenized into an arr
 ...
 ```

-For a list of all full-text queries, see [Full-text queries](../full-text/).
+For a list of all full-text queries, see [Full-text queries]({{site.url}}{{site.baseurl}}/opensearch/full-text/).

 If you want to query for an exact term like “HAMLET” in the speaker field and don't need the results to be sorted by relevance scores, a term-level query is more efficient:

@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Reindex data
-parent: OpenSearch
 nav_order: 16
 ---

@@ -113,7 +112,7 @@ POST _reindex
 }
 ```

-For a list of all query operations, see [Full-text queries](../full-text/).
+For a list of all query operations, see [Full-text queries]({{site.url}}{{site.baseurl}}/opensearch/query-dsl/full-text/).

 ## Combine one or more indices

@@ -0,0 +1,169 @@
+---
+layout: default
+title: Bulk
+parent: REST API reference
+nav_order: 15
+---
+
+# Bulk
+
+The bulk operation lets you add, update, or delete many documents in a single request. Compared to individual OpenSearch indexing requests, the bulk operation has significant performance benefits. Whenever practical, we recommend batching indexing operations into bulk requests.
+
+
+## Example
+
+```json
+POST _bulk
+{ "delete": { "_index": "movies", "_id": "tt2229499" } }
+{ "index": { "_index": "movies", "_id": "tt1979320" } }
+{ "title": "Rush", "year": 2013 }
+{ "create": { "_index": "movies", "_id": "tt1392214" } }
+{ "title": "Prisoners", "year": 2013 }
+{ "update": { "_index": "movies", "_id": "tt0816711" } }
+{ "doc" : { "title": "World War Z" } }
+
+```
+
+
+## Path and HTTP methods
+
+```
+POST _bulk
+POST {index}/_bulk
+```
+
+Specifying the index in the path means you don't need to include it in the [request body](#request-body).
+
+OpenSearch also accepts PUT requests to the `_bulk` path, but we highly recommend using POST. The accepted usage of PUT---adding or replacing a single resource at a given path---doesn't make sense for bulk requests.
+{: .note }
+
+
+## URL parameters
+
+All bulk URL parameters are optional.
+
+Parameter | Type | Description
+:--- | :--- | :---
+pipeline | String | The pipeline ID for preprocessing documents.
+refresh | Enum | Whether to refresh the affected shards after performing the indexing operations. Default is `false`. `true` makes the changes show up in search results immediately, but hurts cluster performance. `wait_for` waits for a refresh. Requests take longer to return, but cluster performance doesn't suffer.
+require_alias | Boolean | Set to `true` to require that all actions target an index alias rather than an index. Default is `false`.
+routing | String | Routes the request to the specified shard.
+timeout | Time | How long to wait for the request to return. Default `1m`.
+type | String | (Deprecated) The default document type for documents that don't specify a type. Default is `_doc`. We highly recommend ignoring this parameter and using a type of `_doc` for all indices.
+wait_for_active_shards | String | Specifies the number of active shards that must be available before OpenSearch processes the bulk request. Default is 1 (only the primary shard). Set to `all` or a positive integer. Values greater than 1 require replicas. For example, if you specify a value of 3, the index must have two replicas distributed across two additional nodes for the request to succeed.
+{% comment %}_source | List | asdf
+_source_excludes | list | asdf
+_source_includes | list | asdf{% endcomment %}
+
+
+## Request body
+
+The bulk request body follows this pattern:
+
+```
+Action and metadata\n
+Optional document\n
+Action and metadata\n
+Optional document\n
+
+```
+
+The optional JSON document doesn't need to be minified---spaces are fine---but it does need to be on a single line. OpenSearch uses newline characters to parse bulk requests and requires that the request body end with a newline character.
+
+All actions support the same metadata: `_index`, `_id`, and `_require_alias`. If you don't provide an ID, OpenSearch generates one automatically, which can make it challenging to update the document at a later time.
+
+- Create
+
+  Creates a document if it doesn't already exist and returns an error otherwise. The next line must include a JSON document.
+
+  ```json
+  { "create": { "_index": "movies", "_id": "tt1392214" } }
+  { "title": "Prisoners", "year": 2013 }
+  ```
+
+- Delete
+
+  This action deletes a document if it exists. If the document doesn't exist, OpenSearch doesn't return an error, but instead returns `not_found` under `result`. Delete actions don't require documents on the next line.
+
+  ```json
+  { "delete": { "_index": "movies", "_id": "tt2229499" } }
+  ```
+
+- Index
+
+  Index actions create a document if it doesn't yet exist and replace the document if it already exists. The next line must include a JSON document.
+
+  ```json
+  { "index": { "_index": "movies", "_id": "tt1979320" } }
+  { "title": "Rush", "year": 2013}
+  ```
+
+- Update
+
+  This action updates existing documents and returns an error if the document doesn't exist. The next line must include a full or partial JSON document, depending on how much of the document you want to update. It can also include a script or upsert for more complex document updates.
+
+  ```json
+  { "update": { "_index": "movies", "_id": "tt0816711" } }
+  { "doc" : { "title": "World War Z" } }
+  ```
+
+
+## Response
+
+In the response, pay particular attention to the top-level `errors` boolean. If true, you can iterate over the individual actions for more detailed information.
+
+```json
+{
+  "took": 11,
+  "errors": true,
+  "items": [
+    {
+      "index": {
+        "_index": "movies",
+        "_type": "_doc",
+        "_id": "tt1979320",
+        "_version": 1,
+        "result": "created",
+        "_shards": {
+          "total": 2,
+          "successful": 1,
+          "failed": 0
+        },
+        "_seq_no": 1,
+        "_primary_term": 1,
+        "status": 201
+      }
+    },
+    {
+      "create": {
+        "_index": "movies",
+        "_type": "_doc",
+        "_id": "tt1392214",
+        "status": 409,
+        "error": {
+          "type": "version_conflict_engine_exception",
+          "reason": "[tt1392214]: version conflict, document already exists (current version [1])",
+          "index": "movies",
+          "shard": "0",
+          "index_uuid": "yhizhusbSWmP0G7OJnmcLg"
+        }
+      }
+    },
+    {
+      "update": {
+        "_index": "movies",
+        "_type": "_doc",
+        "_id": "tt0816711",
+        "status": 404,
+        "error": {
+          "type": "document_missing_exception",
+          "reason": "[_doc][tt0816711]: document missing",
+          "index": "movies",
+          "shard": "0",
+          "index_uuid": "yhizhusbSWmP0G7OJnmcLg"
+        }
+      }
+    }
+  ]
+}
+```
@@ -0,0 +1,144 @@
+---
+layout: default
+title: Cluster allocation explain
+parent: REST API reference
+nav_order: 30
+---
+
+# Cluster allocation explain
+
+The most basic cluster allocation explain request finds an unassigned shard and explains why it can't be allocated to a node.
+
+If you add some options, you can instead get information on a specific shard, including why OpenSearch assigned it to its current node.
+
+
+## Example
+
+```json
+GET /_cluster/allocation/explain?include_yes_decisions=true
+{
+  "index": "movies",
+  "shard": 0,
+  "primary": true
+}
+```
+
+
+## Path and HTTP methods
+
+```
+GET _cluster/allocation/explain
+POST _cluster/allocation/explain
+```
+
+
+## URL parameters
+
+All cluster allocation explain parameters are optional.
+
+Parameter | Type | Description
+:--- | :--- | :---
