Merge branch 'main' into feature/add-404-page-layout

Author: reakaleek

deploy-manage/_snippets/field-doc-sec-limitations.md

@@ -0,0 +1,44 @@
+Field and document security is subject to the following limitations: 
+
+### Document level security limitations
+
+When a user’s role enables [document level security](/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level.md) for a data stream or index:
+
+* Document level security doesn’t affect global index statistics that relevancy scoring uses. This means that scores are computed without taking the role query into account. Documents that don’t match the role query are never returned.
+* The `has_child` and `has_parent` queries aren’t supported as query parameters in the role definition. The `has_child` and `has_parent` queries can be used in the search API with document level security enabled.
+* [Date math](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/rest-apis/common-options.md#date-math) expressions cannot contain `now` in [range queries with date fields](asciidocalypse://docs/elasticsearch/docs/reference/query-languages/query-dsl-range-query.md#ranges-on-dates).
+* Any query that makes remote calls to fetch query data isn’t supported, including the following queries:
+
+    * `terms` query with terms lookup
+    * `geo_shape` query with indexed shapes
+    * `percolate` query
+
+* If suggesters are specified and document level security is enabled, the specified suggesters are ignored.
+* A search request cannot be profiled if document level security is enabled.
+* The [terms enum API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-terms-enum) does not return terms if document level security is enabled.
+* The [`multi_match`](asciidocalypse://docs/elasticsearch/docs/reference/query-languages/query-dsl-multi-match-query.md) query does not support specifying fields using wildcards.
+
+:::{note} 
+While document-level security prevents users from viewing restricted documents, it’s still possible to write search requests that return aggregate information about the entire index. A user whose access is restricted to specific documents in an index could still learn about field names and terms that only exist in inaccessible documents, and count how many inaccessible documents contain a given term.
+:::
+
+### Field level security limitations
+
+When a user’s role enables document or [field level security](/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level.md) for a data stream or index:
+
+* The user cannot perform write operations:
+
+    * The update API isn’t supported.
+    * Update requests included in bulk requests aren’t supported.
+
+* The user cannot perform operations that effectively make contents accessible under another name, including actions from the following APIs:
+
+    * [Clone index API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-clone)
+    * [Shrink index API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-shrink)
+    * [Split index API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-split)
+    * [Aliases API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-update-aliases)
+
+* The request cache is disabled for search requests if either of the following are true:
+
+    * The role query that defines document level security is [templated](/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level.md#templating-role-query) using a [stored script](/explore-analyze/scripting/modules-scripting-using.md#script-stored-scripts).
+    * The target indices are a mix of local and remote indices.

