Changed transform to rollup

Addressed comments
Added security to ISM
2021-09-17 14:58:07 -07:00 · 2021-09-15 13:47:04 -07:00 · 2021-09-10 11:57:30 -07:00 · 2021-08-19 13:51:01 -07:00 · 2021-08-19 12:13:12 -07:00 · 2021-08-19 09:52:31 -07:00
181 changed files with 3435 additions and 379 deletions
@@ -21,11 +21,9 @@ gem "jekyll-redirect-from", "~> 0.16"
 # gem 'github-pages', group: :jekyll_plugins

 # If you have any plugins, put them here!
-# group :jekyll_plugins do
-#   # gem "jekyll-feed", "~> 0.6"
-#   gem "jekyll-remote-theme"
-#   gem "jekyll-redirect-from"
-# end
+group :jekyll_plugins do
+  gem "jekyll-sitemap"
+end

 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
 gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw, :jruby]
@@ -1 +1 @@
-Copyright 2021 OpenSearch contributors.
+Copyright OpenSearch contributors.
@@ -1,6 +1,8 @@
+<img src="https://opensearch.org/assets/img/opensearch-logo-themed.svg" height="64px">
+
 # OpenSearch documentation

-This repository contains the documentation for OpenSearch, the search, analytics, and visualization suite with advanced security, alerting, SQL support, automated index management, deep performance analysis, and more. You can find the rendered documentation at [docs-beta.opensearch.org](https://docs-beta.opensearch.org).
+This repository contains the documentation for OpenSearch, the search, analytics, and visualization suite with advanced security, alerting, SQL support, automated index management, deep performance analysis, and more. You can find the rendered documentation at [opensearch.org/docs](https://opensearch.org/docs).

 Community contributions remain essential in keeping this documentation comprehensive, useful, well-organized, and up-to-date.

@@ -11,9 +13,9 @@ Community contributions remain essential in keeping this documentation comprehen

  Often, engineering teams can keep existing documentation up-to-date with minimal effort, thus freeing up the documentation team to focus on larger projects.

- Do you have expertise in a particular area of OpenSearch? Cluster sizing? The query DSL? Painless scripting? Aggregations? JVM settings? Take a look at the [current content](https://docs-beta.opensearch.org/docs/opensearch/) and see where you can add value. The [documentation team](#points-of-contact) is happy to help you polish and organize your drafts.
+- Do you have expertise in a particular area of OpenSearch? Cluster sizing? The query DSL? Painless scripting? Aggregations? JVM settings? Take a look at the [current content](https://opensearch.org/docs/opensearch/) and see where you can add value. The [documentation team](#points-of-contact) is happy to help you polish and organize your drafts.

- Are you an OpenSearch Dashboards expert? How did you set up your visualizations? Why is a particular dashboard so valuable to your organization? We have [very little](https://docs-beta.opensearch.org/docs/opensearch-dashboards/) on how to use OpenSearch Dashboards, only how to install it.
+- Are you an OpenSearch Dashboards expert? How did you set up your visualizations? Why is a particular dashboard so valuable to your organization? We have [very little](https://opensearch.org/docs/opensearch-dashboards/) on how to use OpenSearch Dashboards, only how to install it.

 - Are you a web developer? Do you want to add an optional dark mode to the documentation? A "copy to clipboard" button for our code samples? Other improvements to the design or usability? See [major changes](#major-changes) for information on building the website locally.

@@ -32,7 +34,7 @@ If you encounter problems or have questions when contributing to the documentati

 ## How the website works

-This repository contains many [Markdown](https://guides.github.com/features/mastering-markdown/) files in the `/docs` directory. Each Markdown file correlates with one page on the website.
+This repository contains many [Markdown](https://guides.github.com/features/mastering-markdown/) files organized into Jekyll "collections" (e.g. `_search-plugins`, `_opensearch`, etc.). Each Markdown file correlates with one page on the website.

 Using plain text on GitHub has many advantages:

@@ -131,15 +133,15 @@ If you're making major changes to the documentation and need to see the rendered
   sh build.sh
   ```

-1. If the build script doesn't automatically open your web browser (it should), open [http://localhost:4000/](http://localhost:4000/).
+1. If the build script doesn't automatically open your web browser (it should), open [http://localhost:4000/docs/](http://localhost:4000/docs/).

 1. Create a new branch.

-1. Edit the Markdown files in `/docs`.
+1. Edit the Markdown files in each collection (e.g. `_security-plugin/`).

   If you're a web developer, you can customize `_layouts/default.html` and `_sass/custom/custom.scss`.

-1. When you save a file, marvel as Jekyll automatically rebuilds the site and refreshes your web browser. This process takes roughly 30 seconds.
+1. When you save a file, marvel as Jekyll automatically rebuilds the site and refreshes your web browser. This process can take anywhere from 10-30 seconds.

 1. When you're happy with how everything looks, commit, push your changes to your fork, and submit a pull request.

@@ -223,7 +225,7 @@ This documentation uses a modified version of the [just-the-docs](https://github

 ## Get started
 New
-{: .label .label-green :}
+{: .label .label-green }
 ```

 * Labels come in default (blue), green, purple, yellow, and red.
@@ -236,6 +238,27 @@ These classes can help with readability, but should be used *sparingly*. Each ad
 Besides, standard Markdown elements suffice for most documentation.


+## Labels for APIs
+
+Each API operation has a label indicating when it was introduced. For most operations, this label is 1.0:
+
+```
+## Get roles
+Introduced 1.0
+{: .label .label-purple }
+```
+
+If we introduce a breaking change to an operation, add an additional label with a link to the release note for that breaking change:
+
+```
+## Get roles
+Introduced 1.0
+{: .label .label-purple }
+[Last breaking change 2.0](https://example.com)
+{: .label .label-red }
+```
+
+
 ## Math

 If you want to use the sorts of pretty formulas that [MathJax](https://www.mathjax.org) allows, add `has_math: true` to the Jekyll page metadata. Then insert LaTeX math into HTML tags with the rest of your Markdown content:
@@ -271,4 +294,4 @@ This project is licensed under the Apache-2.0 License.