+include_yes_decisions | Boolean | OpenSearch makes a series of yes or no decisions when trying to allocate a shard to a node. If this parameter is true, OpenSearch includes the (generally more numerous) "yes" decisions in its response. Default is false.
+include_disk_info | Boolean | Whether to include information about disk usage in the response. Default is false.
+
+
+## Request body
+
+All cluster allocation explain fields are optional.
+
+Field | Type | Description
+:--- | :--- | :---
+current_node | String | If you only want an explanation if the shard happens to be on a particular node, specify that node name here.
+index | String | The name of the shard's index.
+primary | Boolean | Whether to provide an explanation for the primary shard (true) or its first replica (false), which share the same shard ID.
+shard | Integer | The shard ID that you want an explanation for.
+
+
+## Response
+
+```json
+{
+  "index": "movies",
+  "shard": 0,
+  "primary": true,
+  "current_state": "started",
+  "current_node": {
+    "id": "d8jRZcW1QmCBeVFlgOJx5A",
+    "name": "opensearch-node1",
+    "transport_address": "172.24.0.4:9300",
+    "weight_ranking": 1
+  },
+  "can_remain_on_current_node": "yes",
+  "can_rebalance_cluster": "yes",
+  "can_rebalance_to_other_node": "no",
+  "rebalance_explanation": "cannot rebalance as no target node exists that can both allocate this shard and improve the cluster balance",
+  "node_allocation_decisions": [{
+    "node_id": "vRxi4uPcRt2BtHlFoyCyTQ",
+    "node_name": "opensearch-node2",
+    "transport_address": "172.24.0.3:9300",
+    "node_decision": "no",
+    "weight_ranking": 1,
+    "deciders": [{
+        "decider": "max_retry",
+        "decision": "YES",
+        "explanation": "shard has no previous failures"
+      },
+      {
+        "decider": "replica_after_primary_active",
+        "decision": "YES",
+        "explanation": "shard is primary and can be allocated"
+      },
+      {
+        "decider": "enable",
+        "decision": "YES",
+        "explanation": "all allocations are allowed"
+      },
+      {
+        "decider": "node_version",
+        "decision": "YES",
+        "explanation": "can relocate primary shard from a node with version [1.0.0] to a node with equal-or-newer version [1.0.0]"
+      },
+      {
+        "decider": "snapshot_in_progress",
+        "decision": "YES",
+        "explanation": "no snapshots are currently running"
+      },
+      {
+        "decider": "restore_in_progress",
+        "decision": "YES",
+        "explanation": "ignored as shard is not being recovered from a snapshot"
+      },
+      {
+        "decider": "filter",
+        "decision": "YES",
+        "explanation": "node passes include/exclude/require filters"
+      },
+      {
+        "decider": "same_shard",
+        "decision": "NO",
+        "explanation": "a copy of this shard is already allocated to this node [[movies][0], node[vRxi4uPcRt2BtHlFoyCyTQ], [R], s[STARTED], a[id=x8w7QxWdQQa188HKGn0iMQ]]"
+      },
+      {
+        "decider": "disk_threshold",
+        "decision": "YES",
+        "explanation": "enough disk for shard on node, free: [35.9gb], shard size: [15.1kb], free after allocating shard: [35.9gb]"
+      },
+      {
+        "decider": "throttling",
+        "decision": "YES",
+        "explanation": "below shard recovery limit of outgoing: [0 < 2] incoming: [0 < 2]"
+      },
+      {
+        "decider": "shards_limit",
+        "decision": "YES",
+        "explanation": "total shard limits are disabled: [index: -1, cluster: -1] <= 0"
+      },
+      {
+        "decider": "awareness",
+        "decision": "YES",
+        "explanation": "allocation awareness is not enabled, set cluster setting [cluster.routing.allocation.awareness.attributes] to enable it"
+      }
+    ]
+  }]
+}
+```
@@ -0,0 +1,72 @@
+---
+layout: default
+title: Cluster health
+parent: REST API reference
+grand_parent: OpenSearch
+nav_order: 45
+---
+
+# Cluster health
+
+The most basic cluster health request returns a simple status of the health of your cluster. OpenSearch expresses cluster health in three colors: green, yellow, and red. A green status means all primary shards and their replicas are allocated to nodes. A yellow status means all primary shards are allocated to nodes, but some replicas aren't. A red status means at least one primary shard is not allocated to any node.
+
+To get the status of a specific index, provide the index name.
+
+## Example
+
+This request waits 50 seconds for the cluster to reach the yellow status or better:
+
+```
+GET /_cluster/health?wait_for_status=yellow&timeout=50s
+```
+
+If the cluster health becomes yellow or green before 50 seconds elapse, it returns a response immediately. Otherwise it returns a response as soon as it exceeds the timeout.
+
+## Path and HTTP methods
+
+```
+GET /_cluster/health
+GET /_cluster/health/<index>
+```
+
+## URL parameters
+
+All cluster health parameters are optional.
+
+Parameter | Type | Description
+:--- | :--- | :---
+expand_wildcards | enum | Expands wildcard expressions to concrete indices. Combine multiple values with commas. Supported values are `all`, `open`, `closed`, `hidden`, and `none`. Default is `open`. 
+level | enum | The level of detail for returned health information. Supported values are `cluster`, `indices`, and `shards`. Default is `cluster`.
+local | boolean | Whether to return information from the local node only instead of from the master node. Default is false.
+master_timeout | time | The amount of time to wait for a connection to the master node. Default is 30 seconds.
+timeout | time | The amount of time to wait for a response. If the timeout expires, the request fails. Default is 30 seconds.
+wait_for_active_shards | string | Wait until the specified number of shards is active before returning a response. `all` for all shards. Default is `0`. 
+wait_for_events | enum | Wait until all currently queued events with the given priority are processed. Supported values are `immediate`, `urgent`, `high`, `normal`, `low`, and `languid`.
+wait_for_no_relocating_shards | boolean | Whether to wait until there are no relocating shards in the cluster. Default is false.
+wait_for_no_initializing_shards | boolean | Whether to wait until there are no initializing shards in the cluster. Default is false.
+wait_for_status | enum | Wait until the cluster is in a specific state or better. Supported values are `green`, `yellow`, and `red`.
+
+<!-- wait_for_nodes | string | Wait until the specified number of nodes is available. Also supports operators <=, >=, <, and > 
+# Not working properly when tested -->
+
+## Response
+
+```json
+{
+  "cluster_name" : "opensearch-cluster",
+  "status" : "green",
+  "timed_out" : false,
+  "number_of_nodes" : 2,
+  "number_of_data_nodes" : 2,
+  "active_primary_shards" : 6,
+  "active_shards" : 12,
+  "relocating_shards" : 0,
+  "initializing_shards" : 0,
+  "unassigned_shards" : 0,
+  "delayed_unassigned_shards" : 0,
+  "number_of_pending_tasks" : 0,
+  "number_of_in_flight_fetch" : 0,
+  "task_max_waiting_in_queue_millis" : 0,
+  "active_shards_percent_as_number" : 100.0
+}
+```
@@ -0,0 +1,15 @@
+---
+layout: default
+title: REST API reference
+nav_order: 99
+has_children: true
+redirect_from:
+  - /opensearch/rest-api/
+---
+
+# REST API reference
+
+OpenSearch uses its REST API for most operations. This _incomplete_ section includes REST API paths, HTTP verbs, supported parameters, request body details, and sample responses.
+
+In general, the OpenSearch REST API is no different from the Elasticsearch OSS REST API; most client code that worked with Elasticsearch OSS should also work with OpenSearch.
+{: .tip }
@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Search templates
-parent: OpenSearch
 nav_order: 50
 ---

