Merge branch '586-siem-migration-guide' of https://github.com/elastic/docs-content into 586-siem-migration-guide

Author: benironside

.github/ISSUE_TEMPLATE/issue-report.yaml

@@ -0,0 +1,42 @@
+name: "Docs issue"
+description: Report documentation issues such as inaccuracies, broken links, typos, or missing information.
+title: "[Issue]: "
+labels: ["triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Hi 👋. Thanks for taking the time to fill out this issue report!
+        This form will create an issue that Elastic's docs team will triage and prioritize.
+        You can also open a PR instead.
+  - type: dropdown
+    attributes:
+      label: Type of issue
+      description: What type of issue are you reporting?
+      multiple: false
+      options:
+        - Inaccurate
+        - Missing information
+        - I can't find what I'm looking for
+        - Other
+  - type: input
+    id: link
+    attributes:
+      label: What documentation page is affected
+      description: Include a link to the page where you're seeing the problem.
+    validations:
+      required: true
+  - type: textarea
+    id: related
+    attributes:
+      label: What happened?
+      description: Describe the issue you're experiencing. Screenshots are valuable too!
+    validations:
+      required: true
+  - type: textarea
+    id: moreinfo
+    attributes:
+      label: Additional info
+      description: Anything else we should know?
+    validations:
+      required: false

archive.md

@@ -0,0 +1,6 @@
+---
+layout: archive
+description: Browse the archived documentation for older Elastic product releases. Archived documentation is unmaintained and may be out-of-date.
+---
+
+# Documentation archive

cloud-account/dark-mode.md

@@ -0,0 +1,31 @@
+---
+applies_to:
+  stack: all
+  serverless: all
+---
+
+# Use dark mode in Kibana
+
+The dark mode changes Kibana's default light appearance to a darker and higher-contrast color theme. From the application header, you can turn on dark mode or synchronize the color mode with your operating system settings.
+
+:::{tip}
+If you're using {{ecloud}}, this setting only applies to the Kibana UI of your serverless projects and hosted deployments. If you'd like to change the {{ecloud}} Console color theme too, you must do so separately from its respective interface.
+:::
+
+## Change your color mode preferences
+
+1. Open the user menu from the header.
+2. Select **Appearance**.
+3. Choose a color mode:
+
+    - **Light**: The default color mode of Kibana
+    - **Dark**: The dark and high-contrast color mode of Kibana
+    - **System**: Synchronizes Kibana's color mode with your system settings
+    - **Space default**: Sets the color mode to the value defined in the [Space settings](kibana://reference/advanced-settings.md#kibana-general-settings)
+
+      :::{admonition} Deprecated
+      The **Space default** option will be removed in a future version and automatically replaced with the System color mode.
+      :::
+
+4. Select **Save changes**.
+5. Refresh the page to apply the selected color mode.

cloud-account/index.md

@@ -7,7 +7,7 @@ applies:
   hosted: all
 ---
 
-# Manage your Cloud account
+# Manage your Cloud account and preferences
 
 Your {{ecloud}} account allows you to manage your personal settings, including your email address, password, and authentication methods. You can perform the following tasks at any time from your user profile:
 
@@ -21,6 +21,8 @@ If you use password-based login, then you can perform the following additional t
 
 Additionally, you can manage your organization membership, including joining or leaving an organization. Refer to [Join or leave an organization](/cloud-account/join-or-leave-an-organization.md) for more information.
 