 ## Copyright

-Copyright 2021 OpenSearch contributors.
+Copyright OpenSearch contributors.
@@ -27,14 +27,13 @@ PUT _cluster/settings
 }
 ```

-For a longer term solution, we plan to create an OpenSearch output plugin for Logstash. This plugin *does not exist yet*, but we've included it in the compatibility matrices below based on its expected behavior.
-

 ## Downloads

-These versions of Logstash and Beats offer the best compatibility with OpenSearch. For more information, see the [compatibility matrices](#compatibility-matrices).
+You can download the OpenSearch output plugin for Logstash from [OpenSearch downloads](https://opensearch.org/downloads.html). The Logstash output plugin is compatible with OpenSearch and Elasticsearch OSS (7.10.2 or lower).
+
+These versions of Beats offer the best compatibility with OpenSearch. For more information, see the [compatibility matrices](#compatibility-matrices).

- [Logstash OSS 7.12.1](https://www.elastic.co/downloads/past-releases/logstash-oss-7-12-1)
 - [Filebeat OSS 7.12.1](https://www.elastic.co/downloads/past-releases/filebeat-oss-7-12-1)
 - [Metricbeat OSS 7.12.1](https://www.elastic.co/downloads/past-releases/metricbeat-oss-7-12-1)
 - [Packetbeat OSS 7.12.1](https://www.elastic.co/downloads/past-releases/packetbeat-oss-7-12-1)
@@ -42,6 +41,9 @@ These versions of Logstash and Beats offer the best compatibility with OpenSearc
 - [Winlogbeat OSS 7.12.1](https://www.elastic.co/downloads/past-releases/winlogbeat-oss-7-12-1)
 - [Auditbeat OSS 7.12.1](https://elastic.co/downloads/past-releases/auditbeat-oss-7-12-1)

+Some users report compatibility issues with ingest pipelines on these versions of Beats. If you use ingest pipelines with OpenSearch, consider using the 7.10.2 versions of Beats OSS instead.
+{: .note }
+

 ## Compatibility Matrices

@@ -50,28 +52,26 @@ These versions of Logstash and Beats offer the best compatibility with OpenSearc

 ### Compatibility Matrix for Logstash

-| | Logstash OSS 7.x to 7.11.x | Logstash OSS 7.12.x\* | Logstash 7.13.x without OpenSearch output plugin | Logstash 7.13.x with OpenSearch output plugin\*\* |
+| | Logstash OSS 7.x to 7.11.x | Logstash OSS 7.12.x\* | Logstash 7.13.x without OpenSearch output plugin | Logstash 7.13.x with OpenSearch output plugin |
 | :---| :--- | :--- | :--- | :--- |
-| Elasticsearch OSS v7.x to v7.9.x | *Yes* | *Yes* | *No* | *Yes* |
-| Elasticsearch OSS v7.10.2 | *Yes* | *Yes* | *No* | *Yes* |
-| ODFE OSS v1.x to 1.12 | *Yes* | *Yes* | *No* | *Yes* |
+| Elasticsearch OSS 7.x to 7.9.x | *Yes* | *Yes* | *No* | *Yes* |
+| Elasticsearch OSS 7.10.2 | *Yes* | *Yes* | *No* | *Yes* |
+| ODFE 1.x to 1.12 | *Yes* | *Yes* | *No* | *Yes* |
 | ODFE 1.13 | *Yes* | *Yes* | *No* | *Yes* |
-| OpenSearch 1.0 | [Yes via version setting](https://github.com/opensearch-project/OpenSearch/issues/693) | [Yes via version setting](https://github.com/opensearch-project/OpenSearch/issues/693) | *No* | *Yes* |
+| OpenSearch 1.0 | Yes via version setting | Yes via version setting | *No* | *Yes* |

 \* Most current compatible version with Elasticsearch OSS.

-\*\* Planning to build.
-

 ### Compatibility Matrix for Beats

 | | Beats OSS 7.x to 7.11.x\*\* | Beats OSS 7.12.x\* | Beats 7.13.x |
 | :--- | :--- | :--- | :--- |
-| Elasticsearch OSS v7.x to v7.9.x | *Yes* | *Yes* | No |
-| Elasticsearch OSS v7.10.2 | *Yes* | *Yes* | No |
-| ODFE OSS v1.x to 1.12 | *Yes* | *Yes* | No |
+| Elasticsearch OSS 7.x to 7.9.x | *Yes* | *Yes* | No |
+| Elasticsearch OSS 7.10.2 | *Yes* | *Yes* | No |
+| ODFE 1.x to 1.12 | *Yes* | *Yes* | No |
 | ODFE 1.13 | *Yes* | *Yes* | No |
-| OpenSearch 1.0 | [Yes via version setting](https://github.com/opensearch-project/OpenSearch/issues/693) | [Yes via version setting](https://github.com/opensearch-project/OpenSearch/issues/693) | No |
+| OpenSearch 1.0 | Yes via version setting | Yes via version setting | No |
 | Logstash OSS 7.x to 7.11.x | *Yes* | *Yes* | *Yes* |
 | Logstash OSS 7.12.x\* | *Yes* | *Yes* | *Yes* |
 | Logstash 7.13.x with OpenSearch output plugin | *Yes* | *Yes* | *Yes* |
@@ -3,9 +3,6 @@ layout: default
 title: OpenSearch CLI
 nav_order: 52
 has_children: false
-redirect_from:
-  - /docs/odfe-cli/
-  - /docs/cli/
 ---

 # OpenSearch CLI
@@ -0,0 +1,82 @@
+---
+layout: default
+title: Compatibility
+nav_order: 1
+has_children: false
+redirect_from:
+  - /clients/
+---
+
+# OpenSearch client compatibility
+
+Most clients that work with Elasticsearch OSS 7.10.2 *should* work with OpenSearch, but the latest versions of those clients might include license or version checks that artificially break compatibility. This page includes recommendations around which versions of those clients to use for best compatibility with OpenSearch.
+
+Client | Recommended version
+:--- | :---
+[Java low-level REST client](https://search.maven.org/artifact/org.elasticsearch.client/elasticsearch-rest-client/7.13.4/jar) | 7.13.4
+[Java high-level REST client](https://search.maven.org/artifact/org.elasticsearch.client/elasticsearch-rest-high-level-client/7.13.4/jar) | 7.13.4
+[Python Elasticsearch client](https://pypi.org/project/elasticsearch/7.13.4/) | 7.13.4
+[Elasticsearch Node.js client](https://www.npmjs.com/package/@elastic/elasticsearch/v/7.13.0) | 7.13.0
+
+Clients exist for a wide variety of languages, so if you test a client and verify that it works, please [submit a PR](https://github.com/opensearch-project/documentation-website/pulls) and add it to this table.
+
+
+{% comment %}
+## Python 3 test code
+
+This code indexes a single document and is equivalent to `PUT /python-test-index1/_doc/1`.
+
+```python
+from elasticsearch import Elasticsearch
+
+host = 'localhost'
+port = 9200
+# For testing only. Do not store credentials in code.
+auth = ('admin', 'admin')
+
+es = Elasticsearch(
+  hosts = [{'host': host, 'port': port}],
+  http_auth = auth,
+  use_ssl = True,
+  verify_certs = False
+)
+
+document = {
+  "title": "Moneyball",
+  "director": "Bennett Miller",
+  "year": "2011"
+}
+
+response = es.index(index='python-test-index1', id='1', body=document, refresh=True)
+
+print(response)
+```
+
+
+## Node.js test code
+
+This code is equivalent to `GET /`.
+
+```js
+const { Client } = require('@elastic/elasticsearch')
+const client = new Client({
+  node: 'https://localhost:9200',
+  auth: {
+    // For testing only. Don't store credentials in code.
+    username: 'admin',
+    password: 'admin'
+  },
+  ssl: {
+    // ca: fs.readFileSync('./cacert.pem'),
+    rejectUnauthorized: false
+  }
+})
+
+async function run () {
+  const { body } = await client.info();
+  console.log(body);
+}
+
+run().catch(console.log)
+```
+{% endcomment %}
@@ -79,7 +79,7 @@ public class RESTClientSample {
    RestHighLevelClient client = new RestHighLevelClient(builder);

    //Create a non-default index with custom settings and mappings.
-    CreateIndexRequest createIndexRequest = new CreateIndexRequest("test-index");
+    CreateIndexRequest createIndexRequest = new CreateIndexRequest("custom-index");

    createIndexRequest.settings(Settings.builder() //Specify in the settings how many shards you want in the index.
      .put("index.number_of_shards", 4)
@@ -0,0 +1,246 @@
+---
+layout: default
+title: Advanced configurations
+parent: Logstash
+nav_order: 230
+---
+
+# Advanced configurations
+
+This section describes how to set up advanced configuration options, like referencing field values and conditional statements, for Logstash.
+
+## Referencing field values
+
+To get access to a field, use the `- field` syntax.
+You can also surround the field name by square brackets `- [field]` which makes it more explicit that you're referring to a field.
+
+
+For example, if you have the following event:
+
+```bash
+{
+  "request": "/products/view/123",
+  "verb": "GET",
+  "response": 200,
+  "headers": {
+  "request_path" => "/"
+  }
+}
+```
+
+To access the `request` field, use `- request` or `- [request]`.
+
+If you want to reference nested fields, use the square brackets syntax and specify the path to the field. With each level being enclosed within square brackets: `- [headers][request_path]`.
+
+You can reference fields using the `sprintf` format. This is also called string expansion. You need to add a % sign and then wrap the field reference within curly brackets.
+
+You need to reference field values when using conditional statements.
+
+For example, you can make the file name dynamic and contain the type of the processed events - either `access` or `error`. The `type` option is mainly used for conditionally applying filter plugins based on the type of events being processed.
+
+Let's add a `type` option and specify a value of `access`.
+
+
+```yml
+input {
+  file {
+    path => ""
+  start_position => "beginning"
+  type => "access"
+  }
+  http {
+    type => "access"
+  }
+}
+
+filter {
+  mutate {
+    remove_field => {"host"}
+  }
+}
+
+output {
+  stdout {
+    codec => rubydebug
+  }
+file {
+  path => "%{[type]}.log"
+  }
+}
+```
+
+Start Logstash and send an HTTP request. The processed event is output in the terminal. The event now includes a field named `type`.
+
+You'll see the `access.log` file created within the Logstash directory.
+
+## Conditional statements
+
+You can use conditional statements to control the flow of code execution based on some conditions.
+
+Syntax:
+
+```yml
+if EXPR {
+  ...
+} else if EXPR {
+  ...
+} else {
+  ...
+}
+```
+
+`EXPR` is any valid Logstash syntax that evaluates to a boolean value.
+For example, you can check if an event type is set to `access` or `error` and perform some action based on that:
+
+```yml
+if [type] == "access" {
+...
+} else if [type] == "error" {
+file { .. }
+} else {
+...
+}
+```
+
+You can compare a field value to some arbitrary value:
+
+```yml
+if [headers][content_length] >= 1000 {
+...
+}
+```
+
+You can regex:
+
+```yml
+if [some_field =~ /[0-9]+/ {
+  //some field only contains digits
+}
+```
+
+You can use arrays:
+
+```yml
+if [some_field] in ["one", "two", "three"] {
+  some field is either "one", "two", or "three"
+}
+```
+
+You can use boolean operators:
+
+```yml
+if [type] == "access" or [type] == "error" {
+  ...
+}
+```
+
+
+## Formatting dates
+
+You can use the `sprintf` format or string expansion to format dates.
+For example, you might want the current date to be part of the filename.
+
+To format the date, add a plus sign in curly brackets followed by the date format - `%{+yyyy-MM-dd}`.
+
+```yml
+file {
+  path => "%{[type]}_%{+yyyy_MM_dd}.log"
+}
+```
+
+This is the date stored within the @timestamp fields, which is the time and date of the event.
+Send a request to the pipeline and verify that a filename is outputted that contains the events date.
+
+You can embed the date in other outputs as well, for example into the index name in OpenSearch.
+
+## Sending time information
+
+You can set the time of events.
+
+Logstash already sets the time when the event is received by the input plugin within the @timestamp field.
+In some scenarios, you might need to use a different timestamp.
+For example, if you have an eCommerce store and you process the orders daily at midnight. When Logstash receives the events at midnight, it sets the timestamp to the current time.
+But you want it to be the time when the order is placed and not when Logstash received the event.
+
+Let's change the event timestamp to the date the request is received by the web server. You can do this using a filter plugin named `dates`.
+The `dates` filter passes a `date` or `datetime` value from a field and uses the results as the event timestamp.
+
+Add the `date` plugin at the bottom of the `filter` block:
+
+```yml
+date {
+  match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
+}
+```
+
+timestamp is the field that the `grok` pattern creates.
+`Z` is the timezone. i.e., UTC offsets.
+
+Start Logstash and send an HTTP request.
+
+You can see that the filename contains the date of the request instead of the present date.
+
+If the passing of the date fails, the `filter` plugin adds a tag named `_datepassfailure` to the text field.
+
+After you have set the @timestamp field to a new value, you don't really need the other `timestamp` field anymore. You can remove it with the `remove_field` option.
+
+```yml
+date {
+  match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
+  remove_field => [ "timestamp" ]
+}
+```
+
+## Parsing user agents
+
+The user agent is the last part of a log entry that consists of the name of the browser, the browser version, and the OS of the device.
+
+Users might be using a wide range of browsers, devices, and OS's. Doing this manually is hard.
+
+You can't use `grok` patterns because the `grok` pattern only matches the usage in the string as whole and doesn't figure out which browser the visitor used for instance.
+
+Logstash ships with a file containing regular expressions for this purpose. This makes it really easy to extract user agent information, which you could send to OpenSearch and run aggregations on.
+
+To do this, add a `source` option that contains the name of the field. In this case, that's the `agent` field.
+By default the user agent plugin, adds a number of fields at the top-level of the event.
+Since that can get pretty confusing, we can add an option named `target` with a value of `ua`, short for user agent. What this does is that it nests the fields within an object named `ua`, making things more organized.
+
+```yml
+useragent {
+  source => "agent"
+  target => "ua"
+}
+```
+
+Start Logstah and send an HTTP request.
+
+You can see a field named `ua` with a number of keys including the browser name and version, the OS, and the device.
+
+You could OpenSearch Dashboards to create a pie chart that shows how many visitors are from mobile devices and how many are desktop users. Or, you could get statistics on which browser versions are popular.
+
+## Enriching geographical data
+
+You can take an IP address and perform geographical lookup to resolve the geographical location of the user using the `geoip` filter.
+
+The `geoip` filter plugin ships with a database called `geolite 2`, which is provided by a company named MaxMind. `geolite 2` is a popular source of geographical data and it's available for free.
+Add the `geoip` plugin at the bottom of the `else` block.
+
+The value of the `source` option is the name of the field containing the IP address, in this case that's `clientip`. You can make this field available using the `grok` pattern.
+
+```yml
+geoip {
+  source => "clientip"
+}
+```
+
+Start Logstash and send an HTTP request.
+
+Within the terminal, you see a new field named `geoip` that contains information such as the timezone, country, continent, city, postal code, and the latitude / longitude pair.
+
+If you only need the country name for instance, include an option named `fields` with an array of the field names that you want the `geoip` plugin to return.
+
+Some of the fields are not always available such as city name and region because translating IP addresses into geographical locations is generally not that accurate. If the `geoip` plugin fails to look up the geographical location, it adds a tag named `geoip_lookup_failure`.
+
+You can use the `geoip` plugin with the OpenSearch output because `location` object within the `geoip` object, is a standard format for representing geospatial data in JSON. This is the same format as OpenSearch uses for its `geo_point` data type.
+
+You can use the powerful geospatial queries of OpenSearch for working with geographical data.
@@ -0,0 +1,157 @@
+---
+layout: default
+title: Common filter plugins
+parent: Logstash
+nav_order: 220
+---
+
+# Common filter plugins
+
+This page contains a list of common filter plugins.
+
+## mutate
+
+You can use the `mutate` filter to change the data type of a field. For example, you can use the `mutate` filter if you're sending events to OpenSearch and you need to change the data type of a field to match any existing mappings.
+
+To convert the `quantity` field from a `string` type to an `integer` type:
+
+```yml
+input {
+  http {
+    host => "127.0.0.1"
+    port => 8080
+  }
+}
+
+filter {
+  mutate {
+   convert => {"quantity" => "integer"}
+  }
+}
+
+output {
+  file {
+    path => "output.txt"
+  }
+}
+```
+
+#### Sample output
+
+You can see that the type of the `quantity` field is changed from a `string` to an `integer`.
+
+```yml
+{
+  "quantity" => 3,
+  "host" => "127.0.0.1",
+  "@timestamp" => 2021-05-23T19:02:08.026Z,
+  "amount" => 10,
+  "@version" => "1",
+  "headers" => {
+    "request_path" => "/",
+    "connection" => "keep-alive",
+    "content_length" => "41",
+    "http_user_agent" => "PostmanRuntime/7.26.8",
+    "request_method" => "PUT",
+    "cache_control" => "no-cache",
+    "http_accept" => "*/*",
+    "content_type" => "application/json",
+    "http_version" => "HTTP/1.1",
+    "http_host" => "127.0.0.1:8080",
+    "accept_encoding" => "gzip, deflate, br",
+    "postman_token" => "ffd1cdcb-7a1d-4d63-90f8-0f2773069205"
+   }
+}
+```
+
+Other data types you can convert to are `float`, `string`, and `boolean` values. If you pass in an array, the `mutate` filter converts all the elements in the array. If you pass a `string` like "world" to cast to an `integer` type, the result is 0 and Logstash continues processing events.
+
+Logstash supports a few common options for all filter plugins:
+
+Option | Description
+:--- | :---
+`add_field` | Adds one or more fields to the event.
+`remove_field` | Removes one or more events from the field.
+`add_tag` | Adds one or more tags to the event. You can use tags to perform conditional processing on events depending on which tags they contain.
+`remove_tag` | Removes one or more tags from the event.
+
+For example, you can remove the `host` field from the event:
+
+```yml
+input {
+  http {
+    host => "127.0.0.1"
+    port => 8080
+  }
+}
+
+filter {
+  mutate {
+    remove_field => {"host"}
+  }
+}
+
+output {
+  file {
+    path => "output.txt"
+  }
+}
+```
+
+## grok
+
+With the `grok` filter, you can parse unstructured data and and structure it into fields. The `grok` filter uses text patterns to match text in your logs. You can think of text patterns as variables containing regular expressions.
+
+The format of a text pattern is as follows:
+
+```bash
+%{SYNTAX:SEMANTIC}
+```
+
+`SYNTAX` is the format a piece of text should be in for the pattern to match. You can enter any of `grok`'s predefined patterns. For example, you can use the email identifier to match an email address from a given piece of text.
+
+`SEMANTIC` is an arbitrary name for the matched text. For example, if you're using the email identifier syntax, you can name it “email.”
+
+The following request consists of the IP address of the visitor, name of the visitor, the timestamp of the request, the HTTP verb and URL, the HTTP status code, and the number of bytes:
+
+```bash
+184.252.108.229 - joe [20/Sep/2017:13:22:22 +0200] GET /products/view/123 200 12798
+```
+
+To split this request into different fields:
+
+```yml
+filter {
+  grok {
+   match => { "message" => " %{IP: ip_address} %{USER:identity}
+                             %{USER:auth} \[%{HTTPDATE:reg_ts}\]
+                             \"%{WORD:http_verb}
+                             %{URIPATHPARAM: req_path}
+                             \" %{INT:http_status:int}
+                             %{INT:num_bytes:int}"}
+  }
+}
+```
+
+where:
+
+- `IP`: matches the IP address field.
+- `USER`: matches the user name.
+- `WORD`: matches the HTTP verb.
+- `URIPATHPARAM`: matches the URI path.
+- `INT`: matches the HTTP status field.
+- `INT`: matches the number of bytes.
+
+This is what the event looks like after the `grok` filter breaks it down into individual fields:
+
+```yml
+ip_address: 184.252.108.229
+identity: joe
+reg_ts: 20/Sep/2017:13:22:22 +0200
+http_verb:GET
+req_path: /products/view/123
+http_status: 200
+num_bytes: 12798
+```
+
+For common log formats, you use the predefined patterns defined here⁠---[Logstash patterns](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/ecs-v1). You can make any adjustments to the results with the `mutate` filter.
@@ -0,0 +1,40 @@
+---
+layout: default
+title: Logstash execution model
+parent: Logstash
+nav_order: 210
+---
+
+# Logstash execution model
+
+Here's a brief introduction to how Logstash processes events internally.
+
+## Handling events concurrently
+
+You can configure Logstash to have a number of inputs listening for events. Each input runs in its own thread to avoid inputs blocking each other. If you have two incoming events at the same time, Logstash handles both events concurrently.
+
+After receiving an event and possibly applying an input codec, Logstash sends the event to a work queue. Pipeline workers or batchers perform the rest of the work involving filters and outputs along with any codec used at the output. Each pipeline worker also runs within its own thread meaning that Logstash processes multiple events simultaneously.
+
+## Processing events in batches
+
+A pipeline worker consumes events from the work queue in batches to optimize the throughput of the pipeline as a whole.
+
+One reason why Logstash works in batches is that some code needs to be executed regardless of how many events are processed at a time within the pipeline worker. Instead of executing that code 100 times for 100 events, it’s more efficient to execute it once for a batch of 100 events.
+
+Another reason is that a few output plugins group together events as batches. For example, if you send 100 requests to OpenSearch, the OpenSearch output plugin uses the bulk API to send a single request that groups together the 100 requests.
+
+Logstash determines the batch size by two configuration options⁠---a number representing the maximum batch size and the batch delay. The batch delay is how long Logstash waits before processing the unprocessed batch of events.
+If you set the maximum batch size to 50 and the batch delay to 100 ms, Logstash processes a batch if they're either 50 unprocessed events in the work queue or if one hundred milliseconds have elapsed.
+
+The reason that a batch is processed, even if the maximum batch size isn’t reached, is to reduce the delay in processing and to continue to process events in a timely manner. This works well for pipelines that process a low volume of events.
+
+Imagine that you’ve a pipeline that processes error logs from web servers and pushes them to OpenSearch. You’re using OpenSearch Dashboards to analyze the error logs. Because you’re possibly dealing with a fairly low number of events, it might take a long time to reach 50 events. Logstash processes the events before reaching this threshold because otherwise there would be a long delay before we see the errors appear in OpenSearch Dashboards.
+
+The default batch size and batch delay work for most cases. You don’t need to change the default values unless you need to minutely optimize the performance.
+
+## Optimizing based on CPU cores
+
+The number of pipeline workers are proportional to the number of CPU cores on the nodes.
+If you have 5 workers running on a server with 2 CPU cores, the 5 workers won't be able to process events concurrently. On the other hand, running 5 workers on a server running 10 CPU cores limits the throughput of a Logstash instance.
+
+Instead of running a fixed number of workers, which results in poor performance in some cases, Logstash examines the number of CPU cores of the instance and selects the number of pipeline workers to optimize its performance for the platform on which its running. For instance, your local development machine might not have the same processing power as a production server. So you don't need to manually configure Logstash for different machines.
@@ -0,0 +1,358 @@
+---
+layout: default
+title: Logstash
+nav_order: 200
+has_children: true
+has_toc: true
+redirect_from:
+  - /clients/logstash/
+---
+
+# Logstash
+
+Logstash is a real-time event processing engine. It's part of the OpenSearch stack which includes OpenSearch, Beats, and OpenSearch Dashboards.
+
+You can send events to Logstash from many different sources. Logstash processes the events and sends it one or more destinations. For example, you can send access logs from a web server to Logstash. Logstash extracts useful information from each log and sends it to a destination like OpenSearch.
+
+Sending events to Logstash lets you decouple event processing from your app. Your app only needs to send events to Logstash and doesn’t need to know anything about what happens to the events afterwards.
+
+The open-source community originally built Logstash for processing log data but now you can process any type of events, including events in XML or JSON format.
+
+## Structure of a pipeline
+
+The way that Logstash works is that you configure a pipeline that has three phases⁠---inputs, filters, and outputs.
+
+Each phase uses one or more plugins. Logstash has over 200 built-in plugins so chances are that you’ll find what you need. Apart from the built-in plugins, you can use plugins from the community or even write your own.
+
+The structure of a pipeline is as follows:
+
+```yml
+input {
+  input_plugin => {}
+}
+
+filter {
+  filter_plugin => {}
+}
+
+output {
+  output_plugin => {}
+}
+```
+
+where:
+
+* `input` receives events like logs from multiple sources simultaneously. Logstash supports a number of input plugins for TCP/UDP, files, syslog, Microsoft Windows EventLogs, stdin, HTTP, and so on. You can also use an open source collection of input tools called Beats to gather events. The input plugin sends the events to a filter.
+* `filter` parses and enriches the events in one way or the other. Logstash has a large collection of filter plugins that modify events and pass them on to an output. For example, a `grok` filter parses unstructured events into fields and a `mutate` filter changes fields. Filters are executed sequentially.
+* `output` ships the filtered events to one or more destinations. Logstash supports a wide range of output plugins for destinations like OpenSearch, TCP/UDP, emails, files, stdout, HTTP, Nagios, and so on.
+
+Both the input and output phases support codecs to process events as they enter or exit the pipeline.
+Some of the popular codecs are `json` and `multiline`. The `json` codec processes data that’s in JSON format and the `multiline` codec merges multiple line events into a single line.
+
+You can also write conditional statements within pipeline configurations to perform certain actions, if a certain criteria is met.
+
+## Install Logstash
+
+The OpenSearch Logstash plugin has two installation options at this time: Linux (ARM64/X64) and Docker (ARM64/X64).
+
+Make sure you have [Java Development Kit (JDK)](https://www.oracle.com/java/technologies/javase-downloads.html) version 8 or 11 installed.
+
+### Tarball
+
+1. Download the Logstash tarball from [OpenSearch downloads](https://opensearch.org/downloads.html).
+
+2. Navigate to the downloaded folder in the terminal and extract the files:
+
+     ```bash
+     tar -zxvf logstash-oss-with-opensearch-output-plugin-7.13.2-linux-x64.tar.gz
+     ```
+
+3. Navigate to the `logstash-7.13.2` directory.
+- You can add your pipeline configurations to the `config` directory. Logstash saves any data from the plugins in the `data` directory. The `bin` directory contains the binaries for starting Logstash and managing plugins.
+
+### Docker
+
+1. Pull the Logstash oss package with the OpenSearch output plugin image:
+
+    ```
+    docker pull opensearchproject/logstash-oss-with-opensearch-output-plugin:7.13.2
+    ```
+
+1. Create a Docker network:
+
+    ```
+    docker network create test
+    ```
+
+1. Start OpenSearch with this network:
+
+    ```
+    docker run -p 9200:9200 -p 9600:9600 --name opensearch --net test -e "discovery.type=single-node" opensearchproject/opensearch:1.0.0
+    ```
+
+1. Start Logstash:
+
+    ```
+    docker run -it --rm --name logstash --net test opensearchproject/logstash-oss-with-opensearch-output-plugin:7.13.2 -e 'input { stdin { } } output {
+      opensearch {
+        hosts => ["https://opensearch:9200"]
+        index => "opensearch-logstash-docker-%{+YYYY.MM.dd}"
+        user => "admin"
+        password => "admin"
+        ssl => true
+        ssl_certificate_verification => false
+      }
+    }'
+    ```
+
+## Process text from the terminal
+
+You can define a pipeline that listens for events on `stdin` and outputs events on `stdout`. `stdin` and `stdout` refer to the terminal in which you’re running Logstash.
+
+To enter some text in the terminal and see the event data in the output:
+
+1. Use the `-e` argument to pass a pipeline configuration directly to the Logstash binary. In this case, `stdin` is the input plugin and `stdout` is the output plugin:
+
+    ```bash
+    bin/logstash -e "input { stdin { } } output { stdout { } }"
+    ```
+    Add the `—debug` flag to see a more detailed output.
+
+2. Enter "hello world" in your terminal. Logstash processes the text and outputs it back to the terminal:
+
+    ```yml
+    {
+     "message" => "hello world",
+     "host" => "a483e711a548.ant.amazon.com",
+     "@timestamp" => 2021-05-30T05:15:56.816Z,
+     "@version" => "1"
+    }
+    ```
+
+    The `message` field contains your raw input. The `host` field is an IP address when you don’t run Logstash locally. `@timestamp` shows the date and time for when the event is processed. Logstash uses the `@version` field for internal processing.
+
+3. Press `Ctrl + C` to shut down Logstash.
+
+### Troubleshooting
+
+If you already have a Logstash process running, you’ll get an error. To fix this issue:
+
+1. Delete the `.lock` file from the `data` directory:
+
+    ```bash
+    cd data
+    rm -rf .lock
+    ```
+
+2. Restart Logstash.
+
+## Process JSON or HTTP input and output it to a file
+
+To define a pipeline that handles JSON requests:
+
+1. Open the `config/pipeline.conf` file in any text editor you like. You can create a pipeline configuration file with any extension, the `.conf` extension is a Logstash convention. Add the `json` codec to accept JSON as the input and the `file` plugin to output the processed events to a `.txt` file:
+
+    ```yml
+    input {
+      stdin {
+        codec => json
+      }
+    }
+    output {
+      file {
+        path => "output.txt"
+      }
+    }
+    ```
+
+    To process inputs from a file, add an input file to the `events-data` directory and then pass its path to the `file` plugin at the input:
+
+    ```yml
+    input {
+      file {
+        path => "events-data/input_data.log"
+      }
+    }
+    ```
+
+2. Start Logstash:
+
+    ```bash
+    $ bin/logstash -f config/pipeline.conf
+    ```
+
+    `config/pipeline.conf` is a relative path to the `pipeline.conf` file. You can use an absolute path as well.
+
+3. Add a JSON object in the terminal:
+
+    ```json
+    { "amount": 10, "quantity": 2}
+    ```
+
+    The pipeline only handles a single line of input. If you paste some JSON that spans multiple lines, you’ll get an error.
+
+4. Check that the fields from the JSON object are added to the `output.txt` file:
+
+    ```json
+    $ cat output.txt
+
+    {
+      "@version": "1",
+      "@timestamp": "2021-05-30T05:52:52.421Z",
+      "host": "a483e711a548.ant.amazon.com",
+      "amount": 10,
+      "quantity": 2
+    }
+    ```
+
+    If you type in some invalid JSON as the input, you'll see a JSON parsing error. Logstash doesn't discard the invalid JSON because you still might want to do something with it. For example, you can trigger an email or send a notification to a Slack channel.
+
+To define a pipeline that handles HTTP requests:
+
+1. Use the `http` plugin to send events to Logstash through HTTP:
+
+    ```yml
+    input {
+      http {
+        host => "127.0.0.1"
+        port => 8080
+      }
+    }
+
+    output {
+      file {
+        path => "output.txt"
+      }
+    }
+    ```
+
+    If you don’t specify any options, the `http` plugin binds to `localhost` and listens on port 8080.
+
+2. Start Logstash:
+
+    ```bash
+    $ bin/logstash -f config/pipeline.conf
+    ```
+
+3. Use Postman to send an HTTP request. Set `Content-Type` to an HTTP header with a value of `application/json`:
+
+    ```json
+    PUT 127.0.0.1:8080
+
+    {
+      "amount": 10,
+      "quantity": 2
+    }
+    ```
+
+    Or, you can use the `curl` command:
+
+    ```bash
+    curl -XPUT -H "Content-Type: application/json" -d ' {"amount": 7, "quantity": 3 }' http://localhost:8080 (http://localhost:8080/)
+    ```
+
+    Even though we haven't added the `json` plugin to the input, the pipeline configuration still works because the HTTP plugin automatically applies the appropriate codec based on the `Content-Type` header.
+    If you specify a value of `applications/json`, Logstash parses the request body as JSON.
+
+    The `headers` field contains the HTTP headers that Logstash receives:
+
+    ```json
+    {
+      "host": "127.0.0.1",
+      "quantity": "3",
+      "amount": 10,
+      "@timestamp": "2021-05-30T06:05:48.135Z",
+      "headers": {
+        "http_version": "HTTP/1.1",
+        "request_method": "PUT",
+        "http_user_agent": "PostmanRuntime/7.26.8",
+        "connection": "keep-alive",
+        "postman_token": "c6cd29cf-1b37-4420-8db3-9faec66b9e7e",
+        "http_host": "127.0.0.1:8080",
+        "cache_control": "no-cache",
+        "request_path": "/",
+        "content_type": "application/json",
+        "http_accept": "*/*",
+        "content_length": "41",
+        "accept_encoding": "gzip, deflate, br"
+      },
+    "@version": "1"
+    }
+    ```
+
+
+## Automatically reload the pipeline configuration
+
+You can configure Logstash to detect any changes to the pipeline configuration file or the input log file and automatically reload the configuration.
+
+The `stdin` plugin doesn’t supporting automatic reloading.
+{: .note }
+
+1. Add an option named `start_position` with a value of `beginning` to the input plugin:
+
+    ```yml
+    input {
+      file {
+        path => "/Users/<user>/Desktop/logstash7-12.1/events-data/input_file.log"
+        start_position => "beginning"
+      }
+    }
+    ```
+
+    Logstash only processes any new events added to the input file and ignores the ones that it has already processed to avoid processing the same event more than once on restart.
+
+    Logstash records its progress in a file that's referred to as a `sinceDB` file. Logstash creates a `sinceDB` file for each file that it watches for changes.
+
+2. Open the `sinceDB` file to check how much of the input files are processed:
+
+    ```bash
+    cd data/plugins/inputs/file/
+    ls -al
+
+    -rw-r--r--  1 user  staff   0 Jun 13 10:50 .sincedb_9e484f2a9e6c0d1bdfe6f23ac107ffc5
+
+    cat .sincedb_9e484f2a9e6c0d1bdfe6f23ac107ffc5
+
+    51575938 1 4 7727
+    ```
+
+    The last number in the `sinceDB` file (7727) is the byte offset of the last known event processed.
+
+5. To process the input file from the beginning, delete the `sinceDB` file:
+
+    ```yml
+    rm .sincedb_*
+    ```
+
+2. Start Logstash with a `—-config.reload.automatic` argument:
+
+    ```bash
+    bin/logstash -f config/pipeline.conf --config.reload.automatic
+    ```
+
+    The `reload` option only reloads if you add a new line at the end of the pipeline configuration file.
+
+    Sample output:
+
+    ```yml
+    {
+       "message" => "216.243.171.38 - - [20/Sep/2017:19:11:52 +0200] \"GET /products/view/123 HTTP/1.1\" 200 12798 \"https://codingexplained.com/products\" \"Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)\"",
+       "@version" => "1",
+          "host" => "a483e711a548.ant.amazon.com",
+          "path" => "/Users/kumarjao/Desktop/odfe1/logstash-7.12.1/events-data/input_file.log",
+       "@timestamp" => 2021-06-13T18:03:30.423Z
+    }
+    {
+       "message" => "91.59.108.75 - - [20/Sep/2017:20:11:43 +0200] \"GET /js/main.js HTTP/1.1\" 200 588 \"https://codingexplained.com/products/view/863\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0\"",
+      "@version" => "1",
+          "host" => "a483e711a548.ant.amazon.com",
+          "path" => "/Users/kumarjao/Desktop/odfe1/logstash-7.12.1/events-data/input_file.log",
+    "@timestamp" => 2021-06-13T18:03:30.424Z
+    }
+    ```
+
+7. Add a new line to the input file.
+    - Logstash immediately detects the change and processes the new line as an event.
+
+8. Make a change to the `pipeline.conf` file.
+    - Logstash immediately detects the change and reloads the modified pipeline.
@@ -0,0 +1,77 @@
+---
+layout: default
+title: Ship events to OpenSearch
+parent: Logstash
+nav_order: 220
+---
+
+# Ship events to OpenSearch
+
+You can Ship Logstash events to an OpenSearch cluster and then visualize your events with OpenSearch Dashboards.
+
+Make sure you have [Logstash]({{site.url}}{{site.baseurl}}/clients/logstash/index/#install-logstash), [OpenSearch]({{site.url}}{{site.baseurl}}/opensearch/install/index/), and [OpenSearch Dashboards]({{site.url}}{{site.baseurl}}/dashboards/install/index/).
+{: .note }
+
+## OpenSearch output plugin
+
+To run the OpenSearch output plugin, add the following configuration in your `pipeline.conf` file:
+
+```yml
+output {
+  opensearch {
+    hosts       => "https://localhost:9200"
+    user        => "admin"
+    password    => "admin"
+    index       => "logstash-logs-%{+YYYY.MM.dd}"
+    ssl_certificate_verification => false
+  }
+}
+```
+
+
+## Sample walkthrough
+
+1.  Open the `config/pipeline.conf` file and add in the following configuration:
+
+    ```yml
+    input {
+      stdin {
+        codec => json
+      }
+    }
+
+    output {
+      opensearch {
+        hosts       => "https://localhost:9200"
+        user        => "admin"
+        password    => "admin"
+        index       => "logstash-logs-%{+YYYY.MM.dd}"
+        ssl_certificate_verification => false
+      }
+    }
+    ```
+
+    This Logstash pipeline accepts JSON input through the terminal and ships the events to an OpenSearch cluster running locally. Logstash writes the events to an index with the `logstash-logs-%{+YYYY.MM.dd}` naming convention.
+
+2. Start Logstash:
+
+    ```bash
+    $ bin/logstash -f config/pipeline.conf --config.reload.automatic
+    ```
+
+    `config/pipeline.conf` is a relative path to the `pipeline.conf` file. You can use an absolute path as well.
+
+3. Add a JSON object in the terminal:
+
+    ```json
+    { "amount": 10, "quantity": 2}
+    ```
+
+4. Start OpenSearch Dashboards and choose **Dev Tools**:
+
+    ```json
+    GET _cat/indices?v
+
+    health | status | index | uuid | pri | rep | docs.count | docs.deleted | store.size | pri.store.size
+    green | open | logstash-logs-2021.07.01 | iuh648LYSnmQrkGf70pplA | 1 | 1 | 1 | 0 | 10.3kb | 5.1kb
+    ```
@@ -137,6 +137,7 @@ footer_content:
 plugins:
  - jekyll-remote-theme
  - jekyll-redirect-from
+  - jekyll-sitemap

 # Exclude from processing.
 # The following items will not be processed, by default. Create a custom list
@@ -5,8 +5,6 @@ nav_order: 1
 has_children: false
 has_toc: false
 redirect_from:
-  - /docs/opensearch-dashboards/
-  - /opensearch-dashboards/
  - /dashboards/
 ---

@@ -0,0 +1,135 @@
+---
+layout: default
+title: Helm
+parent: Install OpenSearch Dashboards
+nav_order: 35
+---
+
+# Run OpenSearch Dashboards using Helm
+
+Helm is a package manager that allows you to easily install and manage OpenSearch Dashboards in a Kubernetes cluster. You can define your OpenSearch configurations in a YAML file and use Helm to deploy your applications in a version-controlled and reproducible way.
+
+The Helm chart contains the resources described in the following table.
+
+Resource | Description
+:--- | :---
+`Chart.yaml` |  Information about the chart.
+`values.yaml` |  Default configuration values for the chart.
+`templates` |  Templates that combine with values to generate the Kubernetes manifest files.
+
+The specification in the default Helm chart supports many standard use cases and setups. You can modify the default chart to configure your desired specifications and set Transport Layer Security (TLS) and role-based access control (RBAC).
+
+For information about the default configuration, steps to configure security, and configurable parameters, see the
+[README](https://github.com/opensearch-project/opensearch-devops/blob/main/Helm/README.md).
+
+The instructions here assume you have a Kubernetes cluster with Helm preinstalled. See the [Kubernetes documentation](https://kubernetes.io/docs/setup/) for steps to configure a Kubernetes cluster and the [Helm documentation](https://helm.sh/docs/intro/install/) to install Helm.
+{: .note }
+
+## Prerequisites
+
+Before you get started, you must first use [Helm to install OpenSearch]({{site.url}}{{site.baseurl}}/opensearch/install/helm/).
+
+Make sure that you can send requests to your OpenSearch pod:
+
+```json
+$ curl -XGET https://localhost:9200 -u 'admin:admin' --insecure
+{
+  "name" : "opensearch-cluster-master-1",
+  "cluster_name" : "opensearch-cluster",
+  "cluster_uuid" : "hP2gq5bPS3SLp8Z7wXm8YQ",
+  "version" : {
+    "distribution" : "opensearch",
+    "number" : "1.0.0",
+    "build_type" : "tar",
+    "build_hash" : "34550c5b17124ddc59458ef774f6b43a086522e3",
+    "build_date" : "2021-07-02T23:22:21.383695Z",
+    "build_snapshot" : false,
+    "lucene_version" : "8.8.2",
+    "minimum_wire_compatibility_version" : "6.8.0",
+    "minimum_index_compatibility_version" : "6.0.0-beta1"
+  },
+  "tagline" : "The OpenSearch Project: https://opensearch.org/"
+}
+```
+
+## Install OpenSearch Dashboards using Helm
+
+1. Change to the `opensearch-dashboards` directory:
+
+   ```bash
+   cd opensearch-dashboards
+   ```
+
+1. Package the Helm chart:
+
+   ```bash
+   helm package .
+   ```
+
+1. Deploy OpenSearch Dashboards:
+
+   ```bash
+   helm install --generate-name opensearch-dashboards-1.0.0.tgz
+   ```
+   The output shows you the specifications instantiated from the install.
+   To customize the deployment, pass in the values that you want to override with a custom YAML file:
+
+   ```bash
+   helm install --values=customvalues.yaml opensearch-dashboards-1.0.0.tgz
+   ```
+
+#### Sample output
+
+```yaml
+NAME: opensearch-dashboards-1-1629223356
+LAST DEPLOYED: Tue Aug 17 18:02:37 2021
+NAMESPACE: default
+STATUS: deployed
+REVISION: 1
+TEST SUITE: None
+NOTES:
+1. Get the application URL by running these commands:
+  export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=opensearch-dashboards,app.kubernetes.io/instance=op
+ensearch-dashboards-1-1629223356" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT
+```
+
+To make sure your OpenSearch Dashboards pod is up and running, run the following command:
+
+```bash
+$ kubectl get pods
+NAME                                                  READY   STATUS    RESTARTS   AGE
+opensearch-cluster-master-0                           1/1     Running   0          4m35s
+opensearch-cluster-master-1                           1/1     Running   0          4m35s
+opensearch-cluster-master-2                           1/1     Running   0          4m35s
+opensearch-dashboards-1-1629223356-758bd8747f-8www5   1/1     Running   0          66s
+```
+
+To set up port forwarding to access OpenSearch Dashboards, exit the OpenSearch shell and run the following command:
+
+```bash
+$ kubectl port-forward deployment/opensearch-dashboards-1-1629223356 5601
+```
+
+You can now access OpenSearch Dashboards from your browser at: http://localhost:5601.
+
+
+## Uninstall using Helm
+
+To identify the OpenSearch Dashboards deployment that you want to delete:
+
+```bash
+$ helm list
+NAME  NAMESPACE REVISION  UPDATED STATUS  CHART APP VERSION
+opensearch-1-1629223146 default 1 2021-08-17 17:59:07.664498239 +0000 UTCdeployedopensearch-1.0.0           1.0.0      
+opensearch-dashboards-1-1629223356 default  1 2021-08-17  18:02:37.600796946 +0000  UTCdepl
+oyedopensearch-dashboards-1.0.0 1.0.0        
+```
+
+To delete or uninstall a deployment, run the following command:
+
+```bash
+helm delete opensearch-dashboards-1-1629223356
+```
@@ -9,4 +9,4 @@ redirect_from:

 # Install and configure OpenSearch Dashboards

-OpenSearch Dashboards has two installation options at this time: Docker images and tarballs.
+OpenSearch Dashboards has three installation options at this time: Docker images, tarballs, and Helm charts.
@@ -27,4 +27,4 @@ nav_order: 30
   ./bin/opensearch-dashboards
   ```