@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Take and restore snapshots
-parent: OpenSearch
 nav_order: 65
 ---

@@ -101,7 +100,7 @@ Setting | Description
   sudo ./bin/opensearch-plugin install repository-s3
   ```

-   If you're using the Docker installation, see [Customize the Docker image](../../install/docker/#customize-the-docker-image). Your `Dockerfile` should look something like this:
+   If you're using the Docker installation, see [Customize the Docker image]({{site.url}}{{site.baseurl}}/opensearch/install/docker#customize-the-docker-image). Your `Dockerfile` should look something like this:

   ```
   FROM opensearchproject/opensearch:{{site.opensearch_version}}
@@ -1,9 +1,7 @@
 ---
 layout: default
 title: Tasks API
-parent: OpenSearch
-nav_order:  25
-has_math: false
+nav_order: 25
 ---

 # Tasks API operation
@@ -22,7 +20,7 @@ By including a task ID, you can get information specific to a particular task. N
 GET _tasks/<task_id>
 ```

-Note that if a task finishes running, it won't be returned as part of your request. For an example of a task that takes a little longer to finish, you can run the [`_reindex`](../reindex-data) API operation on a larger document, and then run `tasks`.
+Note that if a task finishes running, it won't be returned as part of your request. For an example of a task that takes a little longer to finish, you can run the [`_reindex`]({{site.url}}{{site.baseurl}}/opensearch/reindex-data) API operation on a larger document, and then run `tasks`.

 **Sample Response**
 ```json
@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Supported units
-parent: OpenSearch
 nav_order: 90
 ---

@@ -16,4 +15,4 @@ Bytes | The supported units for byte size are `b` for bytes, `kb` for kibibytes,
 Distances | The supported units for distance are `mi` for miles, `yd` for yards, `ft` for feet, `in` for inches, `km` for kilometers, `m` for meters, `cm` for centimeters, `mm` for millimeters, and `nmi` or `NM` for nautical miles. | `5mi` or `4ft`
 Quantities without units | For large values that don't have a unit, use `k` for kilo, `m` for mega, `g` for giga, `t` for tera, and `p` for peta. | `5k` for 5,000

-To convert output units to human-readable values, see [Common REST parameters](../common-parameters/).
+To convert output units to human-readable values, see [Common REST parameters]({{site.url}}{{site.baseurl}}/opensearch/common-parameters/).
@@ -1,7 +1,6 @@
 ---
 layout: default
 title: Search experience
-parent: OpenSearch
 nav_order: 55
 ---

@@ -40,7 +39,7 @@ These methods are described in the following sections.
 Prefix matching finds documents that matches the last term in the query string.