+Some options also let you set personal preferences and customize the interface, such as [using dark mode](dark-mode.md) in your projects and deployments.
+
 ::::{tip} 
 This section focuses on the actions you can take as an individual user to manage your own account. It does not cover organization-wide settings, such as managing user permissions or configuring organization-level access controls, which are handled by the organization administrators.
 

cloud-account/toc.yml

@@ -5,4 +5,5 @@ toc:
   - file: update-your-email-address.md
   - file: change-your-password.md
   - file: add-a-login-method.md
-  - file: multifactor-authentication.md
+  - file: multifactor-authentication.md
+  - file: dark-mode.md

deploy-manage/_snippets/field-doc-sec-limitations.md

@@ -6,7 +6,7 @@ When a user’s role enables [document level security](/deploy-manage/users-role
 
 * Document level security doesn’t affect global index statistics that relevancy scoring uses. This means that scores are computed without taking the role query into account. Documents that don’t match the role query are never returned.
 * The `has_child` and `has_parent` queries aren’t supported as query parameters in the role definition. The `has_child` and `has_parent` queries can be used in the search API with document level security enabled.
-* [Date math](elasticsearch://reference/elasticsearch/rest-apis/common-options.md#date-math) expressions cannot contain `now` in [range queries with date fields](elasticsearch://reference/query-languages/query-dsl-range-query.md#ranges-on-dates).
+* [Date math](elasticsearch://reference/elasticsearch/rest-apis/common-options.md#date-math) expressions cannot contain `now` in [range queries with date fields](elasticsearch://reference/query-languages/query-dsl/query-dsl-range-query.md#ranges-on-dates).
 * Any query that makes remote calls to fetch query data isn’t supported, including the following queries:
 
     * `terms` query with terms lookup
@@ -16,7 +16,7 @@ When a user’s role enables [document level security](/deploy-manage/users-role
 * If suggesters are specified and document level security is enabled, the specified suggesters are ignored.
 * A search request cannot be profiled if document level security is enabled.
 * The [terms enum API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-terms-enum) does not return terms if document level security is enabled.
-* The [`multi_match`](elasticsearch://reference/query-languages/query-dsl-multi-match-query.md) query does not support specifying fields using wildcards.
+* The [`multi_match`](elasticsearch://reference/query-languages/query-dsl/query-dsl-multi-match-query.md) query does not support specifying fields using wildcards.
 
 :::{note}
 While document-level security prevents users from viewing restricted documents, it’s still possible to write search requests that return aggregate information about the entire index. A user whose access is restricted to specific documents in an index could still learn about field names and terms that only exist in inaccessible documents, and count how many inaccessible documents contain a given term.

deploy-manage/api-keys/elastic-cloud-enterprise-api-keys.md

@@ -70,5 +70,5 @@ To create a bearer token:
     { "token": "eyJ0eXa...<very long string>...MgBmsw4s" }
     ```
 
-2. Specify the bearer token in the Authentication header of your API requests. To learn more, check [accessing the API from the command line](asciidocalypse://docs/cloud/docs/reference/cloud-enterprise/ece-api-command-line.md).
+2. Specify the bearer token in the Authentication header of your API requests. To learn more, check [accessing the API from the command line](cloud://reference/cloud-enterprise/ece-api-command-line.md).
 

deploy-manage/api-keys/elasticsearch-api-keys.md

@@ -15,7 +15,7 @@ Several types of {{es}} API keys exist:
 
 To manage API keys in {{kib}}, go to the **API Keys** management page using the navigation menu or the [global search field](../../explore-analyze/find-and-organize/find-apps-and-objects.md).
 
-![API Keys UI](../../images/kibana-api-keys.png "")
+![API Keys UI](/deploy-manage/images/kibana-api-keys.png "")
 
 
 ## Security privileges [api-keys-security-privileges]
@@ -33,7 +33,7 @@ To manage roles, go to the **Roles** management page using the navigation menu o
 
 To create an API key, go to the **API Keys** management page using the navigation menu or the [global search field](../../explore-analyze/find-and-organize/find-apps-and-objects.md), and select **Create API key**.
 