-1. See the [OpenSearch Dashboards documentation]({{site.url}}{{site.baseurl}}/opensearch-dashboards/).
+1. See the [OpenSearch Dashboards documentation]({{site.url}}{{site.baseurl}}/dashboards/index/).
@@ -12,9 +12,9 @@ By default, for ease of testing and getting started, OpenSearch Dashboards runs
 Setting | Description
 :--- | :---
 opensearch.ssl.verificationMode | This setting is for communications between OpenSearch and OpenSearch Dashboards. Valid values are `full`, `certificate`, or `none`. We recommend `full` if you enable TLS, which enables hostname verification. `certificate` just checks the certificate, not the hostname, and `none` performs no checks (suitable for HTTP). Default is `full`.
-opensearch.ssl.certificateAuthorities | If `opensearch.ssl.verificationMode` is `full` or `certificate`, specify the full path (e.g. `[ "/usr/share/opensearch-dashboards-1.0.0/config/root-ca.pem" ]` to the certificate authority for your OpenSearch cluster.
+opensearch.ssl.certificateAuthorities | If `opensearch.ssl.verificationMode` is `full` or `certificate`, specify the full path to one or more CA certificates that comprise a trusted chain for your OpenSearch cluster. For example, you might need to include a root CA _and_ an intermediate CA if you used the intermediate CA to issue your admin, client, and node certificates.
 server.ssl.enabled | This setting is for communications between OpenSearch Dashboards and the web browser. Set to true for HTTPS, false for HTTP.
-server.ssl.certificate | If `server.ssl.enabled` is true, specify the full path (e.g. `/usr/share/opensearch-dashboards-1.0.0/config/my-client-cert.pem` to a valid client certificate for your OpenSearch cluster. You can [generate your own]({{site.url}}{{site.baseurl}}/security-plugin/configuration/generate-certificates/) or get one from a certificate authority.
+server.ssl.certificate | If `server.ssl.enabled` is true, specify the full path to a valid client certificate for your OpenSearch cluster. You can [generate your own]({{site.url}}{{site.baseurl}}/security-plugin/configuration/generate-certificates/) or get one from a certificate authority.
 server.ssl.key | If `server.ssl.enabled` is true, specify the full path (e.g. `/usr/share/opensearch-dashboards-1.0.0/config/my-client-cert-key.pem` to the key for your client certificate. You can [generate your own]({{site.url}}{{site.baseurl}}/security-plugin/configuration/generate-certificates/) or get one from a certificate authority.
 opensearch_security.cookie.secure | If you enable TLS for OpenSearch Dashboards, change this setting to `true`. For HTTP, set it to `false`.

@@ -27,9 +27,9 @@ opensearch.username: "kibanaserver"
 opensearch.password: "kibanaserver"
 opensearch.requestHeadersWhitelist: [ authorization,securitytenant ]
 server.ssl.enabled: true
-server.ssl.certificate: /usr/share/opensearch-1.0.0/config/client-cert.pem
-server.ssl.key: /usr/share/opensearch-1.0.0/config/client-cert-key.pem
-opensearch.ssl.certificateAuthorities: [ "/usr/share/opensearch-1.0.0/config/root-ca.pem" ]
+server.ssl.certificate: /usr/share/opensearch-dashboards/config/client-cert.pem
+server.ssl.key: /usr/share/opensearch-dashboards/config/client-cert-key.pem
+opensearch.ssl.certificateAuthorities: [ "/usr/share/opensearch-dashboards/config/root-ca.pem", "/usr/share/opensearch-dashboards/config/intermediate-ca.pem" ]
 opensearch_security.multitenancy.enabled: true
 opensearch_security.multitenancy.tenants.preferred: ["Private", "Global"]
 opensearch_security.readonly_mode.roles: ["kibana_read_only"]
@@ -2,7 +2,7 @@
 layout: default
 title: Notebooks
 nav_order: 50
-redirect_from: /docs/notebooks/
+redirect_from: /notebooks/
 has_children: false
 ---

@@ -36,6 +36,7 @@ A notebook is an interface for creating reports.

 Choose **Actions** to rename, duplicate, or delete a notebook.

+![Create notebook]({{site.url}}{{site.baseurl}}/images/create_notebook.gif)

 ### Step 2: Add a paragraph

@@ -55,7 +56,7 @@ For example, type `%md` for markdown, `%sql` for SQL, and `%ppl` for PPL.
 Add in text formatted in markdown.
 ```

-![Markdown paragraph]({{site.url}}{{site.baseurl}}/images/markdown-notebook.png)
+![Markdown paragraph]({{site.url}}{{site.baseurl}}/images/markdown_notebooks.gif)

 ##### Sample SQL block

@@ -64,7 +65,7 @@ Add in text formatted in markdown.
 Select * from opensearch_dashboards_sample_data_flights limit 20;
 ```

-![SQL paragraph]({{site.url}}{{site.baseurl}}/images/sql-notebook.png)
+![SQL paragraph]({{site.url}}{{site.baseurl}}/images/sql_notebooks.gif)

 ##### Sample PPL block

@@ -73,7 +74,7 @@ Select * from opensearch_dashboards_sample_data_flights limit 20;
 source=opensearch_dashboards_sample_data_logs | head 20
 ```

-![PPL paragraph]({{site.url}}{{site.baseurl}}/images/ppl-notebook.png)
+![PPL paragraph]({{site.url}}{{site.baseurl}}/images/ppl_notebooks.gif)


 #### Add a visualization
@@ -82,7 +83,7 @@ source=opensearch_dashboards_sample_data_logs | head 20
 1. In **Title**, select your visualization and choose a date range. You can choose multiple timelines to compare and contrast visualizations.
 1. To run and save a paragraph, choose **Run**.

-![Visualization paragraph]({{site.url}}{{site.baseurl}}/images/visualization-notebook.png)
+![Visualization paragraph]({{site.url}}{{site.baseurl}}/images/visualization_notebooks.gif)

 ## Paragraph actions

@@ -93,7 +94,8 @@ You can perform the following actions on paragraphs:
 - Run all the paragraphs at the same time.
 - Clear the outputs of all paragraphs.
 - Delete all the paragraphs.
- Move paragraphs up and down.
+
+![Sample notebooks]({{site.url}}{{site.baseurl}}/images/paragraphs_notebooks.gif)

 ## Sample notebooks

@@ -105,6 +107,8 @@ We prepared the following sample notebooks that showcase a variety of use cases:

 To add a sample notebook, choose **Actions** and select **Add sample notebooks**.

+![Sample notebooks]({{site.url}}{{site.baseurl}}/images/sample_notebooks.gif)
+
 ## Create a report

 You can use notebooks to create PNG and PDF reports:
@@ -116,3 +120,5 @@ You can use notebooks to create PNG and PDF reports:

 1. To create a schedule-based report, choose **Create report definition**. For steps to create a report definition, see [Create reports using a definition]({{site.url}}{{site.baseurl}}/dashboards/reporting#create-reports-using-a-definition).
 1. To see all your reports, choose **View all reports**.
+
+![Report notebooks]({{site.url}}{{site.baseurl}}/images/report_notebooks.gif)
@@ -3,5 +3,5 @@ layout: default
 title: Javadoc
 nav_order: 1
 permalink: /javadoc/
-redirect_to: https://opensearch.org/docs/javadocs/
+redirect_to: https://opensearch.org/javadocs/
 ---
@@ -0,0 +1,6 @@
+---
+layout: default
+nav_exclude: true
+permalink: /javadocs/
+redirect_to: https://opensearch.org/javadocs/
+---
@@ -3,7 +3,7 @@ layout: default
 title: Index rollups
 nav_order: 35
 has_children: true
-redirect_from: /docs/ism/index-rollups/
+redirect_from: /im-plugin/index-rollups/
 has_toc: false
 ---

@@ -2,7 +2,6 @@
 layout: default
 title: Index rollups API
 parent: Index rollups
-redirect_from: /docs/ism/rollup-api/
 nav_order: 9
 ---

@@ -20,6 +19,8 @@ Use the index rollup operations to programmatically work with index rollup jobs.
 ---

 ## Create or update an index rollup job
+Introduced 1.0
+{: .label .label-purple }

 Creates or updates an index rollup job.
 You must provide the `seq_no` and `primary_term` parameters.
@@ -134,6 +135,8 @@ Options | Description | Type | Required


 ## Get an index rollup job
+Introduced 1.0
+{: .label .label-purple }

 Returns all information about an index rollup job based on the `rollup_id`.

@@ -159,6 +162,8 @@ GET _plugins/_rollup/jobs/<rollup_id>
 ---

 ## Delete an index rollup job
+Introduced 1.0
+{: .label .label-purple }

 Deletes an index rollup job based on the `rollup_id`.

@@ -178,6 +183,8 @@ DELETE _plugins/_rollup/jobs/<rollup_id>


 ## Start or stop an index rollup job
+Introduced 1.0
+{: .label .label-purple }

 Start or stop an index rollup job.

@@ -199,6 +206,8 @@ POST _plugins/_rollup/jobs/<rollup_id>/_stop
 ---

 ## Explain an index rollup job
+Introduced 1.0
+{: .label .label-purple }

 Returns detailed metadata information about the index rollup job and its current progress.

@@ -3,7 +3,7 @@ layout: default
 title: Index transforms
 nav_order: 20
 has_children: true
-redirect_from: /docs/im/index-transforms/
+redirect_from: /im-plugin/index-transforms/
 has_toc: false
 ---

@@ -15,6 +15,8 @@ Aside from using OpenSearch Dashboards, you can also use the REST API to create,
 {:toc}

 ## Create a transform job
+Introduced 1.0
+{: .label .label-purple }

 Creates a transform job.

@@ -139,6 +141,8 @@ source_field | String | The field(s) to transform | Yes
 aggregations | JSON | The aggregations to use in the transform job. Supported aggregations are: `sum`, `max`, `min`, `value_count`, `avg`, `scripted_metric`, and `percentiles`. For more information, see [Metric Aggregations]({{site.url}}{{site.baseurl}}/opensearch/metric-agg). | Yes if not using groups

 ## Update a transform job
+Introduced 1.0
+{: .label .label-purple }

 Updates a transform job if `transform_id` already exists.

@@ -254,6 +258,8 @@ Parameter | Description | Required
 `if_primary_term` | Only perform the transform operation if the last operation that changed the transform job has the specified sequence term. | No

 ## Get a transform job's details
+Introduced 1.0
+{: .label .label-purple }

 Returns a transform job's details.

@@ -520,6 +526,8 @@ GET _plugins/_transform?size=2&from=8
 ```

 ## Start a transform job
+Introduced 1.0
+{: .label .label-purple }

 Transform jobs created using the API are automatically enabled, but if you ever need to enable a job, you can use the `start` API operation.

@@ -538,6 +546,8 @@ POST _plugins/_transform/<transform_id>/_start
 ```

 ## Stop a transform job
+Introduced 1.0
+{: .label .label-purple }

 Stops/disables a transform job.

@@ -556,6 +566,8 @@ POST _plugins/_transform/<transform_id>/_stop
 ```

 ## Get the status of a transform job
+Introduced 1.0
+{: .label .label-purple }

 Returns the status and metadata of a transform job.

@@ -589,6 +601,8 @@ GET _plugins/_transform/<transform_id>/_explain
 ```

 ## Preview a transform job's results
+Introduced 1.0
+{: .label .label-purple }

 Returns a preview of what a transformed index would look like.

@@ -674,6 +688,8 @@ POST _plugins/_transform/_preview
 ```

 ## Delete a transform job
+Introduced 1.0
+{: .label .label-purple }

 Deletes a transform job. This operation does not delete the source or target indices.

@@ -2,8 +2,7 @@
 layout: default
 title: ISM API
 parent: Index State Management
-redirect_from: /docs/ism/api/
-nav_order: 5
+nav_order: 20
 ---

 # ISM API
@@ -21,6 +20,8 @@ Use the index state management operations to programmatically work with policies


 ## Create policy
+Introduced 1.0
+{: .label .label-purple }

 Creates a policy.

@@ -138,6 +139,8 @@ PUT _plugins/_ism/policies/policy_1
 ---

 ## Add policy
+Introduced 1.0
+{: .label .label-purple }

 Adds a policy to an index. This operation does not change the policy if the index already has one.