 For example, assume that the user types “qui” into a search UI. To autocomplete this phrase, use the `match_phrase_prefix` query to search all `text_entry` fields that begin with the prefix "qui."
-To make the word order and relative positions flexible, specify a `slop` value. To learn about the `slop` option, see [Options](../full-text/#options).
+To make the word order and relative positions flexible, specify a `slop` value. To learn about the `slop` option, see [Options]({{site.url}}{{site.baseurl}}/opensearch/query-dsl/full-text#options).

 #### Sample Request

@@ -60,7 +59,7 @@ GET shakespeare/_search

 Prefix matching doesn’t require any special mappings. It works with your data as-is.
 However, it’s a fairly resource-intensive operation. A prefix of `a` could match hundreds of thousands of terms and not be useful to your user.
-To limit the impact of prefix expansion, set `max_expansions` to a reasonable number. To learn about the `max_expansions` option, see [Options](../full-text/#options).
+To limit the impact of prefix expansion, set `max_expansions` to a reasonable number. To learn about the `max_expansions` option, see [Options]({{site.url}}{{site.baseurl}}/opensearch/query-dsl/full-text#options).

 #### Sample Request

@@ -31,6 +31,10 @@ code {
  padding-top: 2rem;
 }

+.nav-category {
+  text-align: start;
+}
+
 .main-content {
  ol {
    > li {
@@ -3,6 +3,9 @@ layout: default
 title: Asynchronous search
 nav_order: 51
 has_children: true
+redirect_from:
+  - /docs/async/
+  - /search-plugins/async/
 ---

 # Asynchronous search
@@ -4,19 +4,20 @@ title: Asynchronous search security
 nav_order: 2
 parent: Asynchronous search
 has_children: false
+redirect_from: /docs/async/security/
 ---

 # Asynchronous search security

 You can use the security plugin with asynchronous searches to limit non-admin users to specific actions. For example, you might want some users to only be able to submit or delete asynchronous searches, while you might want others to only view the results.

-All asynchronous search indices are protected as system indices. Only a super admin user or an admin user with a Transport Layer Security (TLS) certificate can access system indices. For more information, see [System indices](../../security/configuration/system-indices/).
+All asynchronous search indices are protected as system indices. Only a super admin user or an admin user with a Transport Layer Security (TLS) certificate can access system indices. For more information, see [System indices]({{site.url}}{{site.baseurl}}/security-plugin/configuration/system-indices/).

 ## Basic permissions

-As an admin user, you can use the security plugin to assign specific permissions to users based on which API operations they need access to. For a list of supported APIs operations, see [Asynchronous search](../).
+As an admin user, you can use the security plugin to assign specific permissions to users based on which API operations they need access to. For a list of supported APIs operations, see [Asynchronous search]({{site.url}}{{site.baseurl}}/).

-The security plugin has two built-in roles that cover most asynchronous search use cases: `asynchronous_search_full_access` and `asynchronous_search_read_access`. For descriptions of each, see [Predefined roles](../../security/access-control/users-roles/#predefined-roles).
+The security plugin has two built-in roles that cover most asynchronous search use cases: `asynchronous_search_full_access` and `asynchronous_search_read_access`. For descriptions of each, see [Predefined roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/users-roles#predefined-roles).

 If these roles don’t meet your needs, mix and match individual asynchronous search permissions to suit your use case. Each action corresponds to an operation in the REST API. For example, the `cluster:admin/opensearch/asynchronous_search/delete` permission lets you delete a previously submitted asynchronous search.

@@ -24,7 +25,7 @@ If these roles don’t meet your needs, mix and match individual asynchronous se

 Use backend roles to configure fine-grained access to asynchronous searches based on roles. For example, users of different departments in an organization can view asynchronous searches owned by their own department.

-First, make sure your users have the appropriate [backend roles](../../security/access-control/). Backend roles usually come from an [LDAP server](../../security/configuration/ldap/) or [SAML provider](../../security/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually](../../security/access-control/api/#create-user).
+First, make sure your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).

 Now when users view asynchronous search resources in OpenSearch Dashboards (or make REST API calls), they only see asynchronous searches submitted by users who have a subset of the backend role.
 For example, consider two users: `judy` and `elon`.
@@ -32,7 +33,7 @@ For example, consider two users: `judy` and `elon`.
 `judy` has an IT backend role:

 ```json
-PUT _opensearch/_security/api/internalusers/judy
+PUT _plugins/_security/api/internalusers/judy
 {
  "password": "judy",
  "backend_roles": [
@@ -45,7 +46,7 @@ PUT _opensearch/_security/api/internalusers/judy
 `elon` has an admin backend role:

 ```json
-PUT _opensearch/_security/api/internalusers/elon
+PUT _plugins/_security/api/internalusers/elon
 {
  "password": "elon",
  "backend_roles": [
@@ -58,7 +59,7 @@ PUT _opensearch/_security/api/internalusers/elon
 Both `judy` and `elon` have full access to asynchronous search:

 ```json
-PUT _opensearch/_security/api/rolesmapping/async_full_access
+PUT _plugins/_security/api/rolesmapping/async_full_access
 {
  "backend_roles": [],
  "hosts": [],
@@ -3,6 +3,7 @@ layout: default
 title: Settings
 parent: Asynchronous search
 nav_order: 4
+redirect_from: /docs/async/settings/
 ---

 # Settings
@@ -1,9 +1,10 @@
 ---
 layout: default
-title: API
-nav_order: 4
+title: k-NN API
+nav_order: 5
 parent: k-NN
 has_children: false
+redirect_from: /docs/knn/api/
 ---

 # k-NN plugin API
@@ -15,14 +16,14 @@ The k-NN plugin adds two API operations to help you better manage the plugin's f

 The k-NN `stats` API provides information about the current status of the k-NN plugin. The plugin keeps track of both cluster-level and node-level statistics. Cluster-level statistics have a single value for the entire cluster. Node-level statistics have a single value for each node in the cluster. You can filter the query by `nodeId` and `statName`:
 ```
-GET /_opensearch/_knn/nodeId1,nodeId2/stats/statName1,statName2
+GET /_plugins/_knn/nodeId1,nodeId2/stats/statName1,statName2
 ```

 Statistic |  Description
 :--- | :---
 `circuit_breaker_triggered` | Indicates whether the circuit breaker is triggered. This statistic is only relevant to approximate k-NN search.
 `total_load_time` | The time in nanoseconds that k-NN has taken to load graphs into the cache. This statistic is only relevant to approximate k-NN search.
-`eviction_count` | The number of graphs that have been evicted from the cache due to memory constraints or idle time. This statistic is only relevant to approximate k-NN search. <br /> **Note**: Explicit evictions that occur because of index deletion aren't counted. 
+`eviction_count` | The number of graphs that have been evicted from the cache due to memory constraints or idle time. This statistic is only relevant to approximate k-NN search. <br /> **Note**: Explicit evictions that occur because of index deletion aren't counted.
 `hit_count` | The number of cache hits. A cache hit occurs when a user queries a graph that's already loaded into memory. This statistic is only relevant to approximate k-NN search.
 `miss_count` | The number of cache misses. A cache miss occurs when a user queries a graph that isn't loaded into memory yet. This statistic is only relevant to approximate k-NN search.
 `graph_memory_usage` | Current cache size (total size of all graphs in memory) in kilobytes. This statistic is only relevant to approximate k-NN search.
@@ -45,7 +46,7 @@ Statistic |  Description
 ### Usage

 ```json
-GET /_opensearch/_knn/stats?pretty
+GET /_plugins/_knn/stats?pretty
 {
    "_nodes" : {
        "total" : 1,
@@ -87,7 +88,7 @@ GET /_opensearch/_knn/stats?pretty
 ```

 ```json
-GET /_opensearch/_knn/HYMrXXsBSamUkcAjhjeN0w/stats/circuit_breaker_triggered,graph_memory_usage?pretty
+GET /_plugins/_knn/HYMrXXsBSamUkcAjhjeN0w/stats/circuit_breaker_triggered,graph_memory_usage?pretty
 {
    "_nodes" : {
        "total" : 1,
@@ -121,7 +122,7 @@ After the process finishes, you can start searching against the indices with no
 This request performs a warmup on three indices:

 ```json
-GET /_opensearch/_knn/warmup/index1,index2,index3?pretty
+GET /_plugins/_knn/warmup/index1,index2,index3?pretty
 {
  "_shards" : {
    "total" : 6,
@@ -139,7 +140,7 @@ The call doesn't return results until the warmup operation finishes or the reque
 GET /_tasks
 ```

-After the operation has finished, use the [k-NN `_stats` API operation](#Stats) to see what the k-NN plugin loaded into the graph.
+After the operation has finished, use the [k-NN `_stats` API operation](#stats) to see what the k-NN plugin loaded into the graph.


 ### Best practices
@@ -148,6 +149,6 @@ For the warmup operation to function properly, follow these best practices:

 * Don't run merge operations on indices that you want to warm up. During merge, the k-NN plugin creates new segments, and old segments are sometimes deleted. For example, you could encounter a situation in which the warmup API operation loads graphs A and B into native memory, but segment C is created from segments A and B being merged. The graphs for A and B would no longer be in memory, and graph C would also not be in memory. In this case, the initial penalty for loading graph C is still present.

-* Confirm that all graphs you want to warm up can fit into native memory. For more information about the native memory limit, see the [knn.memory.circuit_breaker.limit statistic](../settings/#cluster-settings). High graph memory usage causes cache thrashing, which can lead to operations constantly failing and attempting to run again.
+* Confirm that all graphs you want to warm up can fit into native memory. For more information about the native memory limit, see the [knn.memory.circuit_breaker.limit statistic]({{site.url}}{{site.baseurl}}/search-plugins/knn/settings#cluster-settings). High graph memory usage causes cache thrashing, which can lead to operations constantly failing and attempting to run again.