-![Create API Key UI](../../images/kibana-create-ccr-api-key.png "")
+![Create API Key UI](/deploy-manage/images/kibana-create-ccr-api-key.png "")
 
 Refer to the [Create API key](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-create-api-key) documentation to learn more about creating user API keys.
 

deploy-manage/api-keys/serverless-project-api-keys.md

@@ -14,7 +14,7 @@ In serverless projects, the following types of API keys exist:
 
 You can manage your keys in **{{project-settings}} → {{manage-app}} → {{api-keys-app}}**:
 
-:::{image} ../../images/serverless-api-key-management.png
+:::{image} /deploy-manage/images/serverless-api-key-management.png
 :alt: API keys UI
 :screenshot:
 :::
@@ -24,7 +24,7 @@ You can manage your keys in **{{project-settings}} → {{manage-app}} → {{api-
 
 In **{{api-keys-app}}**, click **Create API key**:
 
-:::{image} ../../images/serverless-create-personal-api-key.png
+:::{image} /deploy-manage/images/serverless-create-personal-api-key.png
 :alt: Create API key UI
 :screenshot:
 :width: 50%

deploy-manage/autoscaling/autoscaling-deciders.md

@@ -18,7 +18,7 @@ applies_to:
 
 [Autoscaling](/deploy-manage/autoscaling.md) in Elasticsearch enables dynamic resource allocation based on predefined policies. A key component of this mechanism is autoscaling deciders, which independently assess resource requirements and determine when scaling actions are necessary. Deciders analyze various factors, such as storage usage, indexing rates, and machine learning workloads, to ensure clusters maintain optimal performance without manual intervention.
 
-::::{admonition} Indirect use only 
+::::{admonition} Indirect use only
 This feature is designed for indirect use by {{ech}}, {{ece}}, and {{eck}}. Direct use is not supported.
 ::::
 
@@ -49,7 +49,7 @@ The [autoscaling](../../deploy-manage/autoscaling.md) reactive storage decider (
 
 The reactive storage decider is enabled for all policies governing data nodes and has no configuration options.
 
-The decider relies partially on using [data tier preference](../../manage-data/lifecycle/data-tiers.md#data-tier-allocation) allocation rather than node attributes. In particular, scaling a data tier into existence (starting the first node in a tier) will result in starting a node in any data tier that is empty if not using allocation based on data tier preference. Using the [ILM migrate](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/index-lifecycle-actions/ilm-migrate.md) action to migrate between tiers is the preferred way of allocating to tiers and fully supports scaling a tier into existence.
+The decider relies partially on using [data tier preference](../../manage-data/lifecycle/data-tiers.md#data-tier-allocation) allocation rather than node attributes. In particular, scaling a data tier into existence (starting the first node in a tier) will result in starting a node in any data tier that is empty if not using allocation based on data tier preference. Using the [ILM migrate](elasticsearch://reference/elasticsearch/index-lifecycle-actions/ilm-migrate.md) action to migrate between tiers is the preferred way of allocating to tiers and fully supports scaling a tier into existence.
 
 ## Proactive storage decider [autoscaling-proactive-storage-decider]
 
@@ -62,7 +62,7 @@ The estimation of expected additional data is based on past indexing that occurr
 ### Configuration settings [autoscaling-proactive-storage-decider-settings]
 
 `forecast_window`
-:   (Optional, [time value](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/rest-apis/api-conventions.md#time-units)) The window of time to use for forecasting. Defaults to 30 minutes.
+:   (Optional, [time value](elasticsearch://reference/elasticsearch/rest-apis/api-conventions.md#time-units)) The window of time to use for forecasting. Defaults to 30 minutes.
 