@@ -160,10 +163,16 @@ POST _plugins/_ism/add/index_1
 }
 ```

+If you use a wildcard `*` while adding a policy to an index, the ISM plugin interprets `*` as all indices, including system indices like `.opendistro-security`, which stores users, roles, and tenants. A delete action in your policy might accidentally delete all user roles and tenants in your cluster.
+Don't use the broad `*` wildcard, and instead add a prefix, such as `my-logs*`, when specifying indices with the `_ism/add` API.
+{: .warning }
+
 ---


 ## Update policy
+Introduced 1.0
+{: .label .label-purple }

 Updates a policy. Use the `seq_no` and `primary_term` parameters to update an existing policy. If these numbers don't match the existing policy or the policy doesn't exist, ISM throws an error.

@@ -281,6 +290,8 @@ PUT _plugins/_ism/policies/policy_1?if_seq_no=7&if_primary_term=1
 ---

 ## Get policy
+Introduced 1.0
+{: .label .label-purple }

 Gets the policy by `policy_id`.

@@ -351,6 +362,8 @@ GET _plugins/_ism/policies/policy_1
 ---

 ## Remove policy from index
+Introduced 1.0
+{: .label .label-purple }

 Removes any ISM policy from the index.

@@ -374,6 +387,8 @@ POST _plugins/_ism/remove/index_1
 ---

 ## Update managed index policy
+Introduced 1.0
+{: .label .label-purple }

 Updates the managed index policy to a new policy (or to a new version of the policy). You can use an index pattern to update multiple indices at once. When updating multiple indices, you might want to include a state filter to only affect certain managed indices. The change policy filters out all the existing managed indices and only applies the change to the ones in the state that you specify. You can also explicitly specify the state that the managed index transitions to after the change policy takes effect.

@@ -410,6 +425,8 @@ POST _plugins/_ism/change_policy/index_1
 ---

 ## Retry failed index
+Introduced 1.0
+{: .label .label-purple }

 Retries the failed action for an index. For the retry call to succeed, ISM must manage the index, and the index must be in a failed state. You can use index patterns (`*`) to retry multiple failed indices.

@@ -436,6 +453,8 @@ POST _plugins/_ism/retry/index_1
 ---

 ## Explain index
+Introduced 1.0
+{: .label .label-purple }

 Gets the current state of the index. You can use index patterns to get the status of multiple indices.

@@ -461,6 +480,8 @@ The `plugins.index_state_management.policy_id` setting is deprecated starting fr
 ---

 ## Delete policy
+Introduced 1.0
+{: .label .label-purple }

 Deletes the policy by `policy_id`.

@@ -4,8 +4,7 @@ title: Index State Management
 nav_order: 3
 has_children: true
 redirect_from:
-  - /docs/im/ism/
-  - /docs/ism/
+  - /im-plugin/ism/
 has_toc: false
 ---

@@ -90,7 +89,6 @@ Make sure that the alias that you enter already exists. For more information abo

 After you attach a policy to an index, ISM creates a job that runs every 5 minutes by default to perform policy actions, check conditions, and transition the index into different states. To change the default time interval for this job, see [Settings]({{site.url}}{{site.baseurl}}/im-plugin/ism/settings/).

-If you want to use an OpenSearch operation to create an index with a policy already attached to it, see [create index]({{site.url}}{{site.baseurl}}/im-plugin/ism/api#create-index).

 ### Step 3: Manage indices

@@ -3,7 +3,6 @@ layout: default
 title: Managed Indices
 nav_order: 3
 parent: Index State Management
-redirect_from: /docs/ism/managedindices/
 has_children: false
 ---

@@ -3,7 +3,6 @@ layout: default
 title: Policies
 nav_order: 1
 parent: Index State Management
-redirect_from: /docs/ism/policies/
 has_children: false
 ---

@@ -94,7 +93,7 @@ For a list of available unit types, see [Supported units]({{site.url}}{{site.bas

 ISM supports the following operations:

- [force_merge](#forcemerge)
+- [force_merge](#force_merge)
 - [read_only](#read_only)
 - [read_write](#read_write)
 - [replica_count](#replica_count)
@@ -2,7 +2,6 @@
 layout: default
 title: Settings
 parent: Index State Management
-redirect_from: /docs/ism/settings/
 nav_order: 4
 ---

@@ -1,9 +1,9 @@
 ---
 layout: default
 title: Refresh search analyzer
-nav_order: 40
+nav_order: 50
 has_children: false
-redirect_from: /docs/ism/refresh-analyzer/
+redirect_from: /im-plugin/refresh-analyzer/
 has_toc: false
 ---

@@ -0,0 +1,41 @@
+---
+layout: default
+title: Index management security
+nav_order: 40
+has_children: false
+---
+
+# Index management security
+
+Using the security plugin with index management lets you limit non-admin users to certain actions. For example, you might want to set up your security such that a group of users can only read ISM policies, while others can create, delete, or change policies.
+
+All index management data are protected as system indices, and only a super admin or an admin with a Transport Layer Security (TLS) certificate can access system indices. For more information, see [System indices]({{site.url}}{{site.baseurl}}/security-plugin/configuration/system-indices).
+
+## Basic permissions
+
+The security plugin comes with one role that offers full access to index management: `index_management_full_access`. For a description of the role's permissions, see [Predefined roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/users-roles#predefined-roles).
+
+With security enabled, users not only need the correct index management permissions, but they also need permissions to execute actions to involved indices. For example, if a user wants to use the REST API to attach a policy that executes a rollup job to an index named `system-logs`, they would need the permissions to attach a policy and execute a rollup job, as well as access to `system-logs`.
+
+Finally, with the exceptions of Create Policy, Get Policy, and Delete Policy, users also need the `indices:admin/opensearch/ism/managedindex` permission to execute [ISM APIs]({{site.url}}{{site.baseurl}}/im-plugin/ism/api).
+
+## (Advanced) Limit access by backend role
+
+You can use backend roles to configure fine-grained access to index management policies and actions. For example, users of different departments in an organization might view different policies depending on what roles and permissions they are assigned.
+
+First, ensure your users have the appropriate [backend roles]({{site.url}}{{site.baseurl}}/security-plugin/access-control/index/). Backend roles usually come from an [LDAP server]({{site.url}}{{site.baseurl}}/security-plugin/configuration/ldap/) or [SAML provider]({{site.url}}{{site.baseurl}}/security-plugin/configuration/saml/). However, if you use the internal user database, you can use the REST API to [add them manually]({{site.url}}{{site.baseurl}}/security-plugin/access-control/api#create-user).
+
+Use the REST API to enable the following setting:
+
+```json
+PUT _cluster/settings
+{
+  "transient": {
+    "plugins.index_management.filter_by_backend_roles": "true"
+  }
+}
+```
+
+With security enabled, only users who share at least one backend role can see and execute the policies and actions relevant to their roles.
+
+For example, consider a scenario with three users: `John` and `Jill`, who have the backend role `helpdesk_staff`, and `Jane`, who has the backend role `phone_operator`. `John` wants to create a policy that performs a rollup job on an index named `airline_data`, so `John` would need a backend role that has permissions to access that index, create relevant policies, and execute relevant actions, and `Jill` would be able to access the same index, policy, and job. However, `Jane` cannot access or edit those resources or actions.
@@ -94,6 +94,9 @@ layout: table_wrappers
          {% endfor %}
        {% endif %}
      </nav>
+      <div class="site-footer">
+        <p class="text-small text-grey-dk-100">See a problem? Submit <a href="https://github.com/opensearch-project/documentation-website/issues">issues</a> or <a href="https://github.com/opensearch-project/documentation-website/edit/main/{{ page.path }}">edit this page</a> on <a href="https://github.com/opensearch-project/documentation-website/">GitHub</a>.</p>
+      </div>
    </div>
    <div class="copy-banner">
      <div class="container">
@@ -19,6 +19,8 @@ Use these anomaly detection operations to programmatically create and manage det
 ---

 ## Create anomaly detector
+Introduced 1.0
+{: .label .label-purple }

 Creates an anomaly detector.

@@ -306,6 +308,8 @@ Options | Description | Type | Required
 ---

 ## Preview detector
+Introduced 1.0
+{: .label .label-purple }

 Passes a date range to the anomaly detector to return any anomalies within that date range.

@@ -445,6 +449,8 @@ If you specify a category field, each result is associated with an entity:
 ---

 ## Start detector job
+Introduced 1.0
+{: .label .label-purple }

 Starts a real-time or historical anomaly detector job.

@@ -470,6 +476,8 @@ POST _plugins/_anomaly_detection/detectors/<detectorId>/_start
 ---

 ## Stop detector job
+Introduced 1.0
+{: .label .label-purple }

 Stops a real-time or historical anomaly detector job.

@@ -488,6 +496,8 @@ Stopped detector: m4ccEnIBTXsGi3mvMt9p
 ---

 ## Search detector result
+Introduced 1.0
+{: .label .label-purple }

 Returns all results for a search query.

@@ -933,6 +943,8 @@ GET _plugins/_anomaly_detection/detectors/results/_search
 ---

 ## Delete detector
+Introduced 1.0
+{: .label .label-purple }

 Deletes a detector based on the `detector_id`.
 To delete a detector, you need to first stop the detector.
@@ -968,6 +980,8 @@ DELETE _plugins/_anomaly_detection/detectors/<detectorId>
 ---

 ## Update detector
+Introduced 1.0
+{: .label .label-purple }

 Updates a detector with any changes, including the description or adding or removing of features.
 To update a detector, you need to first stop the detector.
@@ -1139,6 +1153,8 @@ PUT _plugins/_anomaly_detection/detectors/<detectorId>
 ---

 ## Get detector
+Introduced 1.0
+{: .label .label-purple }

 Returns all information about a detector based on the `detector_id`.

@@ -1485,6 +1501,8 @@ GET _plugins/_anomaly_detection/detectors/<detectorId>?task=true
 ---

 ## Search detector
+Introduced 1.0
+{: .label .label-purple }

 Returns all anomaly detectors for a search query.

@@ -1591,6 +1609,8 @@ Sample Input:
 ---

 ## Get detector stats
+Introduced 1.0
+{: .label .label-purple }

 Provides information about how the plugin is performing.

@@ -1691,6 +1711,8 @@ Historical detectors contain additional fields:
 ---

 ## Create monitor
+Introduced 1.0
+{: .label .label-purple }

 Create a monitor to set up alerts for the detector.

@@ -1909,6 +1931,8 @@ POST _plugins/_alerting/monitors
 ---

 ## Profile detector
+Introduced 1.0
+{: .label .label-purple }

 Returns information related to the current state of the detector and memory usage, including current errors and shingle size, to help troubleshoot the detector.

@@ -13,7 +13,7 @@ An anomaly in OpenSearch is any unusual behavior change in your time-series data

 It can be challenging to discover anomalies using conventional methods such as creating visualizations and dashboards. You could configure an alert based on a static threshold, but this requires prior domain knowledge and isn't adaptive to data that exhibits organic growth or seasonal behavior.

-Anomaly detection  automatically detects anomalies in your OpenSearch data in near real-time using the Random Cut Forest (RCF) algorithm. RCF is an unsupervised machine learning algorithm that models a sketch of your incoming data stream to compute an `anomaly grade` and `confidence score` value for each incoming data point. These values are used to differentiate an anomaly from normal variations. For more information about how RCF works, see [Random Cut Forests](https://pdfs.semanticscholar.org/8bba/52e9797f2e2cc9a823dbd12514d02f29c8b9.pdf?_ga=2.56302955.1913766445.1574109076-1059151610.1574109076).
+Anomaly detection  automatically detects anomalies in your OpenSearch data in near real-time using the Random Cut Forest (RCF) algorithm. RCF is an unsupervised machine learning algorithm that models a sketch of your incoming data stream to compute an `anomaly grade` and `confidence score` value for each incoming data point. These values are used to differentiate an anomaly from normal variations. For more information about how RCF works, see [Random Cut Forests](https://api.semanticscholar.org/CorpusID:927435).

 You can pair the anomaly detection plugin with the [alerting plugin]({{site.url}}{{site.baseurl}}/monitoring-plugins/alerting/) to notify you as soon as an anomaly is detected.

@@ -20,6 +20,8 @@ Use the alerting API to programmatically manage monitors and alerts.
 ---

 ## Create monitor
+Introduced 1.0
+{: .label .label-purple }

 #### Request

@@ -246,6 +248,8 @@ For a full list of timezone names, refer to [Wikipedia](https://en.wikipedia.org
 ---

 ## Update monitor
+Introduced 1.0
+{: .label .label-purple }

 When you update a monitor, include the current version number as a parameter. OpenSearch increments the version number automatically (see the sample response).

@@ -368,6 +372,8 @@ PUT _plugins/_alerting/monitors/<monitor_id>
 ---

 ## Get monitor
+Introduced 1.0
+{: .label .label-purple }

 #### Request

@@ -438,6 +444,8 @@ GET _plugins/_alerting/monitors/<monitor_id>
 ---

 ## Monitor stats
+Introduced 1.0
+{: .label .label-purple }

 Returns statistics about the alerting feature. Use `_plugins/_alerting/stats` to find node IDs and metrics. Then you can drill down using those values.

@@ -627,6 +635,8 @@ GET _plugins/_alerting/<node-id>/stats/<metric>
 ---

 ## Delete monitor
+Introduced 1.0
+{: .label .label-purple }

 #### Request

@@ -658,6 +668,8 @@ DELETE _plugins/_alerting/monitors/<monitor_id>
 ---

 ## Search monitors
+Introduced 1.0
+{: .label .label-purple }

 #### Request

@@ -755,6 +767,8 @@ GET _plugins/_alerting/monitors/_search
 ---

 ## Run monitor
+Introduced 1.0
+{: .label .label-purple }

 You can add the optional `?dryrun=true` parameter to the URL to show the results of a run without actions sending any message.

@@ -787,6 +801,8 @@ POST _plugins/_alerting/monitors/<monitor_id>/_execute
 ---

 ## Get alerts
+Introduced 1.0
+{: .label .label-purple }

 Returns an array of all alerts.

@@ -855,8 +871,10 @@ GET _plugins/_alerting/monitors/alerts
 ---

 ## Acknowledge alert
+Introduced 1.0
+{: .label .label-purple }

-[After getting your alerts](#get-alerts/), you can acknowledge any number of active alerts in one call. If the alert is already in an ERROR, COMPLETED, or ACKNOWLEDGED state, it appears in the `failed` array.
+[After getting your alerts](#get-alerts), you can acknowledge any number of active alerts in one call. If the alert is already in an ERROR, COMPLETED, or ACKNOWLEDGED state, it appears in the `failed` array.


 #### Request
@@ -882,6 +900,8 @@ POST _plugins/_alerting/monitors/<monitor-id>/_acknowledge/alerts
 ---

 ## Create destination
+Introduced 1.0
+{: .label .label-purple }

 #### Requests

@@ -956,6 +976,8 @@ POST _plugins/_alerting/destinations
 ---

 ## Update destination
+Introduced 1.0
+{: .label .label-purple }

 #### Request

@@ -991,6 +1013,8 @@ PUT _plugins/_alerting/destinations/<destination-id>
 ---

 ## Get destination
+Introduced 1.0
+{: .label .label-purple }

 Retrieve one destination.

@@ -1036,6 +1060,8 @@ GET _plugins/_alerting/destinations/<destination-id>
 ---

 ## Get destinations
+Introduced 1.0
+{: .label .label-purple }

 Retrieve all destinations.

@@ -1081,6 +1107,8 @@ GET _plugins/_alerting/destinations
 ---

 ## Delete destination
+Introduced 1.0
+{: .label .label-purple }

 #### Request

@@ -1110,6 +1138,8 @@ DELETE _plugins/_alerting/destinations/<destination-id>
 ---

 ## Create email account
+Introduced 1.0
+{: .label .label-purple }

 #### Request
 ```json
@@ -1142,6 +1172,8 @@ POST _plugins/_alerting/destinations/email_accounts
 ```

 ## Update email account
+Introduced 1.0
+{: .label .label-purple }

 #### Request
 ```json
@@ -1173,6 +1205,8 @@ PUT _plugins/_alerting/destinations/email_accounts/<email_account_id>
 ```

 ## Get email account
+Introduced 1.0
+{: .label .label-purple }

 #### Request
 ```json
@@ -1204,6 +1238,8 @@ GET _plugins/_alerting/destinations/email_accounts/<email_account_id>
 ```

 ## Delete email account
+Introduced 1.0
+{: .label .label-purple }

 #### Request
 ```
@@ -1230,6 +1266,8 @@ DELETE _plugins/_alerting/destinations/email_accounts/<email_account_id>
 ```

 ## Search email account
+Introduced 1.0
+{: .label .label-purple }

 #### Request

@@ -1296,6 +1334,8 @@ POST _plugins/_alerting/destinations/email_accounts/_search
 ---

 ## Create email group
+Introduced 1.0
+{: .label .label-purple }

 #### Request

@@ -1330,6 +1370,8 @@ POST _plugins/_alerting/destinations/email_groups
 ```

 ## Update email group
+Introduced 1.0
+{: .label .label-purple }

 #### Request

@@ -1363,6 +1405,8 @@ PUT _plugins/_alerting/destinations/email_groups/<email_group_id>
 ```

 ## Get email group
+Introduced 1.0
+{: .label .label-purple }

 #### Request
 ```json
@@ -1395,6 +1439,8 @@ GET _plugins/_alerting/destinations/email_groups/<email_group_id>
 ```

 ## Delete email group
+Introduced 1.0
+{: .label .label-purple }

 #### Request
 ```
@@ -1421,6 +1467,8 @@ DELETE _plugins/_alerting/destinations/email_groups/<email_group_id>
 ```

 ## Search email group
+Introduced 1.0
+{: .label .label-purple }

 #### Request

@@ -4,9 +4,6 @@ title: Cron
 nav_order: 20
 parent: Alerting
 has_children: false
-redirect_from:
-  - /alerting/cron/
-  - /docs/alerting/cron/
 ---

 # Cron expression reference
@@ -34,7 +34,7 @@ Destination | A reusable location for an action, such as Amazon Chime, Slack, or
 1. Specify a name for the destination so that you can identify it later.
 1. For **Type**, choose Slack, Amazon Chime, custom webhook, or [email](#email-as-a-destination).

-For Email type, refer to [Email as a destination](#email-as-a-destination) section below. For all other types, specify the webhook URL. For more information about webhooks, see the documentation for [Slack](https://api.slack.com/incoming-webhooks) and [Chime](https://docs.aws.amazon.com/chime/latest/ug/webhooks.html).
+For Email type, refer to [Email as a destination](#email-as-a-destination) section below. For all other types, specify the webhook URL. For more information about webhooks, see the documentation for [Slack](https://api.slack.com/incoming-webhooks) and [Amazon Chime](https://docs.aws.amazon.com/chime/latest/ug/webhooks.html).

 For custom webhooks, you must specify more information: parameters and headers. For example, if your endpoint requires basic authentication, you might need to add a header with a key of `Authorization` and a value of `Basic <Base64-encoded-credential-string>`. You might also need to change `Content-Type` to whatever your webhook requires. Popular values are `application/json`, `application/xml`, and `text/plain`.

@@ -296,7 +296,7 @@ Variable | Data Type | Description
 `ctx.trigger.actions.destination_id`| String | The alert destination's ID.
 `ctx.trigger.actions.message_template.source` | String | The message to send in the alert.
 `ctx.trigger.actions.message_template.lang` | String | The scripting language used to define the message. Must be Mustache.
-`ctx.trigger.actions.throttle_enabled` | Boolean | Whether throttling is enabled for this trigger. See [adding actions](#add-actions/) for more information about throttling.
+`ctx.trigger.actions.throttle_enabled` | Boolean | Whether throttling is enabled for this trigger. See [adding actions](#add-actions) for more information about throttling.
 `ctx.trigger.actions.subject_template.source` | String | The message's subject in the alert.
 `ctx.trigger.actions.subject_template.lang` | String | The scripting language used to define the subject. Must be mustache.

@@ -6,6 +6,8 @@ nav_order: 1
 ---

 # Performance Analyzer API
+Introduced 1.0
+{: .label .label-purple }

 Performance Analyzer uses a single HTTP method and URI for most requests:

@@ -660,7 +660,7 @@ GET opensearch_dashboards_sample_data_logs/_search
 ```

 The `ip_range` aggregation is for IP addresses.
-It works on `ip` type fields. You can define the IP ranges and masks in the [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation.
+It works on `ip` type fields. You can define the IP ranges and masks in the [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation.

 ```json
 GET opensearch_dashboards_sample_data_logs/_search
@@ -1026,7 +1026,7 @@ GET opensearch_dashboards_sample_data_logs/_search

 The `geohash_grid` aggregation buckets documents for geographical analysis. It organizes a geographical region into a grid of smaller regions of different sizes or precisions. Lower values of precision represent larger geographical areas and higher values represent smaller, more precise geographical areas.

-The number of results returned by a query might be far too many to display each geo point individually on a map. The `geohash_grid` aggregation buckets nearby geo points together by calculating the Geohash for each point, at the level of precision that you define (between 1 to 12; the default is 5). To learn more about Geohash, see [Wikipedia](http://en.wikipedia.org/wiki/Geohash).
+The number of results returned by a query might be far too many to display each geo point individually on a map. The `geohash_grid` aggregation buckets nearby geo points together by calculating the Geohash for each point, at the level of precision that you define (between 1 to 12; the default is 5). To learn more about Geohash, see [Wikipedia](https://en.wikipedia.org/wiki/Geohash).

 The web logs example data is spread over a large geographical area, so you can use a lower precision value. You can zoom in on this map by increasing the precision value:

@@ -329,10 +329,4 @@ You can then use the [Index State Management (ISM)]({{site.url}}{{site.baseurl}}

 ## Next steps

-If you are using the security plugin, the previous request to `_cat/nodes?v` might have failed with an initialization error. To initialize the plugin, run `opensearch/plugins/opensearch-security/tools/securityadmin.sh`. A sample command that uses the demo certificates might look like this:
-
-```bash
-sudo ./securityadmin.sh -cd {{site.url}}{{site.baseurl}}/securityconfig/ -icl -nhnv -cacert /etc/opensearch/root-ca.pem -cert /etc/opensearch/kirk.pem -key /etc/opensearch/kirk-key.pem -h <private-ip>
-```
-
-For full guidance around configuration options, see [Security configuration]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/).
+If you are using the security plugin, the previous request to `_cat/nodes?v` might have failed with an initialization error. For full guidance around using the security plugin, see [Security configuration]({{site.url}}{{site.baseurl}}/security-plugin/configuration/index/).
@@ -6,24 +6,14 @@ nav_order: 13

 # Data streams

-If you're ingesting continuously generated time-series data such as logs, events, and metrics into OpenSearch, you're likely in a scenario where:
+If you're ingesting continuously generated time-series data such as logs, events, and metrics into OpenSearch, you're likely in a scenario where the number of documents grows rapidly and you don't need to update older documents.

- You’re ingesting documents that grow rapidly.
- You don’t need to update older documents.
- Your searches generally target the newer documents.
+A typical workflow to manage time-series data involves multiple steps such as creating a rollover index alias, defining a write index, and defining common mappings and settings for the backing indices.

-A typical workflow to manage time-series data is as follows:
+Data streams simplify this bootstrapping process and enforce a setup that best suits time-series data, such as being designed primarily for append-only data, and ensuring that each document has a timestamp field.

- To split your data into an index for each day, use the rollover operation.
- To perform searches on a virtual index name that gets expanded to the underlying indices, create an [index alias]({{site.url}}{{site.baseurl}}/opensearch/index-alias/).
- To perform a write operation on an index alias, configure the latest index as the write index.
- To configure new indices, extract common mappings and settings into an [index template]({{site.url}}{{site.baseurl}}/opensearch/index-templates/).
+A data stream is internally composed of multiple backing indices. Search requests are routed to all the backing indices, while indexing requests are routed to the latest write index. You can use [ISM]({{site.url}}{{site.baseurl}}/im-plugin/ism/index/) policies to automatically handle rollovers or deletion of indices in a data stream, based on your use case.

-Even after you perform all these operations, you’re still not enforcing the best practices when dealing with time-series data. For example, you can modify the indices directly. You’re able to ingest documents without a timestamp field, which might result in slower queries.
-
-Data streams abstract the complexity and enforce the best practices for managing time-series data.
-
-With data streams, you can store append-only time-series data across multiple indices with a single endpoint for ingesting and searching data. It replaces index aliases for time-series data.

 ## About data streams

@@ -264,7 +254,7 @@ POST logs-redis/_rollover

 If you now perform a `GET` operation on the `logs-redis` data stream, you see that the generation ID is incremented from 1 to 2.

-You can also set up an [Index State Management (ISM) policy]({{site.url}}{{site.baseurl}}/ism/policies/) to automate the rollover process for the data stream.  
+You can also set up an [Index State Management (ISM) policy]({{site.url}}{{site.baseurl}}/im-plugin/ism/policies/) to automate the rollover process for the data stream.  
 The ISM policy is applied to the backing indices at the time of their creation. When you associate a policy to a data stream, it only affects the future backing indices of that data stream.

 You also don’t need to provide the `rollover_alias` setting, because the ISM policy infers this information from the backing index.
@@ -276,7 +266,7 @@ To manage data streams from OpenSearch Dashboards, open **OpenSearch Dashboards*
 You see a toggle switch for data streams that you can use to show or hide indices belonging to a data stream.

 When you enable this switch, you see a data stream multi-select dropdown menu that you can use for filtering data streams.
-You also see a data stream column that shows you the name of the parent data stream the index is contained in.
+You also see a data stream column that shows you the name of the data stream the index is contained in.

 ![data stream toggle]({{site.url}}{{site.baseurl}}/images/data_streams_toggle.png)

@@ -298,4 +288,4 @@ You can use wildcards to delete more than one data stream.

 We recommend deleting data from a data stream using an ISM policy.

-You can also use [asynchronous search]({{site.url}}{{site.baseurl}}/async/index/) and [SQL]({{site.url}}{{site.baseurl}}/sql/index/) and [PPL]({{site.url}}{{site.baseurl}}/ppl/index/) to query your data stream directly. You can also use the security plugin to define granular permissions on the data stream name.
+You can also use [asynchronous search]({{site.url}}{{site.baseurl}}/search-plugins/async/index/) and [SQL]({{site.url}}{{site.baseurl}}/search-plugins/sql/index/) and [PPL]({{site.url}}{{site.baseurl}}/search-plugins/ppl/index/) to query your data stream directly. You can also use the security plugin to define granular permissions on the data stream name.
@@ -0,0 +1,60 @@
+---
+layout: default
+title: Date math support for index names
+nav_order: 92
+---
+
+# Date math support for index names
+
+Date math is shorthand arithmetic for finding relative dates.
+
+If you're indexing time-series data with the dates mapped in the index names, you can use date math in your queries to filter index names and limit the number of searched indices.
+
+## Date math syntax
+
+The date math syntax for an index name is as follows:
+
+```
+<static_name{date_math_expr{date_format|time_zone}}>
+```
+
+- `static_name`: The unchanged or static portion of the index name. To use the characters `{` and `}` in the static part of an index name, escape them with a backslash `\`.
+- `date_math_expr`: The changing or dynamic portion of the index name that’s computed by the date math expression. For example, `now+1h` adds one hour, `now-1d` subtracts one hour, and `now/d` rounds down to the nearest day, where `now` represents the current timestamp.
+- `date_format`: (Optional) Specify the format for the computed date. The default value is `YYYY.MM.dd`. Make sure that you’re using the correct small or capital letters in the date format. For example, `mm` denotes minute of hour, while `MM` denotes month of year. Similarly, `hh` denotes the hour in the `1-12` range in combination with AM/PM, while `HH` denotes the hour in the `0-23` 24-hour range.
+- `time_zone`: (Optional) Specify the timezone offset. The default value is UTC. For example, the UTC time offset for PST is `-08:00`.
+
+## Date math example
+
+You must enclose date math index names within angle brackets.
+
+If today is 22nd March, 2024:
+
+- `<logstash-{now/d}>` resolves to `logstash-2024.03.22`
+- `<logstash-{now/M}>` resolves to `logstash-2024.03.01`
+- `<logstash-{now/M{YYYY.MM}}>` resolves to `logstash-2024.03`
+- `<logstash-{now/M-1M{YYYY.MM}}>` resolves to `logstash-2024.02`
+- `<logstash-{now/d{yyyy.MM.dd|+12:00}}>` resolves to `logstash-2024.03.23`
+
+You need to encode all special characters in URI format:
+
+Special characters | URI format
+:--- | :---
+`<` | %3C
+`>` | %3E
+`/` | %2F
+`{` | %7B
+`}` | %7D
+`|` | %7C
+`+` | %2B
+`:` | %3A
+`,` | %2C
+`\` | %5C
+
+If you are searching for errors in your daily logs with the default Logstash index name format `logstash-YYYY.MM.dd`, you can use date math to restrict the search to indices of the past three days:
+
+```
+# GET <logstash-{now/d-2d}>,<logstash-{now/d-1d}>,<logstash-{now/d}>/_search
+GET %3Clogstash-%7Bnow%2Fd-2d%7D%3E%2C%3Clogstash-%7Bnow%2Fd-1d%7D%3E%2C%3Clogstash-%7Bnow%2Fd%7D%3E/_search
+```
+
+This date math expression is evaluated at runtime.
@@ -0,0 +1,133 @@
+---
+layout: default
+title: Helm
+parent: Install OpenSearch
+nav_order: 6
+---
+
+# Run OpenSearch using Helm
+
+Helm is a package manager that allows you to easily install and manage OpenSearch in a Kubernetes cluster. You can define your OpenSearch configurations in a YAML file and use Helm to deploy your applications in a version-controlled and reproducible way.
+
+The Helm chart contains the resources described in the following table.
+
+Resource | Description
+:--- | :---
+`Chart.yaml` |  Information about the chart.
+`values.yaml` |  Default configuration values for the chart.
+`templates` |  Templates that combine with values to generate the Kubernetes manifest files.
+
+The specification in the default Helm chart supports many standard use cases and setups. You can modify the default chart to configure your desired specifications and set Transport Layer Security (TLS) and role-based access control (RBAC).
+
+For information about the default configuration, steps to configure security, and configurable parameters, see the
+[README](https://github.com/opensearch-project/opensearch-devops/blob/main/Helm/README.md).
+
+The instructions here assume you have a Kubernetes cluster with Helm preinstalled. See the [Kubernetes documentation](https://kubernetes.io/docs/setup/) for steps to configure a Kubernetes cluster and the [Helm documentation](https://helm.sh/docs/intro/install/) to install Helm.
+{: .note }
+
+## Prerequisites
+
+The default Helm chart deploys a three-node cluster. We recommend that you have at least 8 GiB of memory available for this deployment. You can expect the deployment to fail if, say, you have less than 4 GiB of memory available.
+
+## Install OpenSearch using Helm
+
+1. Clone the [opensearch-devops](https://github.com/opensearch-project/opensearch-devops/) repository:
+
+   ```bash
+   git clone https://github.com/opensearch-project/opensearch-devops.git
+   ```
+
+1. Change to the `opensearch` directory:
+
+   ```bash
+   cd Helm/opensearch
+   ```
+
+1. Package the Helm chart:
+
+   ```bash
+   helm package .
+   ```
+
+1. Deploy OpenSearch:
+
+   ```bash
+   helm install --generate-name opensearch-1.0.0.tgz
+   ```
+   The output shows you the specifications instantiated from the install.
+   To customize the deployment, pass in the values that you want to override with a custom YAML file:
+
+   ```bash
+   helm install --values=customvalues.yaml opensearch-1.0.0.tgz
+   ```
+
+#### Sample output
+
+  ```yaml
+  NAME: opensearch-1-1629223146
+  LAST DEPLOYED: Tue Aug 17 17:59:07 2021
+  NAMESPACE: default
+  STATUS: deployed
+  REVISION: 1
+  TEST SUITE: None
+  NOTES:
+  Watch all cluster members come up.
+    $ kubectl get pods --namespace=default -l app=opensearch-cluster-master -w
+  ```
+
+To make sure your OpenSearch pod is up and running, run the following command:
+
+```bash
+$ kubectl get pods
+NAME                                                  READY   STATUS    RESTARTS   AGE
+opensearch-cluster-master-0                           1/1     Running   0          3m56s
+opensearch-cluster-master-1                           1/1     Running   0          3m56s
+opensearch-cluster-master-2                           1/1     Running   0          3m56s
+```
+
+To access the OpenSearch shell:
+
+```bash
+$ kubectl exec -it opensearch-cluster-master-0 -- /bin/bash
+```
+
+You can send requests to the pod to verify that OpenSearch is up and running:
+
+```json
+$ curl -XGET https://localhost:9200 -u 'admin:admin' --insecure
+{
+  "name" : "opensearch-cluster-master-1",
+  "cluster_name" : "opensearch-cluster",
+  "cluster_uuid" : "hP2gq5bPS3SLp8Z7wXm8YQ",
+  "version" : {
+    "distribution" : "opensearch",
+    "number" : "1.0.0",
+    "build_type" : "tar",
+    "build_hash" : "34550c5b17124ddc59458ef774f6b43a086522e3",
+    "build_date" : "2021-07-02T23:22:21.383695Z",
+    "build_snapshot" : false,
+    "lucene_version" : "8.8.2",
+    "minimum_wire_compatibility_version" : "6.8.0",
+    "minimum_index_compatibility_version" : "6.0.0-beta1"
+  },
+  "tagline" : "The OpenSearch Project: https://opensearch.org/"
+}
+```
+
+## Uninstall using Helm
+
+To identify the OpenSearch deployment that you want to delete:
+
+```bash
+$ helm list
+NAME  NAMESPACEREVISIONUPDATED  STATUS  CHART APP VERSION
+opensearch-1-1629223146 default 1 2021-08-17 17:59:07.664498239 +0000 UTCdeployedopensearch-1.0.0    1.0.0       
+```
+
+To delete or uninstall a deployment, run the following command:
+
+```bash
+helm delete opensearch-1-1629223146
+```
+
+For steps to install OpenSearch Dashboards, see [Helm to install OpenSearch Dashboards]({{site.url}}{{site.baseurl}}/dashboards/install/helm/).
@@ -7,13 +7,13 @@ nav_order: 70

 # Important settings

-For production workloads, make sure the [Linux setting](https://www.kernel.org/doc/Documentation/sysctl/vm.txt) `vm.max_map_count` is set to at least 262144. On the OpenSearch Docker image, this setting is the default. To check, start a Bash session in the container and run:
+For production workloads, make sure the [Linux setting](https://www.kernel.org/doc/Documentation/sysctl/vm.txt) `vm.max_map_count` is set to at least 262144. Even if you use the Docker image, set this value on the *host machine*. To check the current value, run this command:

 ```bash
 cat /proc/sys/vm/max_map_count
 ```

-To increase this value, you have to modify the Docker image. For other install types, add this setting to the host machine's `/etc/sysctl.conf` file with the following line:
+To increase the value, add the following line to `/etc/sysctl.conf`:

 ```
 vm.max_map_count=262144
@@ -3,7 +3,6 @@ layout: default
 title: Install OpenSearch
 nav_order: 2
 redirect_from:
-  - /docs/install/
  - /opensearch/install/
 has_children: true
 ---
@@ -3,7 +3,6 @@ layout: default
 title: Boolean queries
 parent: Query DSL
 nav_order: 45
-redirect_from: /docs/opensearch/bool/
 ---

 # Boolean queries
@@ -3,9 +3,6 @@ layout: default
 title: Full-text queries
 parent: Query DSL
 nav_order: 40
-redirect_from:
-  - /docs/opensearch/full-text/
-  - /opensearch/full-text/
 ---

 # Full-text queries
@@ -3,7 +3,6 @@ layout: default
 title: Term-level queries
 parent: Query DSL
 nav_order: 30
-redirect_from: /docs/opensearch/term/
 ---

 # Term-level queries
@@ -145,7 +144,7 @@ The search query “To be, or not to be” is analyzed and tokenized into an arr
 ...
 ```

-For a list of all full-text queries, see [Full-text queries]({{site.url}}{{site.baseurl}}/opensearch/full-text/).
+For a list of all full-text queries, see [Full-text queries]({{site.url}}{{site.baseurl}}/opensearch/query-dsl/full-text/).

 If you want to query for an exact term like “HAMLET” in the speaker field and don't need the results to be sorted by relevance scores, a term-level query is more efficient:

@@ -2,11 +2,12 @@
 layout: default
 title: Alias
 parent: REST API reference
-grand_parent: OpenSearch
-nav_order: 8
+nav_order: 5
 ---

 # Alias
+Introduced 1.0
+{: .label .label-purple }

 An alias is a virtual pointer that you can use to reference one or more indices. Creating and updating aliases are atomic operations, so you can reindex your data and point an alias at it without any downtime.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat aliases
+Introduced 1.0
+{: .label .label-purple }

 The cat aliases operation lists the mapping of aliases to indices, plus routing and filtering information.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat allocation
+Introduced 1.0
+{: .label .label-purple }

 The cat allocation operation lists the allocation of disk space for indices and the number of shards on each node.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat count
+Introduced 1.0
+{: .label .label-purple }

 The cat count operation lists the number of documents in your cluster.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat fielddata
+Introduced 1.0
+{: .label .label-purple }

 The cat fielddata operation lists the memory size used by each field per node.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat health
+Introduced 1.0
+{: .label .label-purple }

 The cat health operation lists the status of the cluster, how long the cluster has been up, the number of nodes, and other useful information that helps you analyze the health of your cluster.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat indices
+Introduced 1.0
+{: .label .label-purple }

 The cat indices operation lists information related to indices⁠—how much disk space they are using, how many shards they have, their health status, and so on.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat master
+Introduced 1.0
+{: .label .label-purple }

 The cat master operation lists information that helps identify the elected master node.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat nodeattrs
+Introduced 1.0
+{: .label .label-purple }

 The cat nodeattrs operation lists the attributes of custom nodes.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat nodes
+Introduced 1.0
+{: .label .label-purple }

 The cat nodes operation lists node-level information, including node roles and load metrics.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat pending tasks
+Introduced 1.0
+{: .label .label-purple }

 The cat pending tasks operation lists the progress of all pending tasks, including task priority and time in queue.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat plugins
+Introduced 1.0
+{: .label .label-purple }

 The cat plugins operation lists the names, components, and versions of the installed plugins.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat recovery
+Introduced 1.0
+{: .label .label-purple }

 The cat recovery operation lists all completed and ongoing index and shard recoveries.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat repositories
+Introduced 1.0
+{: .label .label-purple }

 The cat repositories operation lists all completed and ongoing index and shard recoveries.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat segments
+Introduced 1.0
+{: .label .label-purple }

 The cat segments operation lists Lucene segment-level information for each index.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat shards
+Introduced 1.0
+{: .label .label-purple }

 The cat shards operation lists the state of all primary and replica shards and how they are distributed.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat snapshots
+Introduced 1.0
+{: .label .label-purple }

 The cat snapshots operation lists all snapshots for a repository.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat tasks
+Introduced 1.0
+{: .label .label-purple }

 The cat tasks operation lists the progress of all tasks currently running on your cluster.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat templates
+Introduced 1.0
+{: .label .label-purple }

 The cat templates operation lists the names, patterns, order numbers, and version numbers of index templates.

@@ -8,6 +8,8 @@ has_children: false
 ---

 # cat thread pool
+Introduced 1.0
+{: .label .label-purple }

 The cat thread pool operation lists the active, queued, and rejected threads of different thread pools on each node.

@@ -47,5 +49,5 @@ master_timeout | Time | The amount of time to wait for a connection to the maste
 node_name  name                      active queue rejected
 odfe-node2 ad-batch-task-threadpool    0     0        0
 odfe-node2 ad-threadpool               0     0        0
-odfe-node2 analyze                     0     0        0s 
+odfe-node2 analyze                     0     0        0s
 ```
@@ -6,6 +6,8 @@ nav_order: 10
 ---

 # Cluster allocation explain
+Introduced 1.0
+{: .label .label-purple }

 The most basic cluster allocation explain request finds an unassigned shard and explains why it can't be allocated to a node.

@@ -6,6 +6,8 @@ nav_order: 15
 ---

 # Cluster health
+Introduced 1.0
+{: .label .label-purple }

 The most basic cluster health request returns a simple status of the health of your cluster. OpenSearch expresses cluster health in three colors: green, yellow, and red. A green status means all primary shards and their replicas are allocated to nodes. A yellow status means all primary shards are allocated to nodes, but some replicas aren't. A red status means at least one primary shard is not allocated to any node.

@@ -6,6 +6,8 @@ nav_order: 20
 ---

 # Cluster settings
+Introduced 1.0
+{: .label .label-purple }

 The cluster settings operation lets you check the current settings for your cluster, review default settings, and change settings. When you update a setting using the API, OpenSearch applies it to all nodes in the cluster.

@@ -2,11 +2,12 @@
 layout: default
 title: Create index
 parent: REST API reference
-grand_parent: OpenSearch
-nav_order: 7
+nav_order: 3
 ---

 # Create index
+Introduced 1.0
+{: .label .label-purple }

 While you can create an index by using a document as a base, you can also just create an empty index for use later.

@@ -7,6 +7,8 @@ nav_order: 20
 ---

 # Bulk
+Introduced 1.0
+{: .label .label-purple }

 The bulk operation lets you add, update, or delete many documents in a single request. Compared to individual OpenSearch indexing requests, the bulk operation has significant performance benefits. Whenever practical, we recommend batching indexing operations into bulk requests.

@@ -0,0 +1,123 @@
+---
+layout: default
+title: Delete by query
+parent: Document APIs
+grand_parent: REST API reference
+nav_order: 40
+---
+
+# Delete by query
+Introduced 1.0
+{: .label .label-purple}
+
+You can include a query as part of your delete request so OpenSearch deletes all documents that match that query.
+
+## Example
+
+```json
+POST sample-index1/_delete_by_query
+{
+  "query": {
+    "match": {
+      "movie-length": "124"
+    }
+  }
+}
+```
+
+## Path and HTTP methods
+
+```
+POST <target>/_delete_by_query
+```
+
+## URL parameters
+
+All URL parameters are optional.
+
+Parameter | Type | Description
+:--- | :--- | :--- | :---
+&lt;index&gt; | String | Name of the data streams, indices, or aliases to delete from. Supports wildcards. If left blank, OpenSearch searches all indices.
+allow_no_indices | Boolean | False indicates to OpenSearch the request should return an error if any wildcard expression or index alias targets only missing or closed indices. Default is true.
+analyzer | String | The analyzer to use in the query string.
+analyze_wildcard | Boolean | Specifies whether to analyze wildcard and prefix queries. Default is false.
+conflicts | String | Indicates to OpenSearch what should happen if the delete by query operation runs into a version conflict. Valid options are `abort` and `proceed`. Default is `abort`.
+default_operator | String | Indicates whether the default operator for a string query should be AND or OR. Default is OR.
+df | String | The default field in case a field prefix is not provided in the query string.
+expand_wildcards | String | Specifies the type of index that wildcard expressions can match. Supports comma-separated values. Valid values are `all` (match any index), `open` (match open, non-hidden indices), `closed` (match closed, non-hidden indices), `hidden` (match hidden indices), and `none` (deny wildcard expressions). Default is `open`.
+from | Integer | The starting index to search from. Default is 0.
+ignore_unavailable | Boolean | Specifies whether to include missing or closed indices in the response. Default is false.
+lenient | Boolean | Specifies whether OpenSearch should ignore format-based query failures (for example, querying a text field for an integer). Default is false.
+max_docs | Integer | Maximum amount of documents the operation should process. Default is all documents.
+preference | String | Specifies the shard or node OpenSearch should perform the operation on.
+q | String | Query in the Lucene query string syntax.
+request_cache | Boolean | Specifies whether OpenSearch should use the request cache for the request. Default is whether it's enabled in the index's settings.
+refresh | Boolean | Specifies whether OpenSearch should refresh all of the shards involved in the delete request once the operation finishes. Default is false.
+requests_per_second | Integer | Specifies the request's throttling in sub-requests per second. Default is -1, which means no throttling.
+routing | String | Value used to route the operation to a specific shard.
+scroll | Time | Amount of time the search context should be open.
+scroll_size | Integer | Size of the scroll request of the operation. Default is 1000.
+search_type | String | Whether OpenSearch should use global term and document frequencies calculating revelance scores. Valid choices are `query_then_fetch` and `dfs_query_then_fetch`. `query_then_fetch` scores documents using local term and document frequencies for the shard. It’s usually faster but less accurate. `dfs_query_then_fetch` scores documents using global term and document frequencies across all shards. It’s usually slower but more accurate. Default is `query_then_fetch`.
+search_timeout | Time | Amount of time until timeout for the search request. Default is no timeout.
+slices | Integer | Number of sub-tasks OpenSearch should divide this task into. Default is 1, which means OpenSearch should not divide this task.
+sort | String | A comma-separated list of &lt;field&gt; : &lt;direction&gt; pairs to sort by.
+_source | String | Specifies whether to include the `_source` field in the response.
+_source_excludes | String | A comma-separated list of source fields to exclude from the response.
+_source_includes | String | A comma-separated list of source fields to include in the response.
+stats | String | Value to associate with the request for additional logging.
+terminate_after | Integer | The maximum number of documents OpenSearch should process before terminating the request.
+timeout | Time | How long the operation should wait from a response from active shards. Default is `1m`.
+version | Boolean | Whether to include the document version as a match.
+wait_for_active_shards | String | The number of shards that must be active before OpenSearch executes the operation. Valid values are `all` or any integer up to the total number of shards in the index. Default is 1, which is the primary shard.
+
+## Request body
+
+To search your index for specific documents, you must include a [query]({{site.url}}{{site.baseurl}}/opensearch/query-dsl/index) in the request body that OpenSearch uses to match documents. If you don't use a query, OpenSearch treats your delete request as a simple [delete document operation]({{site.url}}{{site.baseurl}}/opensearch/rest-api/document-apis/delete-document).
+
+```json
+{
+  "query": {
+    "match": {
+      "movie-length": "124"
+    }
+  }
+}
+```
+
+## Response
+```json
+{
+  "took": 143,
+  "timed_out": false,
+  "total": 1,
+  "deleted": 1,
+  "batches": 1,
+  "version_conflicts": 0,
+  "noops": 0,
+  "retries": {
+    "bulk": 0,
+    "search": 0
+  },
+  "throttled_millis": 0,
+  "requests_per_second": -1.0,
+  "throttled_until_millis": 0,
+  "failures": []
+}
+```
+
+## Response body fields
+
+Field | Description
+:--- | :---
+took | The amount of time in milliseconds OpenSearch needed to complete the operation.
+timed_out | Whether any delete requests during the operation timed out.
+total | Total number of documents processed.
+deleted | Total number of documents deleted.
+batches | Number of scroll responses the request processed.
+version_conflicts | Number of conflicts the request ran into.
+noops | How many delete requests OpenSearch ignored during the operation. This field always returns 0.
+retries | The number of bulk and search retry requests.
+throttled_millis | Number of throttled milliseconds during the request.
+requests_per_second | Number of requests executed per second during the operation.
+throttled_until_millis | The amount of time until OpenSearch executes the next throttled request. Always equal to 0 in a delete by query request.
+failures | Any failures that occur during the request.
@@ -0,0 +1,75 @@
+---
+layout: default
+title: Delete document
+parent: Document APIs
+grand_parent: REST API reference
+nav_order: 15
+---
+
+# Delete document
+Introduced 1.0
+{: .label .label-purple }
+
+If you no longer need a document in your index, you can use the delete document API operation to delete it.
+
+## Example
+
+```
+DELETE /sample-index1/_doc/1
+```
+
+## Path and HTTP methods
+
+```
+DELETE /<index-name>/_doc/<_id>
+```
+
+## URL parameters
+
+Parameter | Type | Description | Required
+:--- | :--- | :--- | :---
+&lt;index-name&gt; | String | The index to delete from. | Yes
+&lt;_id&gt; | String | The ID of the document to delete. | Yes
+if_seq_no | Integer | Only perform the delete operation if the document's version number matches the specified number. | No
+if_primary_term | Integer | Only perform the delete operation if the document has the specified primary term. | No
+refresh | Enum | If true, OpenSearch refreshes shards to make the operation visible to searching. Valid options are `true`, `false`, and `wait_for`, which tells OpenSearch to wait for a refresh before executing the operation. Default is false. | No
+routing | String | Value used to route the operation to a specific shard. | No
+timeout | Time | How long to wait for a response from the cluster. | No
+version | Integer | The version of the document to delete, which must match the last updated version of the document. | No
+version_type | Enum | Retrieves a specifically typed document. Available options are `external` (retrieve the document if the specified version number is greater than the document's current version) and `external_gte` (retrieve the document if the specified version number is greater than or equal to the document's current version). For example, to delete version 3 of a document, use `/_doc/1?version=3&version_type=external`. | No
+wait_for_active_shards | String | The number of active shards that must be available before OpenSearch processes the delete request. Default is 1 (only the primary shard). Set to `all` or a positive integer. Values greater than 1 require replicas. For example, if you specify a value of 3, the index must have two replicas distributed across two additional nodes for the operation to succeed. | No
+
+
+## Response
+```json
+{
+  "_index": "sample-index1",
+  "_type": "_doc",
+  "_id": "1",
+  "_version": 2,
+  "result": "deleted",
+  "_shards": {
+    "total": 2,
+    "successful": 2,
+    "failed": 0
+  },
+  "_seq_no": 1,
+  "_primary_term": 15
+}
+```
+
+## Response body fields
+
+Field | Description
+:--- | :---
+_index | The name of the index.
+_type | The document's type. OpenSearch only supports one type, which is `_doc`.
+_id | The document's ID.
+_version | The document's version.
+_result | The result of the delete operation.
+_shards | Detailed information about the cluster's shards.
+total | The total number of shards.
+successful | The number of shards OpenSearch succssfully deleted the document from.
+failed | The number of shards OpenSearch failed to delete the document from.
+_seq_no | The sequence number assigned when the document was indexed.
+_primary_term | The primary term assigned when the document was indexed.
@@ -7,6 +7,8 @@ nav_order: 5
 ---

 # Get document
+Introduced 1.0
+{: .label .label-purple }

 After adding a JSON document to your index, you can use the get document API operation to retrieve the document's information and data.

@@ -33,16 +35,16 @@ All get document URL parameters are optional.

 Parameter | Type | Description
 :--- | :--- | :---
-preference | string | Specifies a preference of which shard to retrieve results from. Available options are `_local`, which tells the operation to retrieve results from a locally allocated shard replica, and a custom string value assigned to a specific shard replica. By default, OpenSearch executes get document operations on random shards.
-realtime | boolean | Specifies whether the operation should run in realtime. If false, the operation waits for the index to refresh to analyze the source to retrieve data, which makes the operation near-realtime. Default is true.
-refresh | boolean | If true, OpenSearch refreshes shards to make the operation visible to searching. Default is false.
-routing | string | A value used to route the operation to a specific shard.
-stored_fields | boolean | If true, the operation retrieves document fields stored in the index rather than the document's `_source`. Default is false.
-_source | string | Whether to include the `_source` field in the response body. Default is true.
-_source_excludes | string | A comma-separated list of source fields to exclude in the query response.
-_source_includes | string | A comma-separated list of source fields to include in the query response.
-version | integer | The version of the document to return, which must match the current version of the document.
-version_type | enum | Retrieves a specifically typed document. Available options are `external` (retrieve the document if the specified version number is greater than the document's current version) and `external_gte` (retrieve the document if the specified version number is greater than or equal to the document's current verison). For example, to retrieve version 3 of a document, use `/_doc/1?version=3&version_type=external`.
+preference | String | Specifies a preference of which shard to retrieve results from. Available options are `_local`, which tells the operation to retrieve results from a locally allocated shard replica, and a custom string value assigned to a specific shard replica. By default, OpenSearch executes get document operations on random shards.
+realtime | Boolean | Specifies whether the operation should run in realtime. If false, the operation waits for the index to refresh to analyze the source to retrieve data, which makes the operation near-realtime. Default is true.
+refresh | Boolean | If true, OpenSearch refreshes shards to make the operation visible to searching. Default is false.
+routing | String | A value used to route the operation to a specific shard.
+stored_fields | Boolean | If true, the operation retrieves document fields stored in the index rather than the document's `_source`. Default is false.
+_source | String | Whether to include the `_source` field in the response body. Default is true.
+_source_excludes | String | A comma-separated list of source fields to exclude in the query response.
+_source_includes | String | A comma-separated list of source fields to include in the query response.
+version | Integer | The version of the document to return, which must match the current version of the document.
+version_type | Enum | Retrieves a specifically typed document. Available options are `external` (retrieve the document if the specified version number is greater than the document's current version) and `external_gte` (retrieve the document if the specified version number is greater than or equal to the document's current version). For example, to retrieve version 3 of a document, use `/_doc/1?version=3&version_type=external`.