 * Don't index any documents that you want to load into the cache. Writing new information to segments prevents the warmup API operation from loading the graphs until they're searchable. This means that you would have to run the warmup operation again after indexing finishes.
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ashwin Kumar	c18cced55a	Update _clients/logstash/index.md Co-authored-by: Vijayan Balasubramanian <VijayanB@users.noreply.github.com>	2021-08-03 13:30:21 -07:00
Ashwin Kumar	31613067dd	Update _clients/logstash/index.md Co-authored-by: Vijayan Balasubramanian <VijayanB@users.noreply.github.com>	2021-08-02 17:34:06 -07:00
Ashwin Kumar	8d178c3d83	Update _clients/logstash/index.md Co-authored-by: Vijayan Balasubramanian <VijayanB@users.noreply.github.com>	2021-08-02 17:33:56 -07:00
Ashwin Kumar	cfb582dd26	Update _clients/logstash/index.md Co-authored-by: Vijayan Balasubramanian <VijayanB@users.noreply.github.com>	2021-08-02 17:33:45 -07:00
ashwinkumar12345	96e0c4dbcd	install fix	2021-08-02 13:00:04 -07:00
ashwinkumar12345	880a635b90	minor fix	2021-08-02 11:16:39 -07:00
ashwinkumar12345	9ab749a7df	added Logstash Docker install steps	2021-08-02 11:14:03 -07:00
ashwinkumar12345	3170c44a4f	added docker image	2021-07-09 11:26:35 -07:00
ashwinkumar12345	5c3572bed1	typo	2021-07-06 23:52:32 -07:00
ashwinkumar12345	96f08a51d7	incorporated feedback	2021-07-06 23:51:45 -07:00
ashwinkumar12345	70c9b6d9c8	minor changes	2021-07-06 11:53:10 -07:00
ashwinkumar12345	9648a850ad	more changes	2021-07-05 23:52:45 -07:00
ashwinkumar12345	e0004a2f52	minor changes	2021-06-20 12:30:09 -07:00
ashwinkumar12345	a1a5ed068b	added logstash info	2021-06-14 12:26:23 -07:00
aetter	a8ec4d645a	Update upgrade-migrate.md	2021-06-14 08:39:41 -07:00
aetter	93f8af1bf7	Update upgrade-migrate.md	2021-06-14 08:38:32 -07:00
Andrew Etter	4b13395284	Merge pull request #40 from opensearch-project/migration Initial migration content	2021-06-11 13:25:46 -07:00
aetter	99cb063728	Fix link	2021-06-11 13:25:01 -07:00
aetter	c44bdfa895	Mention green health.	2021-06-11 11:15:48 -07:00
aetter	a4825dbddd	Moves migration to top-level section (for now)	2021-06-11 11:12:32 -07:00
aetter	f8adcd449e	Merge branch 'main' into migration	2021-06-11 10:18:31 -07:00
aetter	51017f3bcc	Perhaps I can redirect myself out of this long nightmare	2021-06-10 15:09:17 -07:00
aetter	d80ce75e1c	Improve mobile layout, continue trying to fix slash links	2021-06-10 14:42:36 -07:00
aetter	b39b545055	Missed one.	2021-06-10 13:48:06 -07:00
aetter	3694bf9253	Update _config.yml	2021-06-10 13:44:37 -07:00
aetter	c39f1346b5	Let's just start trying random things since everything works fine locally	2021-06-10 13:31:50 -07:00
aetter	0d410f49a6	I believe this fixes links with trailing slashes	2021-06-10 13:23:58 -07:00
aetter	9c3dda1e1a	Update index.md	2021-06-10 12:48:49 -07:00
aetter	e14076bbd3	Fix anchor links	2021-06-10 12:26:41 -07:00
Andrew Etter	ec0fe2060e	Merge pull request #51 from tgurr/disable Improvements to disable.md	2021-06-10 12:24:14 -07:00
aetter	fceb1a13b0	Update index.md	2021-06-10 12:14:42 -07:00
Timo Gurr	32ed3aa2d9	Link to the actual sub-section of interest Signed-off-by: Timo Gurr <timo.gurr@gmail.com>	2021-06-10 20:53:37 +02:00
Timo Gurr	a40e2f3f15	Fix broken links Signed-off-by: Timo Gurr <timo.gurr@gmail.com>	2021-06-10 20:53:22 +02:00
Andrew Etter	94a1da6c8d	Merge pull request #50 from opensearch-project/layout-changes Navigational improvement	2021-06-10 11:16:03 -07:00
aetter	d74507e3c4	Security REST API	2021-06-10 11:15:44 -07:00
aetter	669e0043ec	Update rollup-api.md	2021-06-10 10:52:01 -07:00
aetter	ff7da4537a	Typos	2021-06-10 10:44:05 -07:00
aetter	15fef30df6	TA content wasn't showing up	2021-06-10 10:35:55 -07:00
aetter	90f5029ca2	Add transforms back in, add redirects	2021-06-10 10:20:58 -07:00
aetter	9fea38c2cf	Update plugins.md	2021-06-10 09:23:05 -07:00
aetter	005584554b	Update section name	2021-06-10 09:09:20 -07:00
aetter	9d77b35dcc	Making the steps more prominent.	2021-06-10 08:18:41 -07:00
Liz Snyder	fed7115baa	Few small nits	2021-06-09 22:18:31 -07:00
aetter	3f8624bb0a	Got a little overzealous	2021-06-09 19:36:03 -07:00
aetter	9ea68d488a	No more relative links	2021-06-09 19:15:41 -07:00
aetter	da466be751	Add Logstash compat	2021-06-09 13:25:19 -07:00
aetter	8145dcc075	Merge branch 'main' into layout-changes	2021-06-09 13:25:06 -07:00
aetter	5a093b8eb1	Merge branch 'main' into migration	2021-06-09 13:19:01 -07:00
aetter	6022b9361a	Typo.	2021-06-09 11:33:10 -07:00
Keith Chan	a9489c0f49	Fixed a typo	2021-06-09 09:16:56 -07:00