deploy-manage/api-keys/serverless-project-api-keys.md

@@ -70,7 +70,7 @@ For example, the following `role_descriptors` object defines a `books-read-only`
 }
 ```
 
-For the `role_descriptors` object schema, check out the [`/_security/api_key` endpoint](https://www.elastic.co/docs/api/doc/elasticsearch-serverless/operation/operation-security-create-api-key) docs. For supported privileges, check [Security privileges](../users-roles/cluster-or-deployment-auth/elasticsearch-privileges.md#privileges-list-indices).
+For the `role_descriptors` object schema, check out the [`/_security/api_key` endpoint](https://www.elastic.co/docs/api/doc/elasticsearch-serverless/operation/operation-security-create-api-key) docs. For supported privileges, check [Security privileges](/deploy-manage/users-roles/cluster-or-deployment-auth/elasticsearch-privileges.md#privileges-list-indices).
 
 
 ## Update an API key [api-keys-update-an-api-key]

deploy-manage/cloud-organization/billing.md

@@ -2,6 +2,7 @@
 mapped_urls:
   - https://www.elastic.co/guide/en/cloud/current/ec-billing.html
   - https://www.elastic.co/guide/en/serverless/current/general-manage-billing.html
+  - https://www.elastic.co/guide/en/serverless/current/general-billing-stop-project.html
 applies_to:
   deployment:
     ess: all
@@ -21,7 +22,7 @@ Elastic charges a recurring fee for using our offerings on {{ecloud}}. In this s
   * [Elasticsearch projects](/deploy-manage/cloud-organization/billing/elasticsearch-billing-dimensions.md)
   * [Elastic Observability projects](/deploy-manage/cloud-organization/billing/elastic-observability-billing-dimensions.md)
   * [Elastic Security projects](/deploy-manage/cloud-organization/billing/security-billing-dimensions.md)
-  
+
 For more information, you can also refer to our [{{ech}}](https://www.elastic.co/pricing) and [{{serverless-full}}](https://www.elastic.co/pricing/serverless-search) pricing pages.
 
 ## Billing models

deploy-manage/deploy/cloud-enterprise/air-gapped-install.md

@@ -1,26 +1,33 @@
 ---
+applies_to:
+  deployment:
+    ece: all
 mapped_urls:
-  - https://www.elastic.co/guide/en/elastic-stack/current/air-gapped-install.html
   - https://www.elastic.co/guide/en/cloud-enterprise/current/ece-install-offline.html
 ---
 
-# Air gapped install
+# Air-gapped install [ece-install-offline]
 
-% What needs to be done: Refine
+Installing ECE on hosts without internet access is commonly referred to as an *offline* or *air-gapped* installation. ECE supports two air-gapped installation methods, depending on whether a private Docker registry is available. In both cases, you must download multiple Docker images and the installation script from Elastic, and load them onto your hosts or private registry.
 
-% GitHub issue: https://github.com/elastic/docs-projects/issues/309
+::::{note}
+    The versioning of {{es}} and {{kib}} is synchronized and versions where the major, minor, and patch levels match can be used together. Differences in build versions indicated by a dash do not affect compatibility.
+::::
 
-% Scope notes: In the issue
+Before you start, you must:
 
-% Use migrated content from existing pages that map to this page:
+* Follow the same prerequisites described in [](./install.md#ece-install-prerequisites). This includes [](./identify-deployment-scenario.md) and [](./prepare-environment.md) steps.
+* [Configure your operating system](./configure-operating-system.md) in all ECE hosts.
+* Be part of the `docker` group to run the installation script. You should not install Elastic Cloud Enterprise as the `root` user.
+* Set up and run a local copy of the Elastic Package Repository, otherwise your deployments with APM server and Elastic agent won’t work. Refer to the [Running EPR in air-gapped environments](asciidocalypse://docs/docs-content/docs/reference/ingestion-tools/fleet/air-gapped.md#air-gapped-diy-epr) documentation.
 
-% - [ ] ./raw-migrated-files/stack-docs/elastic-stack/air-gapped-install.md
-% - [ ] ./raw-migrated-files/cloud/cloud-enterprise/ece-install-offline.md
-%      Notes: 3 child docs
+When you are ready to install ECE, you can proceed:
 
-⚠️ **This page is a work in progress.** ⚠️
+* [With your private Docker registry](./ece-install-offline-with-registry.md)
+* [Without a private Docker registry](./ece-install-offline-no-registry.md)
 
-The documentation team is working to combine content pulled from the following pages:
+After installing ECE in your hosts, you can continue with [](./post-installation-steps.md).
 
-* [/raw-migrated-files/stack-docs/elastic-stack/air-gapped-install.md](/raw-migrated-files/stack-docs/elastic-stack/air-gapped-install.md)