 ## Response
@@ -67,7 +69,7 @@ Field | Description
 :--- | :---
 _index | The name of the index.
 _type | The document's type. OpenSearch only supports one type, which is `_doc`.
-_id | The document's id.
+_id | The document's ID.
 _version | The document's version number. Updated whenever the document changes.
 _seq_no | The sequnce number assigned when the document is indexed.
 primary_term | The primary term assigned when the document is indexed.
@@ -0,0 +1,95 @@
+---
+layout: default
+title: Index document
+parent: Document APIs
+grand_parent: REST API reference
+nav_order: 1
+---
+
+# Index document
+Introduced 1.0
+{: .label .label-purple}
+
+Before you can search for data, you must first add documents. This operation adds a single document to your index.
+
+## Example
+
+```json
+PUT sample-index/_doc/1
+{
+  "Description": "To be or not to be, that is the question."
+}
+```
+
+## Path and HTTP methods
+
+```
+PUT <index>/_doc/<_id>
+POST <index>/_doc
+
+PUT <index>/_create/<_id>
+POST <index>/_create/<_id>
+```
+
+## URL parameters
+
+In your request, you must specify the index you want to add your document to. If the index doesn't already exist, OpenSearch automatically creates the index and adds in your document. All other URL parameters are optional.
+
+Parameter | Type | Description | Required
+:--- | :--- | :--- | :---
+&lt;index&gt; | String | Name of the index. | Yes
+&lt;_id&gt; | String | A unique identifier to attach to the document. To automatically generate an ID, use `POST <target>/doc` in your request instead of PUT. | No
+if_seq_no | Integer | Only perform the operation if the document has the specified sequence number. | No
+if_primary_term | Integer | Only perform the operation if the document has the specified primary term. | No
+op_type | Enum | Specifies the type of operation to complete with the document. Valid values are `create` (create the index if it doesn't exist) and `index`. If a document ID is included in the request, then the default is `index`. Otherwise, the default is `create`. | No
+pipeline | String | ID used to route the indexing operation to a certain pipeline. | No
+routing | String | Value used to assign operations to specific shards. | No
+timeout | Time | How long to wait for a response from the cluster. Default is `1m`. | No
+version | Integer | The document's version number. | No
+version_type | Enum | Assigns a specific type to the document. Valid options are `external` (retrieve the document if the specified version number is greater than the document's current version) and `external_gte` (retrieve the document if the specified version number is greater than or equal to the document's current version). For example, to index version 3 of a document, use `/_doc/1?version=3&version_type=external`. | No
+wait_for_active_shards | String | The number of active shards that must be available before OpenSearch processes the request. Default is 1 (only the primary shard). Set to `all` or a positive integer. Values greater than 1 require replicas. For example, if you specify a value of 3, the index must have two replicas distributed across two additional nodes for the operation to succeed. | No
+require_alias | Boolean | Specifies whether the target index must be an index alias. Default is false. | No
+
+## Request body
+
+Your request body must contain the information you want to index.
+
+```json
+{
+  "Description": "This is just a sample document"
+}
+```
+
+## Response
+```json
+{
+  "_index": "sample-index",
+  "_type": "_doc",
+  "_id": "1",
+  "_version": 1,
+  "result": "created",
+  "_shards": {
+    "total": 2,
+    "successful": 1,
+    "failed": 0
+  },
+  "_seq_no": 0,
+  "_primary_term": 1
+}
+```
+
+## Response body fields
+
+Field | Description
+:--- | :---
+_index | The name of the index.
+_type | The document's type. OpenSearch supports only one type, which is `_doc`.
+_id | The document's ID.
+_version | The document's version.
+_result | The result of the index operation.
+_shards | Detailed information about the cluster's shards.
+total | The total number of shards.
+successful | The number of shards OpenSearch succssfully added the document to.
+failed | The number of shards OpenSearch failed to added the document to.
+_seq_no | The sequence number assigned when the document was indexed.
+_primary_term | The primary term assigned when the document was indexed.
@@ -4,6 +4,8 @@ title: Document APIs
 parent: REST API reference
 has_children: true
 nav_order: 7
+redirect_from:
+  - /opensearch/rest-api/document-apis/
 ---

 # Document APIs
@@ -0,0 +1,143 @@
+---
+layout: default
+title: Multi-get document
+parent: Document APIs
+grand_parent: REST API reference
+nav_order: 30
+---
+
+# Multi-get documents
+Introduced 1.0 
+{: .label .label-purple }
+
+The multi-get operation allows you to execute multiple GET operations in one request, so you can get back all documents that match your criteria.
+
+## Example without specifying index in URL
+
+```json
+GET _mget
+
+{
+  "docs": [
+  {
+    "_index": "sample-index1",
+    "_id": "1"
+  },
+  {
+    "_index": "sample-index2",
+    "_id": "1",
+    "_source": {
+      "include": ["Length"]
+    }
+  }
+  ]
+}
+```
+
+## Example of specifying index in URL
+
+```json
+GET sample-index1/_mget
+
+{
+  "docs": [
+    {
+      "_type": "_doc",
+      "_id": "1",
+      "_source": false
+    },
+    {
+      "_type": "_doc",
+      "_id": "2",
+      "_source": [ "Director", "Title" ]
+    }
+  ]
+}
+```
+
+## Path and HTTP methods
+
+```
+GET _mget
+GET <index>/_mget
+```
+
+## URL parameters
+
+All multi-get URL parameters are optional.
+
+Parameter | Type | Description
+:--- | :--- | :--- | :---
+&lt;index&gt; | String | Name of the index to retrieve documents from.
+preference | String | The node or shard that OpenSearch should perform the operation on. Default is random.
+realtime | Boolean | Specifies whether the operation should run in realtime. If false, the operation waits for the index to refresh to analyze the source to retrieve data, which makes the operation near-realtime. Default is `true`.
+refresh | Boolean | If true, OpenSearch refreshes shards to make the operation visible to searching. Default is `false`.
+routing | String | A value used to route the operation to a specific shard.
+stored_fields | Boolean | If true, the operation retrieves document fields stored in the index rather than the document's `_source`. Default is `false`.
+_source | String | Whether to include the `_source` field in the query response. Default is `true`.
+_source_excludes | String | A comma-separated list of source fields to exclude in the query response.
+_source_includes | String | A comma-separated list of source fields to include in the query response.
+
+## Request body
+
+If you don't specify an index in your request's URL, you must specify your target indices and the relevant document IDs in the request body. Other fields are optional.
+
+Field | Type | Description | Required
+:--- | :--- | :--- | :---
+docs | Array | The documents you want to retrieve data from. Can contain the attributes: `_id`, `_index`, `_routing`, `_source`, and `_stored_fields`. If you specify an index in the URL, you can omit this field and add IDs of the documents to retrieve. | Yes if an index is not specified in the URL
+_id | String | The ID of the document. | Yes if `docs` is specified in the request body
+_index | String | Name of the index. | Yes if an index is not specified in the URL
+_routing | String | The value of the shard that has the document. | Yes if a routing value was used when indexing the document
+_source | Object | Specifies whether to return the `_source` field from an index (boolean), whether to return specific fields (array), or whether to include or exclude certain fields. | No
+_source.includes | Array | Specifies which fields to include in the query response. For example, `"_source": { "include": ["Title"] }` retrieves `Title` from the index. | No
+_source.excludes | Array | Specifies which fields to exclude in the query response. For example, `"_source": { "exclude": ["Director"] }` excludes `Director` from the query response. | No
+ids | Array | IDs of the documents to retrieve. Only allowed when an index is specified in the URL. | No
+
+## Response
+```json
+{
+  "docs": [
+    {
+      "_index": "sample-index1",
+      "_type": "_doc",
+      "_id": "1",
+      "_version": 4,
+      "_seq_no": 5,
+      "_primary_term": 19,
+      "found": true,
+      "_source": {
+        "Title": "Batman Begins",
+        "Director": "Christopher Nolan"
+      }
+    },
+    {
+      "_index": "sample-index2",
+      "_type": "_doc",
+      "_id": "1",
+      "_version": 1,
+      "_seq_no": 6,
+      "_primary_term": 19,
+      "found": true,
+      "_source": {
+        "Title": "The Dark Knight",
+        "Director": "Christopher Nolan"
+      }
+    }
+  ]
+}
+```
+
+## Response body fields
+
+Field | Description
+:--- | :---
+_index | The name of the index.
+_type | The document's type. OpenSearch only supports one type, which is `_doc`.
+_id | The document's ID.
+_version | The document's version number. Updated whenever the document changes.
+_seq_no | The sequnce number assigned when the document is indexed.
+primary_term | The primary term assigned when the document is indexed.
+found | Whether the document exists.
+_routing | The shard that the document is routed to. If the document is not routed to a particular shard, this field is omitted.
+_source | Contains the document's data if `found` is true. If `_source` is set to false or `stored_fields` is set to true in the URL parameters, this field is omitted.
+_fields | Contains the document's data that's stored in the index. Only returned if both `stored_fields` and `found` are true.
@@ -0,0 +1,139 @@
+---
+layout: default
+title: Update by query
+parent: Document APIs
+grand_parent: REST API reference
+nav_order: 50
+---
+
+# Update by query
+Introduced 1.0
+{: .label .label-purple}
+
+You can include a query and a script as part of your update request so OpenSearch can run the script to update all of the documents that match the query.
+
+## Example
+
+```json
+POST test-index1/_update_by_query
+{
+  "query": {
+    "term": {
+      "oldValue": 10
+    }
+  },
+  "script" : {
+    "source": "ctx._source.oldValue += params.newValue",
+    "lang": "painless",
+    "params" : {
+      "newValue" : 20
+    }
+  }
+}
+```
+
+## Path and HTTP methods
+
+```
+POST <target-index1>, <target-index2>/_update_by_query
+```
+
+## URL parameters
+
+All URL parameters are optional.
+
+Parameter | Type | Description
+:--- | :--- | :--- | :---
+&lt;target-index&gt; | String | Comma-separated list of indices to update. To update all indices, use * or omit this parameter.
+allow_no_indices | String | If false, the request returns an error if wildcard expressions match closed or missing indices. Default is true.
+analyzer | String | Analyzer to use in the query string.
+analyze_wildcard | Boolean | Whether the operation should include wildcard and prefix queries in the analysis. Default is false.
+conflicts | String | Specifies whether the operation should continue if the request runs into version conflicts. Valid options are `abort` and `proceed`. Default is `abort`.
+default_operator | String | The default operator the string query should use. Valid options are `AND` and `OR`. Default is `OR`.
+df | String | The default field when the query string does not have a field prefix.
+expand_wildcards | String | Specifies the type of index that wildcard expressions can match. Supports comma-separated values. Valid values are `all` (match any index), `open` (match open, non-hidden indices), `closed` (match closed, non-hidden indices), `hidden` (match hidden indices), and `none` (deny wildcard expressions). Default is `open`.
+from | Integer | The starting index to search from. Default is 0.
+ignore_unavailable | Boolean | Whether to exclude missing or closed indices in the response. Default is false.
+lenient | Boolean | Whether OpenSearch should ignore format-based query failures (for example, querying an integer field for a string). Default is false.
+max_docs | Integer | Maximum number of documents the request should process. Default is all documents.
+pipeline | String | ID of the pipeline to use to process documents.
+preference | String | The node or shard OpenSearch should perform the operation on.
+q | String | Query in the Lucene query string syntax.
+request_cache | Boolean | Whether OpenSearch should use the request cache for the operation. Default is whether it's enabled in the index's settings.
+refresh | Boolean | Specifies whether OpenSearch should refresh shards involved in the operation to make the operation visible to searching.
+requests_per_second | Integer | Specifies the request's throttling in sub-requests per second. Default is -1, which means no throttling.
+routing | String | Value used to route the operation to a specific shard.
+scroll | Time | How long to keep the search context open.
+scroll_size | Integer | Size of the operation's scroll request. Default is 1000.
+search_type | String | Whether OpenSearch should use global term and document frequencies calculating revelance scores. Valid choices are `query_then_fetch` and `dfs_query_then_fetch`. `query_then_fetch` scores documents using local term and document frequencies for the shard. It’s usually faster but less accurate. `dfs_query_then_fetch` scores documents using global term and document frequencies across all shards. It’s usually slower but more accurate. Default is `query_then_fetch`.
+search_timeout | Time | Amount of time until timeout for the search request. Default is no timeout.
+slices | Integer | Number of sub-tasks OpenSearch should divide this task into. Default is 1, which means OpenSearch should not divide this task.
+sort | String | A comma-separated list of &lt;field&gt; : &lt;direction&gt; pairs to sort by.
+_source | String | Whether to include the `_source` field in the response.
+_source_excludes | String | A comma-separated list of source fields to exclude from the response.
+_source_includes | String | A comma-separated list of source fields to include in the response.
+stats | String | Value to associate with the request for additional logging.
+terminate_after | Integer | The maximum number of documents OpenSearch should process before terminating the request.
+timeout | Time | How long the operation should wait from a response from active shards. Default is `1m`.
+version | Boolean | Whether to include the document version as a match.
+wait_for_active_shards | String | The number of shards that must be active before OpenSearch executes the operation. Valid values are `all` or any integer up to the total number of shards in the index. Default is 1, which is the primary shard.
+
+## Request body
+
+To update your indices and documents by query, you must include a [query]({{site.baseurl}}{{site.url}}/opensearch/query-dsl/index) and a script in the request body that OpenSearch can run to update your documents. If you don't specify a query, then every document in the index gets updated.
+
+```json
+{
+  "query": {
+    "term": {
+      "oldValue": 20
+    }
+  },
+  "script" : {
+    "source": "ctx._source.oldValue += params.newValue",
+    "lang": "painless",
+    "params" : {
+      "newValue" : 10
+    }
+  }
+}
+```
+
+## Response
+```json
+{
+  "took": 21,
+  "timed_out": false,
+  "total": 1,
+  "updated": 1,
+  "deleted": 0,
+  "batches": 1,
+  "version_conflicts": 0,
+  "noops": 0,
+  "retries": {
+    "bulk": 0,
+    "search": 0
+  },
+  "throttled_millis": 0,
+  "requests_per_second": -1.0,
+  "throttled_until_millis": 0,
+  "failures": []
+}
+```
+
+## Response body fields
+
+Field | Description
+:--- | :---
+took | The amount of time in milliseconds OpenSearch needed to complete the operation.
+timed_out | Whether any update requests during the operation timed out.
+total | Total number of documents processed.
+updated | Total number of documents updated.
+batches | Number of scroll responses the request processed.
+version_conflicts | Number of conflicts the request ran into.
+noops | How many update requests OpenSearch ignored during the operation. This field always returns 0.
+retries | The number of bulk and search retry requests.
+throttled_millis | Number of throttled milliseconds during the request.
+requests_per_second | Number of requests executed per second during the operation.
+throttled_until_millis | The amount of time until OpenSearch executes the next throttled request. Always equal to 0 in an update by query request.
+failures | Any failures that occur during the request.
@@ -0,0 +1,126 @@
+---
+layout: default
+title: Update document
+parent: Document APIs
+grand_parent: REST API reference
+nav_order: 10
+---
+
+# Update document
+Introduced 1.0
+{: .label .label-purple }
+
+If you need to update a document's fields in your index, you can use the update document API operation. You can do so by specifying the new data you want in your index or by including a script in your request body, which OpenSearch runs to update the document.
+
+## Example
+
+```json
+POST /sample-index1/_update/1
+{
+  "doc": {
+    "first_name" : "Bruce",
+    "last_name" : "Wayne"
+  }
+}
+```
+
+## Script example
+
+```json
+POST /test-index1/_update/1
+{
+  "script" : {
+    "source": "ctx._source.oldValue += params.newValue",
+    "lang": "painless",
+    "params" : {
+      "newValue" : 10
+    }
+  }
+}
+```
+
+## Path and HTTP methods
+
+```
+POST /<index-name>/_update/<_id>
+```
+
+## URL parameters
+
+Parameter | Type | Description | Required
+:--- | :--- | :--- | :---
+&lt;index-name&gt; | String | Name of the index. | Yes
+&lt;_id&gt; | String | The ID of the document to update. | Yes
+if_seq_no | Integer | Only perform the delete operation if the document's version number matches the specified number. | No
+if_primary_term | Integer | Only perform the delete operation if the document has the specified primary term. | No
+lang | String | Language of the script. Default is `painless`. | No
+require_alias | Boolean | Specifies whether the destination must be an index alias. Default is false. | No
+refresh | Enum | If true, OpenSearch refreshes shards to make the operation visible to searching. Valid options are `true`, `false`, and `wait_for`, which tells OpenSearch to wait for a refresh before executing the operation. Default is false. | No
+retry_on_conflict | Integer | The amount of times OpenSearch should retry the operation if there's a document conflict. Default is 0. | No
+routing | String | Value used to route the operation to a specific shard. | No
+_source | List | Whether to include the `_source` field in the response body. Default is true. | No
+_source_excludes | List | A comma-separated list of source fields to exclude in the query response. | No
+_source_includes | List | A comma-separated list of source fields to include in the query response. | No
+timeout | Time | How long to wait for a response from the cluster. | No
+wait_for_active_shards | String | The number of active shards that must be available before OpenSearch processes the update request. Default is 1 (only the primary shard). Set to `all` or a positive integer. Values greater than 1 require replicas. For example, if you specify a value of 3, the index must have two replicas distributed across two additional nodes for the operation to succeed. | No
+
+## Request body
+
+Your request body must contain the information you want to update your document with. If you just want to replace certain fields in your document, your request body must include a `doc` object, which has the fields you want to update.
+
+```json
+{
+  "doc": {
+    "first_name": "Thomas",
+    "last_name": "Wayne"
+    }
+}
+```
+
+You can also use a script to tell OpenSearch how to update your document.
+
+```json
+{
+  "script" : {
+    "source": "ctx._source.oldValue += params.newValue",
+    "lang": "painless",
+    "params" : {
+      "newValue" : 10
+    }
+  }
+}
+```
+
+## Response
+```json
+{
+  "_index": "sample-index1",
+  "_type": "_doc",
+  "_id": "1",
+  "_version": 3,
+  "result": "updated",
+  "_shards": {
+    "total": 2,
+    "successful": 2,
+    "failed": 0
+  },
+  "_seq_no": 4,
+  "_primary_term": 17
+}
+```
+
+## Response body fields
+
+Field | Description
+:--- | :---
+_index | The name of the index.
+_type | The document's type. OpenSearch only supports one type, which is `_doc`.
+_id | The document's ID.
+_version | The document's version.
+_result | The result of the delete operation.
+_shards | Detailed information about the cluster's shards.
+total | The total number of shards.
+successful | The number of shards OpenSearch succssfully deleted the document from.
+failed | The number of shards OpenSearch failed to delete the document from.
+_seq_no | The sequence number assigned when the document was indexed.
+_primary_term | The primary term assigned when the document was indexed.
@@ -0,0 +1,163 @@
+---
+layout: default
+title: Explain
+parent: REST API reference
+nav_order: 140
+---
+
+# Explain
+Introduced 1.0
+{: .label .label-purple }
+
+Wondering why a specific document ranks higher (or lower) for a query? You can use the explain API for an explanation of how the relevance score (`_score`) is calculated for every result.
+
+OpenSearch uses a probabilistic ranking framework called [Okapi BM25](https://en.wikipedia.org/wiki/Okapi_BM25) to calculate relevance scores. Okapi BM25 is based on the original [TF/IDF](http://lucene.apache.org/core/4_0_0/core/org/apache/lucene/search/package-summary.html#scoring) framework used by Apache Lucene.
+
+The explain API is an expensive operation in terms of both resources and time. On production clusters, we recommend using it sparingly for the purpose of troubleshooting.
+{: .warning }
+
+
+## Example
+
+To see the explain output for all results, set the `explain` flag to `true` either in the URL or in the body of the request:
+
+```json
+POST kibana_sample_data_ecommerce/_search?explain=true
+{
+  "query": {
+    "match": {
+      "customer_first_name": "Mary"
+    }
+  }
+}
+```
+
+More often, you want the output for a single document. In that case, specify the document ID in the URL:
+
+```json
+POST kibana_sample_data_ecommerce/_explain/EVz1Q3sBgg5eWQP6RSte
+{
+  "query": {
+    "match": {
+      "customer_first_name": "Mary"
+    }
+  }
+}
+```
+
+## Path and HTTP methods
+
+```
+GET <target>/_explain/<id>
+POST <target>/_explain/<id>
+```
+
+## URL parameters
+
+You must specify the index and document ID. All other URL parameters are optional.
+
+Parameter | Type | Description | Required
+:--- | :--- | :--- | :---
+`<index>` | String | Name of the index. You can only specify a single index. | Yes
+`<_id>` | String | A unique identifier to attach to the document. | Yes
+`analyzer` | String | The analyzer to use in the query string. | No
+`analyze_wildcard` | Boolean | Specifies whether to analyze wildcard and prefix queries. Default is false. | No
+`default_operator` | String | Indicates whether the default operator for a string query should be AND or OR. Default is OR. | No
+`df` | String | The default field in case a field prefix is not provided in the query string. | No
+`lenient` | Boolean | Specifies whether OpenSearch should ignore format-based query failures (for example, querying a text field for an integer). Default is false. | No
+`preference` | String | Specifies a preference of which shard to retrieve results from. Available options are `_local`, which tells the operation to retrieve results from a locally allocated shard replica, and a custom string value assigned to a specific shard replica. By default, OpenSearch executes the explain operation on random shards. | No
+`q` | String | Query in the Lucene query string syntax. | No
+`stored_fields` | Boolean | If true, the operation retrieves document fields stored in the index rather than the document’s `_source`. Default is false. | No
+`routing` | String | Value used to route the operation to a specific shard. | No
+`_source` | String | Whether to include the `_source` field in the response body. Default is true. | No
+`_source_excludes` | String | A comma-separated list of source fields to exclude in the query response. | No
+`_source_includes` | String | A comma-separated list of source fields to include in the query response. | No
+
+## Response
+
+```json
+{
+  "_index" : "kibana_sample_data_ecommerce",
+  "_type" : "_doc",
+  "_id" : "EVz1Q3sBgg5eWQP6RSte",
+  "matched" : true,
+  "explanation" : {
+    "value" : 3.5671005,
+    "description" : "weight(customer_first_name:mary in 1) [PerFieldSimilarity], result of:",
+    "details" : [
+      {
+        "value" : 3.5671005,
+        "description" : "score(freq=1.0), computed as boost * idf * tf from:",
+        "details" : [
+          {
+            "value" : 2.2,
+            "description" : "boost",
+            "details" : [ ]
+          },
+          {
+            "value" : 3.4100041,
+            "description" : "idf, computed as log(1 + (N - n + 0.5) / (n + 0.5)) from:",
+            "details" : [
+              {
+                "value" : 154,
+                "description" : "n, number of documents containing term",
+                "details" : [ ]
+              },
+              {
+                "value" : 4675,
+                "description" : "N, total number of documents with field",
+                "details" : [ ]
+              }
+            ]
+          },
+          {
+            "value" : 0.47548598,
+            "description" : "tf, computed as freq / (freq + k1 * (1 - b + b * dl / avgdl)) from:",
+            "details" : [
+              {
+                "value" : 1.0,
+                "description" : "freq, occurrences of term within document",
+                "details" : [ ]
+              },
+              {
+                "value" : 1.2,
+                "description" : "k1, term saturation parameter",
+                "details" : [ ]
+              },
+              {
+                "value" : 0.75,
+                "description" : "b, length normalization parameter",
+                "details" : [ ]
+              },
+              {
+                "value" : 1.0,
+                "description" : "dl, length of field",
+                "details" : [ ]
+              },
+              {
+                "value" : 1.1206417,
+                "description" : "avgdl, average length of field",
+                "details" : [ ]
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
+```
+
+## Response body fields
+
+Field | Description
+:--- | :---
+`matched` | Indicates if the document is a match for the query.
+`explanation` | The `explanation` object has three properties: `value`, `description`, and `details`. The `value` shows the result of the calculation, the `description` explains what type of calculation is performed, and the `details` shows any subcalculations performed.
+Term frequency (`tf`) | How many times the term appears in a field for a given document. The more times the term occurs the higher is the relevance score.
+Inverse document frequency (`idf`) | How often the term appears within the index (across all the documents). The more often the term appears the lower is the relevance score.
+Field normalization factor (`fieldNorm`) | The length of the field. OpenSearch assigns a higher relevance score to a term appearing in a relatively short field.
+
+The `tf`, `idf`, and `fieldNorm` values are calculated and stored at index time when a document is added or updated. The values might have some (typically small) inaccuracies as it’s based on summing the samples returned from each shard.  
+
+Individual queries include other factors for calculating the relevance score, such as term proximity, fuzziness, and so on.
@@ -0,0 +1,246 @@
+---
+layout: default
+title: Multi search
+parent: REST API reference
+nav_order: 130
+---
+
+# Multi search
+Introduced 1.0
+{: .label .label-purple }
+
+The multi-search operation lets you bundle multiple search requests and send them to your OpenSearch cluster in a single request. This operation executes searches in parallel, so you get back the response more quickly as compared to independent search requests. It also executes each request independently, so the failure of one request doesn't affect the others.
+
+The multi-search request body follows this pattern:
+
+```
+header\n
+body\n
+header\n
+body\n
+```
+
+OpenSearch uses newline characters to parse multi-search requests and requires that each request ends with a newline character.
+
+## Example
+
+```json
+GET _msearch
+{"index":"opensearch_dashboards_sample_data_logs"}
+{"query":{"match_all":{}},"from":0,"size":10}
+{"index":"opensearch_dashboards_sample_data_ecommerce","search_type":"dfs_query_then_fetch"}
+{"query":{"match_all":{}}}
+```
+
+## Path and HTTP methods
+
+```
+GET <target>/_msearch
+```
+
+## URL parameters
+
+All multi-search URL parameters are optional.
+
+Parameter | Type | Description
+:--- | :--- | :---
+`allow_no_indices` | Boolean | Whether to ignore wildcards that don't match any indices. Default is `true`.
+`css_minimize_roundtrips` | Boolean | If true, network roundtrips between the local node and remote clusters are minimized for cross-cluster search requests. Default is `true`.
+`expand_wildcards` | Enum | Expands wildcard expressions to concrete indices. Combine multiple values with commas. Supported values are `all`, `open`, `closed`, `hidden`, and `none`. Default is `open`.
+`ignore_unavailable` | Boolean | If an index from the indices list doesn’t exist, whether to ignore it rather than fail the query. Default is `false`.
+`max_concurrent_searches` | Integer | Maximum number of searches executed in parallel. Default is `max(1, (number of of data nodes * min(search thread pool size, 10)))`.
+`max_concurrent_shard_requests` | Integer | Maximum number of concurrent shard requests that each sub-search request executes per node. Default is 5. If you have an environment where a very low number of concurrent search requests is expected, a higher value of this parameter might improve performance.
+`pre_filter_shard_size` | Integer | Defines a threshold that enforces a round-trip to pre-filter search shards that cannot possibly match. This filter phase can limit the number of searched shards significantly. For instance, if a date range filter is applied, then all indices that don't contain documents within that date range are skipped. Default is 128.
+`rest_total_hits_as_int` | String | Whether the `hits.total` property is returned as an integer or an object. Default is `false`.
+`search_type` | String | Whether global term and document frequencies are used when calculating the relevance score. Valid choices are `query_then_fetch` and `dfs_query_then_fetch`. `query_then_fetch` scores documents using local term and document frequencies for the shard. It's usually faster but less accurate. `dfs_query_then_fetch` scores documents using global term and document frequencies across all shards. It's usually slower but more accurate. Default is `query_then_fetch`.
+`typed_keys` | Boolean | Whether aggregation names are prefixed by their internal types in the response. Default is `false`.
+
+## Response
+
+You get back the responses in an array form, where the search response for each search request matches its order in the original multi-search request.
+
+```json
+{
+  "took" : 2150,
+  "responses" : [
+    {
+      "took" : 2149,
+      "timed_out" : false,
+      "_shards" : {
+        "total" : 1,
+        "successful" : 1,
+        "skipped" : 0,
+        "failed" : 0
+      },
+      "hits" : {
+        "total" : {
+          "value" : 10000,
+          "relation" : "gte"
+        },
+        "max_score" : 1.0,
+        "hits" : [
+          {
+            "_index" : "opensearch_dashboards_sample_data_logs",
+            "_type" : "_doc",
+            "_id" : "_fnhBXsBgv2Zxgu9dZ8Y",
+            "_score" : 1.0,
+            "_source" : {
+              "agent" : "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)",
+              "bytes" : 4657,
+              "clientip" : "213.116.129.196",
+              "extension" : "zip",
+              "geo" : {
+                "srcdest" : "CN:US",
+                "src" : "CN",
+                "dest" : "US",
+                "coordinates" : {
+                  "lat" : 42.35083333,
+                  "lon" : -86.25613889
+                }
+              },
+              "host" : "artifacts.opensearch.org",
+              "index" : "opensearch_dashboards_sample_data_logs",
+              "ip" : "213.116.129.196",
+              "machine" : {
+                "ram" : 16106127360,
+                "os" : "ios"
+              },
+              "memory" : null,
+              "message" : "213.116.129.196 - - [2018-07-30T14:12:11.387Z] \"GET /opensearch_dashboards/opensearch_dashboards-1.0.0-windows-x86_64.zip HTTP/1.1\" 200 4657 \"-\" \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)\"",
+              "phpmemory" : null,
+              "referer" : "http://twitter.com/success/ellison-onizuka",
+              "request" : "/opensearch_dashboards/opensearch_dashboards-1.0.0-windows-x86_64.zip",
+              "response" : 200,
+              "tags" : [
+                "success",
+                "info"
+              ],
+              "timestamp" : "2021-08-02T14:12:11.387Z",
+              "url" : "https://artifacts.opensearch.org/downloads/opensearch_dashboards/opensearch_dashboards-1.0.0-windows-x86_64.zip",
+              "utc_time" : "2021-08-02T14:12:11.387Z",
+              "event" : {
+                "dataset" : "sample_web_logs"
+              }
+            }
+          },
+          ...
+        ]
+      },
+      "status" : 200
+    },
+    {
+      "took" : 1473,
+      "timed_out" : false,
+      "_shards" : {
+        "total" : 1,
+        "successful" : 1,
+        "skipped" : 0,
+        "failed" : 0
+      },
+      "hits" : {
+        "total" : {
+          "value" : 4675,
+          "relation" : "eq"
+        },
+        "max_score" : 1.0,
+        "hits" : [
+          {
+            "_index" : "opensearch_dashboards_sample_data_ecommerce",
+            "_type" : "_doc",
+            "_id" : "efnhBXsBgv2Zxgu9ap7e",
+            "_score" : 1.0,
+            "_source" : {
+              "category" : [
+                "Women's Clothing"
+              ],
+              "currency" : "EUR",
+              "customer_first_name" : "Gwen",
+              "customer_full_name" : "Gwen Dennis",
+              "customer_gender" : "FEMALE",
+              "customer_id" : 26,
+              "customer_last_name" : "Dennis",
+              "customer_phone" : "",
+              "day_of_week" : "Tuesday",
+              "day_of_week_i" : 1,
+              "email" : "gwen@dennis-family.zzz",
+              "manufacturer" : [
+                "Tigress Enterprises",
+                "Gnomehouse mom"
+              ],
+              "order_date" : "2021-08-10T16:24:58+00:00",
+              "order_id" : 576942,
+              "products" : [
+                {
+                  "base_price" : 32.99,
+                  "discount_percentage" : 0,
+                  "quantity" : 1,
+                  "manufacturer" : "Tigress Enterprises",
+                  "tax_amount" : 0,
+                  "product_id" : 22182,
+                  "category" : "Women's Clothing",
+                  "sku" : "ZO0036600366",
+                  "taxless_price" : 32.99,
+                  "unit_discount_amount" : 0,
+                  "min_price" : 14.85,
+                  "_id" : "sold_product_576942_22182",
+                  "discount_amount" : 0,
+                  "created_on" : "2016-12-20T16:24:58+00:00",
+                  "product_name" : "Jersey dress - black/red",
+                  "price" : 32.99,
+                  "taxful_price" : 32.99,
+                  "base_unit_price" : 32.99
+                },
+                {
+                  "base_price" : 28.99,
+                  "discount_percentage" : 0,
+                  "quantity" : 1,
+                  "manufacturer" : "Gnomehouse mom",
+                  "tax_amount" : 0,
+                  "product_id" : 14230,
+                  "category" : "Women's Clothing",
+                  "sku" : "ZO0234902349",
+                  "taxless_price" : 28.99,
+                  "unit_discount_amount" : 0,
+                  "min_price" : 13.05,
+                  "_id" : "sold_product_576942_14230",
+                  "discount_amount" : 0,
+                  "created_on" : "2016-12-20T16:24:58+00:00",
+                  "product_name" : "Blouse - june bug",
+                  "price" : 28.99,
+                  "taxful_price" : 28.99,
+                  "base_unit_price" : 28.99
+                }
+              ],
+              "sku" : [
+                "ZO0036600366",
+                "ZO0234902349"
+              ],
+              "taxful_total_price" : 61.98,
+              "taxless_total_price" : 61.98,
+              "total_quantity" : 2,
+              "total_unique_products" : 2,
+              "type" : "order",
+              "user" : "gwen",
+              "geoip" : {
+                "country_iso_code" : "US",
+                "location" : {
+                  "lon" : -118.2,
+                  "lat" : 34.1
+                },
+                "region_name" : "California",
+                "continent_name" : "North America",
+                "city_name" : "Los Angeles"
+              },
+              "event" : {
+                "dataset" : "sample_ecommerce"
+              }
+            }
+          },
+         ...
+        ]
+      },
+      "status" : 200
+    }
+  ]
+}
+```
@@ -6,6 +6,8 @@ nav_order: 120
 ---