Andrew Etter	bae70cab34	Merge pull request #48 from dblock/plugins-security Fix names of entries to delete from opensearch.yml when uninstalling the security plugin.	2021-06-09 08:34:06 -07:00
dblock	0cf268f91a	Fix names of entries to delete from opensearch.yml when uninstalling the security plugin. Signed-off-by: dblock <dblock@amazon.com>	2021-06-09 07:05:43 -04:00
Liz Snyder	45d0d90b50	Merge pull request #45 from opensearch-project/cluster-health-docs Add cluster health to API reference	2021-06-08 20:36:26 -07:00
Liz Snyder	fd78ed448e	Comment out busted prop	2021-06-08 20:35:36 -07:00
Keith Chan	39d9c3037a	Update index.md	2021-06-08 17:32:38 -07:00
aetter	c4cf6838bf	Updates security settings	2021-06-08 15:35:12 -07:00
Keith Chan	105ac1eeb7	Merge pull request #47 from opensearch-project/index-transforms Fixed API endpoints	2021-06-08 14:51:05 -07:00
Keith Chan	bdaf732834	Fixed a typo	2021-06-08 14:50:25 -07:00
keithhc2	86202b8df0	Fixed API endpoints	2021-06-08 14:48:50 -07:00
Keith Chan	d790eb6e14	Fixed parent metadata	2021-06-08 14:22:35 -07:00
Andrew Etter	73e8e44ecb	Merge pull request #46 from elfisher/patch-2 Removes Amazon ES from table	2021-06-08 09:34:21 -07:00
Eli Fisher	cd6f4177c9	Removes Amazon ES from table Removes Amazon ES from table so only OSS ES, ODFE, and OpenSearch are in the table.	2021-06-08 12:31:47 -04:00
Keith Chan	76bed73dd3	Merge pull request #37 from opensearch-project/index-transforms Added new section on transform jobs	2021-06-08 09:09:26 -07:00
Keith Chan	ccbb4c8c4d	Fixed some wording	2021-06-07 22:53:13 -07:00
Andrew Etter	b9302d3d16	Merge pull request #28 from sruti1312/pa-changes Update PA docs	2021-06-07 18:33:59 -07:00
Andrew Etter	55b296a2ed	Merge pull request #26 from chloe-zh/sql-endpoint-update Update query and setting API endpoints for SQL and PPL documentations	2021-06-07 18:33:49 -07:00
keithhc2	ab2132111e	Addressed some comments	2021-06-07 17:28:59 -07:00
aetter	4a9b964b92	Update upgrade-migrate.md	2021-06-07 14:10:02 -07:00
aetter	c2deae9d30	Address Keith's comments, minor improvements	2021-06-07 13:46:42 -07:00
Liz Snyder	b4b215c219	Add cluster health to API reference	2021-06-07 10:48:43 -07:00
Andrew Etter	14c745fa44	Merge pull request #43 from opensearch-project/rc1 Minor changes for RC1 release	2021-06-07 10:38:38 -07:00
aetter	ffc720bfe9	Update index.md	2021-06-07 09:43:35 -07:00
aetter	937b0e06b5	Update index.md	2021-06-07 09:37:35 -07:00
aetter	2236490581	Update version-history.md	2021-06-07 08:36:50 -07:00
aetter	1571143500	Minor changes for RC1 release	2021-06-06 19:19:20 -07:00
Andrew Etter	dc452c9590	Merge pull request #42 from opensearch-project/agg_intro_edit minor edits	2021-06-06 19:13:29 -07:00
aetter	a8887c8340	Update docker-migrate.md	2021-06-06 18:34:33 -07:00
ashwinkumar12345	59d63291b9	minor fix	2021-06-06 00:27:01 -07:00
ashwinkumar12345	37ac04ee8e	minor edits	2021-06-06 00:22:43 -07:00
Kyle J. Davis	908980479e	Merge pull request #41 from elfisher/add-logstash-and-beat-compatiblity-page Adds an Agents and Ingestion tools section Signed-off-by: Kyle Davis <kyledvs@amazon.com>	2021-06-04 15:46:12 -06:00
Eli Fisher	be083bb5db	Fixes typos and tries to simplify some sentences	2021-06-04 16:54:25 -04:00
Eli Fisher	e066d01f6d	Fixes typo	2021-06-04 16:39:26 -04:00
Eli Fisher	7190744ae7	Fixes formatting of content below tables	2021-06-04 16:01:23 -04:00
Eli Fisher	0775042a7d	fixes missing link to OpenSearch output plugin issue	2021-06-04 15:56:31 -04:00
Eli Fisher	78a72f5d22	Adds Agensts and Ingestion Tools page with compatibility matrices	2021-06-04 15:34:24 -04:00
aetter	9f34374691	Initial migration content	2021-06-03 16:17:17 -07:00
keithhc2	f4bd2a96dd	Minor language tweaks	2021-06-01 12:04:16 -07:00
aetter	9a3ec29dd8	Remove duplicate information	2021-06-01 11:23:53 -07:00
aetter	79595fde1f	Add Dashboards browser compatibility	2021-06-01 11:23:11 -07:00
aetter	29f8b256c4	Links	2021-06-01 11:11:15 -07:00
keithhc2	0a14f1bfb1	Adjusted spacing	2021-05-28 16:34:58 -07:00
keithhc2	c2104dcdf7	More tweaking of names	2021-05-28 16:16:56 -07:00
keithhc2	6133598b4e	Tweaked some names	2021-05-28 16:11:37 -07:00
keithhc2	58613ec94f	Added new section on transform jobs	2021-05-28 16:09:25 -07:00
Keith Chan	1e6340e752	Fixed a typo.	2021-05-28 15:42:53 -07:00
aetter	cd78345669	Many redirects	2021-05-28 15:28:27 -07:00
aetter	ce0ebe1948	Redirects for the plugins	2021-05-28 15:20:24 -07:00
aetter	fc998e3956	Merge branch 'main' into layout-changes	2021-05-28 13:54:29 -07:00
aetter	2c32397202	Minor KNN tweaks	2021-05-28 13:54:13 -07:00
Andrew Etter	2297d78063	Merge pull request #36 from jmazanec15/knn-mapping-refactor Fix score conversion for inner product	2021-05-28 13:52:03 -07:00