 
 ### {{api-examples-title}} [autoscaling-proactive-storage-decider-examples]
@@ -96,7 +96,7 @@ The [autoscaling](../../deploy-manage/autoscaling.md) frozen shards decider (`fr
 ### Configuration settings [autoscaling-frozen-shards-decider-settings]
 
 `memory_per_shard`
-:   (Optional, [byte value](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/rest-apis/api-conventions.md#byte-units)) The memory needed per shard, in bytes. Defaults to 2000 shards per 64 GB node (roughly 32 MB per shard). Notice that this is total memory, not heap, assuming that the Elasticsearch default heap sizing mechanism is used and that nodes are not bigger than 64 GB.
+:   (Optional, [byte value](elasticsearch://reference/elasticsearch/rest-apis/api-conventions.md#byte-units)) The memory needed per shard, in bytes. Defaults to 2000 shards per 64 GB node (roughly 32 MB per shard). Notice that this is total memory, not heap, assuming that the Elasticsearch default heap sizing mechanism is used and that nodes are not bigger than 64 GB.
 
 ## Frozen storage decider [autoscaling-frozen-storage-decider]
 
@@ -121,8 +121,8 @@ The [autoscaling](../../deploy-manage/autoscaling.md) {{ml}} decider (`ml`) calc
 
 The {{ml}} decider is enabled for policies governing `ml` nodes.
 
-::::{note} 
-For {{ml}} jobs to open when the cluster is not appropriately scaled, set `xpack.ml.max_lazy_ml_nodes` to the largest number of possible {{ml}} nodes (refer to [Advanced machine learning settings](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md#advanced-ml-settings) for more information). In {{ess}}, this is automatically set.
+::::{note}
+For {{ml}} jobs to open when the cluster is not appropriately scaled, set `xpack.ml.max_lazy_ml_nodes` to the largest number of possible {{ml}} nodes (refer to [Advanced machine learning settings](elasticsearch://reference/elasticsearch/configuration-reference/machine-learning-settings.md#advanced-ml-settings) for more information). In {{ech}}, this is automatically set.
 ::::
 
 
@@ -137,7 +137,7 @@ Both `num_anomaly_jobs_in_queue` and `num_analytics_jobs_in_queue` are designed
 :   (Optional, integer) Specifies the number of queued {{dfanalytics-jobs}} to allow. Defaults to `0`.
 
 `down_scale_delay`
-:   (Optional, [time value](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/rest-apis/api-conventions.md#time-units)) Specifies the time to delay before scaling down. Defaults to 1 hour. If a scale down is possible for the entire time window, then a scale down is requested. If the cluster requires a scale up during the window, the window is reset.
+:   (Optional, [time value](elasticsearch://reference/elasticsearch/rest-apis/api-conventions.md#time-units)) Specifies the time to delay before scaling down. Defaults to 1 hour. If a scale down is possible for the entire time window, then a scale down is requested. If the cluster requires a scale up during the window, the window is reset.
 
 
 ### {{api-examples-title}} [autoscaling-machine-learning-decider-examples]
@@ -168,12 +168,12 @@ The API returns the following result:
 
 ## Fixed decider [autoscaling-fixed-decider]
 
-::::{warning} 
+::::{warning}
 This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
 ::::
 
 
-::::{warning} 
+::::{warning}
 The fixed decider is intended for testing only. Do not use this decider in production.
 ::::
 
@@ -183,10 +183,10 @@ The [autoscaling](../../deploy-manage/autoscaling.md) `fixed` decider responds w
 ### Configuration settings [_configuration_settings]
 
 `storage`
-:   (Optional, [byte value](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/rest-apis/api-conventions.md#byte-units)) Required amount of node-level storage. Defaults to `-1` (disabled).
+:   (Optional, [byte value](elasticsearch://reference/elasticsearch/rest-apis/api-conventions.md#byte-units)) Required amount of node-level storage. Defaults to `-1` (disabled).
 
 `memory`
-:   (Optional, [byte value](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/rest-apis/api-conventions.md#byte-units)) Required amount of node-level memory. Defaults to `-1` (disabled).
+:   (Optional, [byte value](elasticsearch://reference/elasticsearch/rest-apis/api-conventions.md#byte-units)) Required amount of node-level memory. Defaults to `-1` (disabled).
 
 `processors`
 :   (Optional, float) Required number of processors. Defaults to disabled.