 # Scroll
+Introduced 1.0
+{: .label .label-purple }

 You can use the `scroll` operation to retrieve a large number of results. For example, for machine learning jobs, you can request an unlimited number of results in batches.

@@ -3,11 +3,11 @@ layout: default
 title: Tasks
 parent: REST API reference
 nav_order: 80
-redirect_from:
-  - /opensearch/tasksapi/
 ---

 # Tasks
+Introduced 1.0
+{: .label .label-purple }

 A task is any operation you run in a cluster. For example, searching your data collection of books for a title or author name is a task. When you run OpenSearch, a task is automatically created to monitor your cluster's health and performance. For more information about all of the tasks currently executing in your cluster, you can use the `tasks` API operation.

@@ -0,0 +1,80 @@
+---
+layout: default
+title: Update mapping
+parent: REST API reference
+nav_order: 6
+---
+
+# Update mapping
+
+If you want to update an index's mappings to add or update field types after index creation, you can do so with the update mapping API operation.
+
+Note that you cannot use this operation to update mappings that already map to existing data in the index. You must first create a new index with your desired mappings, and then use the [reindex API operation]({{site.url}}{{site.baseurl}}/opensearch/reindex-data) to map all the documents from your old index to the new index. If you don't want any downtime while reindexing your indices, you can use [aliases]({{site.url}}{{site.baseurl}}/opensearch/index-alias).
+
+## Example
+
+```json
+PUT /sample-index/_mapping
+
+{
+  "properties": {
+    "age": {
+      "type": "integer"
+    },
+    "occupation":{
+      "type": "text"
+    }
+  }
+}
+```
+
+
+## Path and HTTP methods
+
+```
+PUT /<target-index>/_mapping
+```
+
+You can also use the update mapping operation to update multiple indices with one request.
+
+```
+PUT /<target-index1>,<target-index2>/_mapping
+```
+
+## URL parameters
+
+All update mapping parameters are optional.
+
+Parameter | Data Type | Description
+:--- | :--- | :---
+allow_no_indices | Boolean | If false, the request returns an error if any wildcard expresion or index alias targets any closed or missing indices. Defaults to false.
+expand_wildcards | String | Expands wildcard expressions to different indices. Combine multiple values with commas. Available values are `all` (match all indices), `open` (match open indices), `closed` (match closed indices), `hidden` (match hidden indices), and `none` (do not accept wildcard expressions), which must be used with `open`, `closed`, or both. Default is `open`.
+ignore_unavailable | Boolean | If true, OpenSearch does not include missing or closed indices in the response.
+master_timeout | Time | How long to wait for a connection to the master node. Default is `30s`.
+timeout | Time | How long to wait for the response to return. Default is `30s`.
+write_index_only | Boolean | If true, the specified mappings are applied only to the write index.
+
+## Request body
+
+The request body must contain `properties`, which has all of the mappings that you want to update.
+
+```json
+{
+  "properties":{
+    "color":{
+      "type": "text"
+    },
+    "year":{
+      "type": "integer"
+    }
+  }
+}
+```
+
+## Response
+
+```json
+{
+    "acknowledged": true
+}
+```
@@ -12,7 +12,7 @@ For example, if you use OpenSearch as a backend search engine for your applicati

 When you're writing code to convert user input into OpenSearch queries, you can simplify your code with search templates. If you need to add fields to your search query, you can just modify the template without making changes to your code.

-Search templates use the Mustache language. For a list of all syntax options, see the [Mustache manual](http://mustache.github.io/mustache.5.html).
+Search templates use the Mustache language. For a list of all syntax options, see the [Mustache manual](https://mustache.github.io/mustache.5.html).
 {: .note }

 ## Create search templates
@@ -6,7 +6,7 @@ nav_order: 65

 # Take and restore snapshots

-Snapshots are backups of a cluster's indices and state. State includes cluster settings, node information, index settings, and shard allocation.
+Snapshots are backups of a cluster's indices and state. State includes cluster settings, node information, index metadata (mappings, settings, templates, etc.), and shard allocation.

 Snapshots have two main uses:

@@ -0,0 +1,232 @@
+# frozen_string_literal: true
+
+require "jekyll/hooks"
+require "jekyll/document"
+require "json"
+require "set"
+require "uri"
+require "pathname"
+
+##
+# This singleton checks links during build to warn or fail upon finding dead links.
+#
+# `JEKYLL_CHECK_EXTERNAL_LINKS`, set on the environment, will cause verification of external links, irrespective of its
+# value. Usage: `JEKYLL_CHECK_EXTERNAL_LINKS= bundle exec jekyll build --trace`
+#
+# `JEKYLL_FATAL_LINK_CHECKER`, set on the environment, will cause the build to fail if an internal dead link is found.
+# If set as `JEKYLL_FATAL_LINK_CHECKER=2`, the build will fail for internal and external dead links; in this case, there
+# is no need to set `JEKYLL_CHECK_EXTERNAL_LINKS`.
+
+module Jekyll::LinkChecker
+
+  ##
+  # The collection that will get stores as the output
+
+  @urls = {}
+
+  ##
+  # Pattern to identify documents that should be excluded based on their URL
+
+  @excluded_paths = /(\.(css|js|json|map|xml|txt|yml)$)/i.freeze
+
+  ##
+  # Pattern to identify certain HTML tags whose content should be excluded from indexing
+
+  @href_matcher = /<a[^>]+href=(['"])(.+?)\1/im.freeze
+
+  ##
+  # Pattern to check for external URLs
+
+  @external_matcher = /^https?:\/\//.freeze
+
+  ##
+  # List of domains to ignore
+  @ignored_domains = %w[localhost]
+
+  ##
+  # Pattern of local paths to ignore
+  @ignored_paths = /(^\/javadocs\/)/.freeze
+
+  ##
+  # Valid response codes for successful links
+  @success_codes = %w[200 302]
+
+  ##
+  # Questionable response codes for successful links
+  @questionable_codes = %w[301 403 429]
+
+  ##
+  # Holds the list of failures
+  @failures = []
+
+  ##
+  # Driven by environment variables, it indicates a need to check external links
+  @check_external_links
+
+  ##
+  # Driven by environment variables, it indicates the need to fail the build for dead links
+  @should_build_fatally
+
+
+  ##
+  # Initializes the singleton by recording the site
+
+  def self.init(site)
+    @site = site
+    @urls = {}
+    @failures = []
+  end
+
+  ##
+  # Processes a Document or Page and adds the links to a collection
+  # It also checks for anchors to parts of the same page/doc
+
+  def self.process(page)
+    return if @excluded_paths.match(page.path)
+
+    hrefs = page.content.scan(@href_matcher)
+    hrefs.each do |(_, href)|
+      relative_path = page.path[0] == '/' ? Pathname.new(page.path).relative_path_from(Dir.getwd) : page.path
+
+      if href.start_with? '#'
+        p relative_path if (page.content =~ /<[a-z0-9-]+[^>]+id="#{href[1..]}"/i).nil?
+        @failures << "##{href[1..]}, linked in ./#{relative_path}" if (page.content =~ /<[a-z0-9-]+[^>]+id="#{href[1..]}"/i).nil?
+      else
+        @urls[href] = Set[] unless @urls.key?(href)
+        @urls[href] << relative_path
+      end
+    end
+  end
+
+  ##
+  # Saves the collection as a JSON file
+
+  def self.verify(site)
+    if ENV.key?('JEKYLL_CHECK_EXTERNAL_LINKS')
+      @check_external_links = true
+      puts "LinkChecker: [Notice] Will verify external links"
+    end
+
+    if ENV.key?('JEKYLL_FATAL_LINK_CHECKER')
+      @should_build_fatally = true
+      if ENV['JEKYLL_FATAL_LINK_CHECKER'] == '2'
+        @check_external_links = true
+        puts "LinkChecker: [Notice] The build will fail if any dead links are found"
+      else
+        puts "LinkChecker: [Notice] The build will fail if a dead internal link is found"
+      end
+    end
+
+    @base_url_matcher = /^#{@site.config["url"]}#{@site.baseurl}(\/.*)$/.freeze
+
+    @urls.each do |url, pages|
+      @failures << "#{url}, linked to in ./#{pages.to_a.join(", ./")}" unless self.check(url)
+    end
+    
+    msg = "Found #{@failures.size} dead link#{@failures.size > 1 ? 's' : ''}:\n#{@failures.join("\n")}" unless @failures.empty?
+
+    if @should_build_fatally
+      raise msg
+    else
+      puts "\nLinkChecker: [Warning] #{msg}\n"
+    end
+  end
+
+  ##
+  # Check if URL is accessible
+
+  def self.check(url)
+    match = @base_url_matcher.match(url)
+    unless match.nil?
+      url = match[1]
+    end
+
+    if @external_matcher =~ url
+      return true unless @check_external_links
+      return self.check_external(url)
+    end
+
+    return self.check_internal(url)
+  end
+
+  ##
+  # Check if an external URL is accessible by making a HEAD call
+
+  def self.check_external(url)
+    uri = URI(url)
+    return true if @ignored_domains.include? uri.host
+
+    (Net::HTTP.new uri.host, uri.port).tap do |http|
+      http.use_ssl = true
+    end.start do |http|
+      http.use_ssl = (uri.scheme == "https")
+
+      request = Net::HTTP::Get.new(uri)
+
+      http.request(request) do |response|
+        return true if @success_codes.include? response.code
+
+        puts "LinkChecker: [Warning] Got #{response.code} from #{url}"
+        return @questionable_codes.include? response.code
+      end
+    end
+  end
+
+  ##
+  # Check if an internal link is accessible
+
+  def self.check_internal(url)
+    return true if @ignored_paths =~ url
+
+    path, hash = url.split('#')
+
+    unless path.end_with? 'index.html'
+      path << '/' unless path.end_with? '/'
+      path << 'index.html' unless path.end_with? 'index.html'
+    end
+
+    filename = File.join(@site.config["destination"], path)
+
+    return false unless File.file?(filename)
+
+    content = File.read(filename)
+    unless content.include? "<title>Redirecting"
+      return true if hash.nil? || hash.empty?
+      return !(content =~ /<[a-z0-9-]+[^>]+id="#{hash}"/i).nil?
+    end
+
+    match = content.match(@href_matcher)
+    if match.nil?
+      puts "LinkChecker: [Warning] Cannot check #{url} due to an unfollowable redirect"
+      return true
+    end
+
+    redirect = match[2]
+    redirect << '#' + hash unless hash.nil? || hash.empty?
+    return self.check(redirect)
+  end
+end
+
+# Before any Document or Page is processed, initialize the LinkChecker
+
+Jekyll::Hooks.register :site, :pre_render do |site|
+  Jekyll::LinkChecker.init(site)
+end
+
+# Process a Page as soon as its content is ready
+
+Jekyll::Hooks.register :pages, :post_convert do |page|
+  Jekyll::LinkChecker.process(page)
+end
+
+# Process a Document as soon as its content is ready
+
+Jekyll::Hooks.register :documents, :post_convert do |document|
+  Jekyll::LinkChecker.process(document)
+end
+
+# Verify gathered links after Jekyll is done writing all its stuff
+
+Jekyll::Hooks.register :site, :post_write do |site|
+  Jekyll::LinkChecker.verify(site)
+end
@@ -205,21 +205,24 @@ td {
 }

 // Keeps labels high and tight next to headers
-h1 + p.label {
-  margin: -23px 0 0 0;
+h1 + p.label, h1 + p.label + p.label,
+h2 + p.label, h2 + p.label + p.label,
+h3 + p.label, h3 + p.label + p.label,
+h4 + p.label, h4 + p.label + p.label,
+h5 + p.label, h5 + p.label + p.label,
+h6 + p.label, h6 + p.label + p.label {
+  margin: -20px 0 0 0;
 }
-h2 + p.label {
-  margin: -15px 0 0 0;
-}
-h3 + p.label {
-  margin: -10px 0 0 0;
-}
-h4 + p.label,
-h5 + p.label,
-h6 + p.label {
-  margin: -7px 0 0 0;
+
+p.label {
+  a {
+    color: inherit;
+    background-image: none;
+    &:hover { background-image: none; }
+  }
 }

+
 // Modifies margins in xl layout to support TOC
 .side-bar {
  @include mq(xl) {
@@ -1098,4 +1101,4 @@ main {
      background: none;
    }
  }
-}
+}
@@ -4,7 +4,6 @@ title: Asynchronous search
 nav_order: 51
 has_children: true
 redirect_from:
-  - /docs/async/
  - /search-plugins/async/
 ---

@@ -15,6 +14,8 @@ Searching large volumes of data can take a long time, especially if you're searc
 Asynchronous search in OpenSearch lets you send search requests that run in the background. You can monitor the progress of these searches and get back partial results as they become available. After the search finishes, you can save the results to examine at a later time.