John Mazanec	4f69990198	Fix innerproduct for ann Signed-off-by: John Mazanec <jmazane@amazon.com>	2021-05-28 13:50:01 -07:00
John Mazanec	3340083904	Fix score conversion for inner product Signed-off-by: John Mazanec <jmazane@amazon.com>	2021-05-28 13:48:01 -07:00
aetter	2f8ef915a7	Merge KNN changes	2021-05-28 12:52:57 -07:00
aetter	264a950b6c	More top-level sections	2021-05-28 12:43:12 -07:00
Andrew Etter	5eb7f4c299	Merge pull request #35 from jmazanec15/knn-mapping-refactor Update knn documentation for rc1	2021-05-28 12:39:24 -07:00
John Mazanec	005168edf2	Update knn documentation for rc1 Signed-off-by: John Mazanec <jmazane@amazon.com>	2021-05-28 12:34:56 -07:00
aetter	73baf3f6db	Fixes site	2021-05-28 11:19:18 -07:00
aetter	2729ce3ccb	Breaks site	2021-05-28 10:48:19 -07:00
aetter	6150e42eec	Period.	2021-05-27 12:49:14 -07:00
aetter	cf938494fa	Merge branch 'main' of https://github.com/opensearch-project/documentation-website into main	2021-05-27 12:47:36 -07:00
aetter	f9b7c5f9ab	Copyright updates.	2021-05-27 12:47:20 -07:00
Andrew Etter	5be6d965c0	Merge pull request #34 from VijayanB/update-api [k-NN] Update url path	2021-05-27 12:33:13 -07:00
Vijayan Balasubramanian	0d977c2478	[k-NN] Update url path Update URL path from _opensearch to _plugins Signed-off-by: Vijayan Balasubramanian <balasvij@amazon.com>	2021-05-27 11:25:35 -07:00
aetter	64a78de6db	Commenting out these sections until we have compatibility sorted out.	2021-05-26 16:12:39 -07:00
aetter	1bca85f866	Add cluster allocation explain to API reference	2021-05-26 15:58:29 -07:00
aetter	de295161ab	Little note on indexing without an ID.	2021-05-26 12:46:08 -07:00
Ashwin Kumar	c5977c86f0	Merge pull request #32 from bowenlan-amzn/main Index Management doc change for bwc	2021-05-26 11:59:49 -07:00
bowenlan-amzn	62d0d70146	Index Management doc change for bwc Signed-off-by: bowenlan-amzn <bowenlan23@gmail.com>	2021-05-26 11:39:26 -07:00
chloe-zh	b8fa4ae9db	Addressed comments Signed-off-by: chloe-zh <chloezh1102@gmail.com>	2021-05-25 12:05:54 -07:00
Sruti Parthiban	2f0577869d	Update PA docs Signed-off-by: Sruti Parthiban <partsrut@amazon.com>	2021-05-25 11:21:38 -07:00
Andrew Etter	66056faa4b	Merge pull request #20 from opensearch-project/query-dsl Some reorganizing and a new index page	2021-05-25 10:00:39 -07:00
Keith Chan	4967221f82	Fixed a typo	2021-05-25 09:59:45 -07:00
Andrew Etter	aea3a6637f	Merge pull request #21 from aditjind/renaming Adding Settings for Alerting from Open-search to Plugins	2021-05-25 09:14:31 -07:00
Ashwin Kumar	fcba22c91c	Merge pull request #27 from spbjss/main Update AD doc to apply the latest security APi update.	2021-05-24 19:01:41 -07:00
Alex	98933d8c72	Update AD doc to apply the latest security APi update. Signed-off-by: Alex <pengsun@amazon.com>	2021-05-24 18:42:50 -07:00
Chloe Zhang	cf3ba3219a	Updated SQL and PPL doc Signed-off-by: chloe-zh <chloezh1102@gmail.com>	2021-05-24 16:50:29 -07:00
Ashwin Kumar	5c673a226b	Merge pull request #25 from spbjss/main Update anomaly detection document for opensearch GA.	2021-05-24 16:43:42 -07:00
Alex	397ba68561	Update anomaly detection document for opensearch GA. Date: Mon May 17 16:28:16 2021 -0700 Signed-off-by: Alex <pengsun@amazon.com>	2021-05-24 16:27:14 -07:00
Aditya Jindal	6e2b437e74	Updating Documentation for the renaming from _opensearch to _plugins Signed-off-by: Aditya Jindal <aditjind@amazon.com>	2021-05-24 13:55:32 -07:00
Aditya Jindal	19a0b2f7eb	Adding Settings for Alerting from Opensearch to Plugins Signed-off-by: Aditya Jindal <aditjind@amazon.com>	2021-05-24 13:55:32 -07:00
Keith Chan	58d5826866	Fixed a typo	2021-05-24 12:58:20 -07:00
keithhc2	a29d654cee	Some reorganizing and a new index page	2021-05-20 15:14:48 -07:00
aetter	04b8e216c4	Port Ashwin's fix to OpenSearch	2021-05-19 09:03:48 -07:00
aetter	c4c00409ee	Alphabetize	2021-05-18 18:41:22 -07:00
aetter	6abaa71599	Update bulk.md	2021-05-18 14:12:49 -07:00
aetter	f9e831c4cf	Adds REST API reference skeleton and bulk request	2021-05-18 13:50:30 -07:00
aetter	8837d6a8a3	Update docker.md	2021-05-17 13:20:58 -07:00
aetter	227f310103	Update index.md	2021-05-17 12:55:16 -07:00
aetter	d86ba8e5fc	Clarify security configuration request	2021-05-17 08:49:26 -07:00
aetter	534bd82454	Update docker-security.md	2021-05-14 11:22:23 -07:00
aetter	cc626c8c74	Java setting	2021-05-13 11:17:09 -07:00
aetter	90e90f018b	Update docker.md	2021-05-13 11:04:01 -07:00
Andrew Etter	5fd364971c	Merge pull request #13 from stockholmux/docker-changes fixed docker compose file and added startup warning	2021-05-13 11:03:09 -07:00
Kyle Davis	0fddcd145b	fixed docker compose file and added startup warning Signed-off-by: Kyle Davis <kyledvs@amazon.com>	2021-05-13 11:53:09 -06:00