-* [/raw-migrated-files/cloud/cloud-enterprise/ece-install-offline.md](/raw-migrated-files/cloud/cloud-enterprise/ece-install-offline.md)
+::::{note}
+Deployment End-of-life (EOL) information relies on the connection to [https://www.elastic.co/support/eol.json](https://www.elastic.co/support/eol.json). If EOL information is updated, Elastic may require you to reconnect to [https://www.elastic.co/support/eol.json](https://www.elastic.co/support/eol.json) over the internet to get this information reflected.
+::::

deploy-manage/deploy/cloud-enterprise/alternative-install-ece-with-ansible.md

@@ -1,6 +1,10 @@
 ---
+applies_to:
+  deployment:
+    ece: all
 mapped_pages:
   - https://www.elastic.co/guide/en/cloud-enterprise/current/ece-configure-ansible.html
+navigation_title: Ansible playbook
 ---
 
 # Alternative: Install ECE with Ansible [ece-configure-ansible]

deploy-manage/deploy/cloud-enterprise/assign-roles-to-hosts.md

@@ -1,4 +1,7 @@
 ---
+applies_to:
+  deployment:
+    ece: all
 mapped_pages:
   - https://www.elastic.co/guide/en/cloud-enterprise/current/ece-change-roles.html
 ---

deploy-manage/deploy/cloud-enterprise/ce-add-support-for-node-roles-autoscaling.md

@@ -1,14 +1,19 @@
 ---
+navigation_title: Data tiers and autoscaling support
+applies_to:
+  deployment:
+    ece: all
 mapped_pages:
   - https://www.elastic.co/guide/en/cloud-enterprise/current/ce-add-support-for-node-roles-and-autoscaling.html
 ---
 
 # Updating custom templates to support node_roles and autoscaling [ce-add-support-for-node-roles-and-autoscaling]
 
-Custom deployment templates should be updated in order to take advantage of new Elastic Cloud Enterprise features, such as [Data tiers](../../../manage-data/lifecycle/data-tiers.md) (that is, the new cold and frozen data tiers) and [Deployment autoscaling](../../autoscaling.md). By updating these templates we also ensure forward compatibility with future Elastic Cloud Enterprise versions that will require certain fields such as `node_roles` and `id` to be present in the deployment configuration.
-
-System owned deployment templates have already been updated to support both data tiers with `node_roles` and autoscaling. However, the custom templates that you created need to be manually updated by following the steps in this guide.
+Templates created in older versions of ECE should be updated in order to take advantage of new Elastic Cloud Enterprise features, such as [Data tiers](../../../manage-data/lifecycle/data-tiers.md), and [Deployment autoscaling](../../autoscaling.md). By updating these templates we also ensure forward compatibility with future Elastic Cloud Enterprise versions that will require certain fields such as `node_roles` and `id` to be present in the deployment configuration.
 
+::::{note}
+System owned deployment templates are automatically updated during the ECE upgrade process to support both data tiers with `node_roles` and autoscaling. However, custom templates that you created must be manually updated by following the steps in this guide.
+::::
 
 ## Adding support for node_roles [ece_adding_support_for_node_roles]
 

deploy-manage/deploy/cloud-enterprise/change-allocator-disconnect-timeout.md

@@ -1,4 +1,7 @@
 ---
+applies_to:
+  deployment:
+    ece: all
 mapped_pages:
   - https://www.elastic.co/guide/en/cloud-enterprise/current/ece-change-allocator-disconnect-timeout.html
 ---

deploy-manage/deploy/cloud-enterprise/change-ece-api-url.md

@@ -1,4 +1,7 @@
 ---
+applies_to:
+  deployment:
+    ece: all
 mapped_pages:
   - https://www.elastic.co/guide/en/cloud-enterprise/current/ece-config-api-base-url.html
 ---

deploy-manage/deploy/cloud-enterprise/change-endpoint-urls.md

@@ -1,4 +1,7 @@
 ---
+applies_to:
+  deployment:
+    ece: all
 mapped_pages:
   - https://www.elastic.co/guide/en/cloud-enterprise/current/ece-administering-endpoints.html
 ---
@@ -9,15 +12,11 @@ For applications without SSL or HTTPS protocol support, you can use a local endp
 
 By default, cluster and Kibana endpoint URLs are constructed according to the following pattern, where `CLUSTER_ID` and `LOCAL_HOST_IP` are values that depend on your specific installation:
 
-::::{admonition}
-```text
+```sh
 http://CLUSTER_ID.LOCAL_HOST_IP.ip.es.io:9200
 https://CLUSTER_ID.LOCAL_HOST_IP.ip.es.io:9243
 ```
 
-::::
-
-
 For example:
 
 ```sh
@@ -29,7 +28,6 @@ https://2882c82e54d4361.us-west-5.aws.found.io:9243
 To find your endpoints, select a deployment review the information on the **Elasticsearch** and **Kibana** pages.
 ::::
 
-
 To change endpoints in the Cloud UI:
 
 1. [Log into the Cloud UI](log-into-cloud-ui.md).