 ## REST API
+Introduced 1.0
+{: .label .label-purple }

 To perform an asynchronous search, send requests to `_plugins/_asynchronous_search`, with your query in the request body:

@@ -112,6 +113,8 @@ Options | Description
 `aggregations` | The partial aggregation results that have been completed by the shards so far.

 ## Get partial results
+Introduced 1.0
+{: .label .label-purple }

 After you submit an asynchronous search request, you can request partial responses with the ID that you see in the asynchronous search response.

@@ -188,6 +191,8 @@ You can poll the ID with the `wait_for_completion_timeout` parameter to wait for
 For asynchronous searches with `keep_on_completion` as `true` and a sufficiently long `keep_alive` time, you can keep polling the IDs until the search finishes. If you don’t want to periodically poll each ID, you can retain the results in your cluster with the `keep_alive` parameter and come back to it at a later time.

 ## Delete searches and results
+Introduced 1.0
+{: .label .label-purple }

 You can use the DELETE API operation to delete any ongoing asynchronous search by its ID. If the search is still running, it’s canceled. If the search is complete, the saved search results are deleted.

@@ -204,6 +209,8 @@ DELETE _plugins/_asynchronous_search/<ID>?pretty
 ```

 ## Monitor stats
+Introduced 1.0
+{: .label .label-purple }

 You can use the stats API operation to monitor asynchronous searches that are running, completed, and/or persisted.

@@ -4,7 +4,6 @@ title: Asynchronous search security
 nav_order: 2
 parent: Asynchronous search
 has_children: false
-redirect_from: /docs/async/security/
 ---

 # Asynchronous search security
@@ -3,7 +3,6 @@ layout: default
 title: Settings
 parent: Asynchronous search
 nav_order: 4
-redirect_from: /docs/async/settings/
 ---

 # Settings
@@ -4,7 +4,6 @@ title: k-NN API
 nav_order: 5
 parent: k-NN
 has_children: false
-redirect_from: /docs/knn/api/
 ---

 # k-NN plugin API
@@ -13,6 +12,8 @@ The k-NN plugin adds two API operations to help you better manage the plugin's f


 ## Stats
+Introduced 1.0
+{: .label .label-purple }

 The k-NN `stats` API provides information about the current status of the k-NN plugin. The plugin keeps track of both cluster-level and node-level statistics. Cluster-level statistics have a single value for the entire cluster. Node-level statistics have a single value for each node in the cluster. You can filter the query by `nodeId` and `statName`:
 ```
@@ -107,6 +108,8 @@ GET /_plugins/_knn/HYMrXXsBSamUkcAjhjeN0w/stats/circuit_breaker_triggered,graph_


 ## Warmup operation
+Introduced 1.0
+{: .label .label-purple }

 The Hierarchical Navigable Small World (HNSW) graphs used to perform an approximate k-Nearest Neighbor (k-NN) search are stored as `.hnsw` files with other Apache Lucene segment files. In order for you to perform a search on these graphs using the k-NN plugin, the plugin needs to load these files into native memory.

@@ -5,14 +5,13 @@ nav_order: 2
 parent: k-NN
 has_children: false
 has_math: true
-redirect_from: /docs/knn/approximate-knn/
 ---

 # Approximate k-NN search

 The approximate k-NN method uses [nmslib's](https://github.com/nmslib/nmslib/) implementation of the Hierarchical Navigable Small World (HNSW) algorithm to power k-NN search. In this case, approximate means that for a given search, the neighbors returned are an estimate of the true k-nearest neighbors. Of the three methods, this method offers the best search scalability for large data sets. Generally speaking, once the data set gets into the hundreds of thousands of vectors, this approach is preferred.

-The k-NN plugin builds an HNSW graph of the vectors for each "knn-vector field"/ "Lucene segment" pair during indexing that can be used to efficiently find the k-nearest neighbors to a query vector during search. To learn more about Lucene segments, please refer to [Apache Lucene's documentation](https://lucene.apache.org/core/8_7_0/core/org/apache/lucene/codecs/lucene87/package-summary.html#package.description). These graphs are loaded into native memory during search and managed by a cache. To learn more about pre-loading graphs into memory, refer to the [warmup API]({{site.url}}{{site.baseurl}}/search-plugins/knn/api#warmup). Additionally, you can see what graphs are already loaded in memory, which you can learn more about in the [stats API section]({{site.url}}{{site.baseurl}}/search-plugins/knn/api#stats).
+The k-NN plugin builds an HNSW graph of the vectors for each "knn-vector field"/ "Lucene segment" pair during indexing that can be used to efficiently find the k-nearest neighbors to a query vector during search. To learn more about Lucene segments, please refer to [Apache Lucene's documentation](https://lucene.apache.org/core/8_7_0/core/org/apache/lucene/codecs/lucene87/package-summary.html#package.description). These graphs are loaded into native memory during search and managed by a cache. To learn more about pre-loading graphs into memory, refer to the [warmup API]({{site.url}}{{site.baseurl}}/search-plugins/knn/api#warmup-operation). Additionally, you can see what graphs are already loaded in memory, which you can learn more about in the [stats API section]({{site.url}}{{site.baseurl}}/search-plugins/knn/api#stats).

 Because the graphs are constructed during indexing, it is not possible to apply a filter on an index and then use this search method. All filters are applied on the results produced by the approximate nearest neighbor search.

@@ -5,7 +5,6 @@ nav_order: 50
 has_children: true
 has_toc: false
 redirect_from:
-  - /docs/knn/
  - /search-plugins/knn/
 ---

@@ -4,7 +4,6 @@ title: JNI library
 nav_order: 6
 parent: k-NN
 has_children: false
-redirect_from: /docs/knn/jni-library/
 ---

 # JNI library
@@ -4,7 +4,6 @@ title: k-NN Index
 nav_order: 1
 parent: k-NN
 has_children: false
-redirect_from: /docs/knn/knn-index/
 ---

 # k-NN Index
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
keithhc2	538703d422	Changed transform to rollup	2021-09-17 14:58:07 -07:00
keithhc2	a69440b262	Addressed comments	2021-09-15 13:47:04 -07:00
keithhc2	0b9f197358	Added security to ISM	2021-09-10 11:57:30 -07:00
Keith Chan	17ae32cb9a	Fixed variable name	2021-08-19 13:51:01 -07:00
Andrew Etter	861644393d	Merge pull request #146 from opensearch-project/fix-144 Fix #144	2021-08-19 12:13:12 -07:00
aetter	b863e18503	Update tls.md	2021-08-19 09:52:31 -07:00
Ashwin Kumar	5789bb4c28	Merge pull request #145 from opensearch-project/helm Add install steps using Helm	2021-08-18 23:04:43 -07:00
ashwinkumar12345	3901ea23c1	incorporated feedback	2021-08-18 23:03:48 -07:00
aetter	00d2db4917	De-duplicate content Point readers to the more comprehensive content: https://github.com/opensearch-project/documentation-website/issues/144	2021-08-18 14:17:41 -07:00
ashwinkumar12345	60da8fa182	add steps to install OpenSearch and OpenSearch Dashboards	2021-08-18 10:49:46 -07:00
Keith Chan	b9023ab6ec	Merge pull request #141 from opensearch-project/document-rest-apis Added update by query to REST API reference	2021-08-17 16:41:38 -07:00
keithhc2	90e28e6f23	Added some context about including a script	2021-08-17 16:36:25 -07:00
keithhc2	d60acc5fd2	Added update by query to REST API reference	2021-08-17 15:22:33 -07:00
Keith Chan	747c4d7730	Fixed nav_order	2021-08-17 13:20:07 -07:00
Keith Chan	10ec3ef95e	Fixed nav_order	2021-08-17 13:19:52 -07:00
aetter	b695c750ad	Improve self-signed certificate script	2021-08-17 12:46:50 -07:00
Ashwin Kumar	f9baa125c3	Merge pull request #140 from opensearch-project/data_streams_update Data stream minor update	2021-08-17 10:05:21 -07:00
ashwinkumar12345	fd1ea4c9ac	minor changes	2021-08-17 00:15:40 -07:00
ashwinkumar12345	1dcdee97f8	incorporated feedback	2021-08-16 22:44:22 -07:00
Ashwin Kumar	2452e60305	Merge pull request #139 from opensearch-project/explain_API Add explain API to REST API	2021-08-16 13:22:05 -07:00
ashwinkumar12345	7d070e1ac2	added feedback	2021-08-16 13:21:29 -07:00
ashwinkumar12345	83a7bbffc0	pushed to main by mistake	2021-08-16 13:20:21 -07:00
ashwinkumar12345	8d548ca475	incorporated feedback	2021-08-16 13:17:35 -07:00
ashwinkumar12345	c8761d3bd6	minor fix	2021-08-16 12:04:23 -07:00
ashwinkumar12345	b5812bebbf	incorporated feedback	2021-08-16 12:01:53 -07:00
ashwinkumar12345	d90d9859a2	minor changes	2021-08-16 11:00:48 -07:00
Andrew Etter	294da5c0df	Merge pull request #135 from opensearch-project/security-admin-script-improvements Improve securityadmin.sh content	2021-08-16 08:32:36 -07:00
ashwinkumar12345	6ebe39307e	added explain API	2021-08-16 00:24:18 -07:00
ashwinkumar12345	b6f61a753c	minor fixes	2021-08-15 12:03:31 -07:00
Keith Chan	d6b02c0e17	Fixed label	2021-08-13 11:25:19 -07:00
Keith Chan	f7093ffd8f	Changed `plugins` to `opensearch_security`	2021-08-13 11:12:23 -07:00
Miki	0a497238c7	Merge pull request #138 from AMoo-Miki/no-banner Remove banner to match website	2021-08-13 10:04:57 -07:00
Miki	0c9fe0271a	Remove banner to match website Signed-off-by: Miki <mehranb@amazon.com>	2021-08-12 17:09:10 -07:00
aetter	d1a065587c	Fix typo	2021-08-12 16:29:17 -07:00
Miki	2561bc262f	Merge pull request #137 from AMoo-Miki/redirect-javadoc Redirect javadoc to https://opensearch.org/javadocs/	2021-08-12 16:29:16 -07:00
Miki	be92ce0783	Redirect javadoc to https://opensearch.org/javadocs/ Signed-off-by: Miki <mehranb@amazon.com>	2021-08-12 16:24:44 -07:00
Andrew Etter	95b5157c19	Merge pull request #136 from opensearch-project/remove-redirects Remove outdated redirects	2021-08-12 15:31:51 -07:00
aetter	1d99315e8b	Clean up broken links	2021-08-12 14:59:49 -07:00
aetter	6f32dce469	Merge branch 'main' into remove-redirects	2021-08-12 14:50:28 -07:00
Miki	fac01d293e	Merge pull request #134 from AMoo-Miki/add-link-checks Link checker plugin and some fixes to URLs	2021-08-12 14:49:45 -07:00
Miki	634db90e9b	Link checker plugin and some fixes to URLs Signed-off-by: Miki <mehranb@amazon.com>	2021-08-12 14:45:04 -07:00
aetter	42095bd2d7	Minor changes to Beats OSS and cluster state descriptions	2021-08-12 14:36:49 -07:00
aetter	0d58bcf854	Remove outdated redirects	2021-08-12 14:34:31 -07:00
aetter	a75fbf62dc	Improve securityadmin.sh content More warnings around usage, better sample commands	2021-08-12 14:25:46 -07:00
Keith Chan	5b1f7fdaca	Merge pull request #132 from opensearch-project/document-rest-apis Added delete by query and index document to document APIs	2021-08-12 11:41:52 -07:00
keithhc2	dbb3d893ac	Addressed comments	2021-08-12 11:41:04 -07:00
aetter	187bccec6b	Typo in security recommendation	2021-08-10 13:03:10 -07:00
aetter	3f7f651619	Add links	2021-08-10 12:00:12 -07:00
Ashwin Kumar	bd944e8448	Merge pull request #133 from opensearch-project/logstash-fixes minor fixes for Logstash	2021-08-10 11:25:08 -07:00
ashwinkumar12345	fa7943b905	incorporated more feedback	2021-08-10 11:24:16 -07:00
ashwinkumar12345	47a1573202	updated doc based on feedback	2021-08-10 11:16:36 -07:00
aetter	45fea0e20e	Remove year from copyright	2021-08-09 15:53:52 -07:00
ashwinkumar12345	4a4c43482a	minor fixes	2021-08-09 14:02:21 -07:00
ashwinkumar12345	bdf53c9117	adding helm	2021-08-09 13:53:04 -07:00
Miki	ee1400ff2b	Merge pull request #126 from AMoo-Miki/fix-redirct-from Fix paths in `redirect_from` data	2021-08-09 12:38:18 -07:00
keithhc2	eb51f06694	Added delete by query and index document to document APIs	2021-08-06 15:52:53 -07:00
Ashwin Kumar	1f60c9c307	Merge pull request #53 from opensearch-project/logstash-1 added logstash info	2021-08-05 10:10:45 -07:00
Miki	bf78a468c3	Merge pull request #127 from AMoo-Miki/add-sitemap Generate a sitemap	2021-08-04 15:59:49 -07:00
Keith Chan	8c703b9cff	Merge pull request #121 from opensearch-project/document-rest-apis Added multi-get document API to REST API	2021-08-04 12:04:14 -07:00
keithhc2	a3808e858a	Minor style changes	2021-08-04 12:03:41 -07:00
keithhc2	59f7ffeb99	Addressed comments	2021-08-04 12:00:36 -07:00
Miki	eac60ec797	Generate a sitemap Signed-off-by: Miki <mehranb@amazon.com>	2021-08-04 11:51:31 -07:00
Ashwin Kumar	b8b7fb13e3	Merge pull request #124 from opensearch-project/multi-search Add multi-search API	2021-08-04 11:42:41 -07:00
ashwinkumar12345	b4461e130f	incorporated feedback	2021-08-04 11:39:04 -07:00
Miki	ba5bfa429f	Fix paths in `redirect_from` data Signed-off-by: Miki <mehranb@amazon.com>	2021-08-04 11:16:37 -07:00
Keith Chan	266df8e006	Added label	2021-08-03 15:39:31 -07:00
Ashwin Kumar	c18cced55a	Update _clients/logstash/index.md Co-authored-by: Vijayan Balasubramanian <VijayanB@users.noreply.github.com>	2021-08-03 13:30:21 -07:00
Ashwin Kumar	31613067dd	Update _clients/logstash/index.md Co-authored-by: Vijayan Balasubramanian <VijayanB@users.noreply.github.com>	2021-08-02 17:34:06 -07:00
Ashwin Kumar	8d178c3d83	Update _clients/logstash/index.md Co-authored-by: Vijayan Balasubramanian <VijayanB@users.noreply.github.com>	2021-08-02 17:33:56 -07:00
Ashwin Kumar	cfb582dd26	Update _clients/logstash/index.md Co-authored-by: Vijayan Balasubramanian <VijayanB@users.noreply.github.com>	2021-08-02 17:33:45 -07:00
ashwinkumar12345	96e0c4dbcd	install fix	2021-08-02 13:00:04 -07:00
ashwinkumar12345	880a635b90	minor fix	2021-08-02 11:16:39 -07:00
ashwinkumar12345	9ab749a7df	added Logstash Docker install steps	2021-08-02 11:14:03 -07:00
ashwinkumar12345	2ff209d0b8	Add multi-search API	2021-08-02 10:57:38 -07:00
ashwinkumar12345	28e0409da3	deleted from main branch	2021-08-02 10:55:50 -07:00
ashwinkumar12345	7c33c8d5a4	Add multi-search API	2021-08-02 10:53:39 -07:00
keithhc2	f315193267	Added versioning label	2021-07-30 14:31:42 -07:00
keithhc2	84e9440f18	Added multi-get document API to REST API	2021-07-29 16:16:15 -07:00
Keith Chan	96a70a820a	Merge pull request #120 from opensearch-project/security-updates Added whitelist.yml	2021-07-28 13:39:55 -07:00
aetter	3d509b3976	Update README.md	2021-07-28 13:27:39 -07:00
keithhc2	dc2f349d7e	Addressed comment and added note about users and roles	2021-07-28 13:21:25 -07:00
aetter	db86114248	Styling for links in labels, update README for API labels	2021-07-28 12:30:34 -07:00
keithhc2	30df98e078	Added whitelist.yml	2021-07-28 11:41:08 -07:00
Andrew Etter	0ac341523a	Merge pull request #117 from opensearch-project/introduced-labels Add "introduced" labels for APIs	2021-07-28 10:13:30 -07:00
Ashwin Kumar	15f9c6bc5c	Merge pull request #116 from opensearch-project/date_math Add date math support for index names	2021-07-28 00:27:56 -07:00
ashwinkumar12345	a9bde64480	incorporated feedback	2021-07-28 00:27:37 -07:00
Keith Chan	a4cca7c71b	Merge pull request #112 from opensearch-project/document-rest-apis Added update document to REST API reference	2021-07-27 10:05:06 -07:00
Keith Chan	4705da9726	Merge pull request #99 from opensearch-project/update-mapping Added update mapping to API reference and fixed some metadata	2021-07-27 10:04:55 -07:00
aetter	5f678cd814	Add "introduced" labels for APIs	2021-07-26 16:14:22 -07:00
ashwinkumar12345	01df7f0b53	added date math for index names	2021-07-26 11:30:02 -07:00
Andrew Etter	d06c1bc978	Merge pull request #115 from opensearch-project/client-compat Add compatibility table for clients	2021-07-26 11:20:24 -07:00
aetter	e378928a5d	Update index.md	2021-07-26 10:01:59 -07:00
aetter	31bf69767a	Add contribution note	2021-07-26 09:59:48 -07:00
aetter	a77c678c98	Add compatibility table for clients Sample code is commented out, but included to help contributors verify compatibility.	2021-07-26 09:49:38 -07:00
aetter	76e3b2710e	Update important-settings.md	2021-07-23 12:34:17 -07:00
keithhc2	793ce77490	Added update document to REST API reference	2021-07-22 14:24:17 -07:00
keithhc2	2b31c5392c	Added some additional context	2021-07-21 11:31:27 -07:00
Miki	37cab900a5	Merge pull request #110 from AMoo-Miki/add-readme-logo Add themed logo to README	2021-07-21 10:19:06 -07:00
Andrew Etter	6c9a46c130	Merge pull request #108 from opensearch-project/data_stream_feedback incorporated data streams feedback	2021-07-21 10:02:17 -07:00
Miki	15a5f18fb7	Add themed logo to README Signed-off-by: Miki <mehranb@amazon.com>	2021-07-20 10:28:25 -07:00
ashwinkumar12345	4453173942	minor fix	2021-07-20 00:42:16 -07:00
ashwinkumar12345	23981ecc33	incorporated feedback	2021-07-19 23:31:33 -07:00
Andrew Etter	a99458c41b	Merge pull request #107 from opensearch-project/ism_warning added ISM warning	2021-07-19 13:17:29 -07:00
ashwinkumar12345	b93af9a94b	add ISM warning	2021-07-19 13:13:58 -07:00
Keith Chan	25421e60e0	Merge pull request #105 from opensearch-project/security-updates Added required openid lines to TLS configuration yaml files	2021-07-16 16:10:37 -07:00
keithhc2	c961ca45d0	Added "openid_connect_idp" to TLS configurations	2021-07-16 15:11:11 -07:00
Andrew Etter	fb9ecbbc15	Merge pull request #101 from opensearch-project/notebook_gifs added gifs for notebooks	2021-07-16 08:55:26 -07:00
Andrew Etter	63f391a3ef	Merge pull request #97 from opensearch-project/data_streams_fixes minor feedback for data streams	2021-07-16 08:55:16 -07:00
aetter	537eaa7743	Add back "edit this page" links, add note for upgrading ODFE	2021-07-16 08:47:59 -07:00
ashwinkumar12345	c098a80fdb	added gifs for notebooks	2021-07-15 23:47:36 -07:00
keithhc2	9574bd2c30	Minor language tweak	2021-07-15 16:42:16 -07:00
keithhc2	951a2e01f1	Added update mapping to API reference and fixed some metadata	2021-07-15 16:38:05 -07:00
Keith Chan	546ce5293b	Merge pull request #98 from opensearch-project/document-apis Added delete document to API reference	2021-07-15 14:39:29 -07:00
keithhc2	9e4618111c	Added delete document to API reference	2021-07-15 10:52:37 -07:00
ashwinkumar12345	40f2e462c1	minor feedback	2021-07-15 01:00:50 -07:00
Keith Chan	0257a9de5d	Changed file name	2021-07-13 14:14:31 -07:00
Andrew Etter	cff7b8fea3	Merge pull request #94 from h0rv4th/patch-1 Update _security-plugin/configuration/disable.md	2021-07-13 11:58:16 -07:00
Horvv	9ae5a6bfc8	Update disable.md The line to create the new image by deactivating the security plugin uses "security-dashboards" and this returns the following error: docker build --tag=opensearch-dashboards-no-security . Sending build context to Docker daemon 5.12kB Step 1/3 : FROM opensearchproject/opensearch-dashboards:1.0.0 ---> 6a109c3fbebf Step 2/3 : RUN /usr/share/opensearch-dashboards/bin/opensearch-dashboards-plugin remove security-dashboard ---> Running in 965b66ef7abd Unable to remove plugin because of error: "Plugin [security-dashboard] is not installed" The command '/bin/sh -c /usr/share/opensearch-dashboards/bin/opensearch-dashboards-plugin remove security-dashboard' returned a non-zero code: 74 Instead using the correct plugin name "securityDashboards" the image compiles correctly: docker build --tag=opensearch-dashboards-no-security . Sending build context to Docker daemon 6.144kB Step 1/3 : FROM opensearchproject/opensearch-dashboards:1.0.0 ---> 6a109c3fbebf Step 2/3 : RUN /usr/share/opensearch-dashboards/bin/opensearch-dashboards-plugin remove securityDashboards ---> Using cache ---> bb9a535b8e42 Step 3/3 : COPY --chown=opensearch-dashboards:opensearch-dashboards opensearch_dashboards.yml /usr/share/opensearch-dashboards/config/ ---> e6e76bba8a4f Successfully built e6e76bba8a4f Successfully tagged opensearch-dashboards-no-security:latest Ref: - https://opensearch.org/docs/dashboards/install/plugins/#list-installed-plugins - https://github.com/opensearch-project/documentation-website/blob/main/_dashboards/install/plugins.md	2021-07-13 19:06:13 +02:00
aetter	3bbdae031e	Update README.md	2021-07-13 09:21:00 -07:00
ashwinkumar12345	3170c44a4f	added docker image	2021-07-09 11:26:35 -07:00
ashwinkumar12345	5c3572bed1	typo	2021-07-06 23:52:32 -07:00
ashwinkumar12345	96f08a51d7	incorporated feedback	2021-07-06 23:51:45 -07:00
ashwinkumar12345	70c9b6d9c8	minor changes	2021-07-06 11:53:10 -07:00
ashwinkumar12345	9648a850ad	more changes	2021-07-05 23:52:45 -07:00
ashwinkumar12345	e0004a2f52	minor changes	2021-06-20 12:30:09 -07:00
ashwinkumar12345	a1a5ed068b	added logstash info	2021-06-14 12:26:23 -07:00