diff --git a/manage-data/ingest/ingest-reference-architectures/ls-multi.md b/manage-data/ingest/ingest-reference-architectures/ls-multi.md
index a0277d28a5..2e4de780cb 100644
--- a/manage-data/ingest/ingest-reference-architectures/ls-multi.md
+++ b/manage-data/ingest/ingest-reference-architectures/ls-multi.md
@@ -19,7 +19,7 @@ Use when
: Data collected by {{agent}} needs to be routed to different {{es}} clusters or non-{{es}} destinations depending on the content
Example
-: Let’s take an example of a Windows workstation, for which we are collecting different types of logs using the System and Windows integrations. These logs need to be sent to different {{es}} clusters and to S3 for backup and a mechanism to send it to other destinations such as different SIEM solutions. In addition, the {{es}} destination is derived based on the type of datastream and an organization identifier.
+: Let’s take an example of a Windows workstation, for which we are collecting different types of logs using the System and Windows integrations. These logs need to be sent to different {{es}} clusters and to S3 for backup and a mechanism to send it to other destinations such as different SIEM solutions. In addition, the {{es}} destination is derived based on the type of data stream and an organization identifier.
In such use cases, agents send the data to {{ls}} as a routing mechanism to different destinations. The System and Windows integrations must be installed on all {{es}} clusters to which the data is routed.
diff --git a/reference/fleet/add-cloud-metadata-processor.md b/reference/fleet/add-cloud-metadata-processor.md
index ea6fb3b0c0..8f628e7358 100644
--- a/reference/fleet/add-cloud-metadata-processor.md
+++ b/reference/fleet/add-cloud-metadata-processor.md
@@ -53,7 +53,7 @@ The metadata that is added to events varies by hosting provider. For examples, r
| --- | --- | --- | --- |
| `timeout` | No | `3s` | Maximum amount of time to wait for a successful response when detecting the hosting provider. If a timeout occurs, no instance metadata is added to the events. This makes it possible to enable this processor for all your deployments (in the cloud or on-premise). |
| `providers` | No | | List of provider names to use. If `providers` is not configured, all providers that do not access a remote endpoint are enabled by default. The list of providers may alternatively be configured with the environment variable `BEATS_ADD_CLOUD_METADATA_PROVIDERS`, by setting it to a comma-separated list of provider names.
The list of supported provider names includes:
* `alibaba` or `ecs` for the Alibaba Cloud provider (disabled by default).
* `azure` for Azure Virtual Machine (enabled by default).
* `digitalocean` for Digital Ocean (enabled by default).
* `aws` or `ec2` for Amazon Web Services (enabled by default).
* `gcp` for Google Compute Engine (enabled by default).
* `openstack` or `nova` for Openstack Nova (enabled by default).
* `openstack-ssl` or `nova-ssl` for Openstack Nova when SSL metadata APIs are enabled (enabled by default).
* `tencent` or `qcloud` for Tencent Cloud (disabled by default).
* `huawei` for Huawei Cloud (enabled by default).
|
-| `overwrite` | No | `false` | Whether to overwrite existing cloud fields. If `true`, the processoroverwrites existing `cloud.*` fields. |
+| `overwrite` | No | `false` | Whether to overwrite existing cloud fields. If `true`, the processor overwrites existing `cloud.*` fields. |
The `add_cloud_metadata` processor supports SSL options to configure the http client used to query cloud metadata.
diff --git a/reference/fleet/add-fleet-server-on-prem.md b/reference/fleet/add-fleet-server-on-prem.md
index ea8186d2ce..2db6e6674e 100644
--- a/reference/fleet/add-fleet-server-on-prem.md
+++ b/reference/fleet/add-fleet-server-on-prem.md
@@ -55,7 +55,7 @@ You can install only a single {{agent}} per host, which means you cannot run {{f
Before deploying, you need to:
-* Obtain or generate a Cerfiticate Authority (CA) certificate.
+* Obtain or generate a Certificate Authority (CA) certificate.
* Ensure components have access to the ports needed for communication.
diff --git a/reference/fleet/add_cloudfoundry_metadata-processor.md b/reference/fleet/add_cloudfoundry_metadata-processor.md
index 5dac686bda..8dcde2dd3d 100644
--- a/reference/fleet/add_cloudfoundry_metadata-processor.md
+++ b/reference/fleet/add_cloudfoundry_metadata-processor.md
@@ -64,5 +64,5 @@ For efficient annotation, application metadata retrieved by the Cloud Foundry cl
| `client_secret` | Yes | | Client Secret to authenticate with Cloud Foundry. |
| `cache_duration` | No | `120s` | Maximum amount of time to cache an application’s metadata. |
| `cache_retry_delay` | No | `20s` | Time to wait before trying to obtain an application’s metadata again in case of error. |
-| `ssl` | No | | SSL configuration to use when connecting to Cloud Foundry. For a list ofavailable settings, refer to [SSL/TLS](/reference/fleet/elastic-agent-ssl-configuration.md), specificallythe settings under [Table 7, Common configuration options](/reference/fleet/elastic-agent-ssl-configuration.md#common-ssl-options) and [Table 8, Client configuration options](/reference/fleet/elastic-agent-ssl-configuration.md#client-ssl-options). |
+| `ssl` | No | | SSL configuration to use when connecting to Cloud Foundry. For a list of available settings, refer to [SSL/TLS](/reference/fleet/elastic-agent-ssl-configuration.md), specifically the settings under [Table 7, Common configuration options](/reference/fleet/elastic-agent-ssl-configuration.md#common-ssl-options) and [Table 8, Client configuration options](/reference/fleet/elastic-agent-ssl-configuration.md#client-ssl-options). |
diff --git a/reference/fleet/add_docker_metadata-processor.md b/reference/fleet/add_docker_metadata-processor.md
index 449a1adca3..3649bb1f73 100644
--- a/reference/fleet/add_docker_metadata-processor.md
+++ b/reference/fleet/add_docker_metadata-processor.md
@@ -72,7 +72,7 @@ If the Docker daemon is restarted, the mounted socket will become invalid, and m
| Name | Required | Default | Description |
| --- | --- | --- | --- |
| `host` | No | `unix:///var/run/docker.sock` | Docker socket (UNIX or TCP socket). |
-| `ssl` | No | | SSL configuration to use when connecting to the Docker socket. For a list ofavailable settings, refer to [SSL/TLS](/reference/fleet/elastic-agent-ssl-configuration.md), specificallythe settings under [Table 7, Common configuration options](/reference/fleet/elastic-agent-ssl-configuration.md#common-ssl-options) and [Table 8, Client configuration options](/reference/fleet/elastic-agent-ssl-configuration.md#client-ssl-options). |
+| `ssl` | No | | SSL configuration to use when connecting to the Docker socket. For a list of available settings, refer to [SSL/TLS](/reference/fleet/elastic-agent-ssl-configuration.md), specifically the settings under [Table 7, Common configuration options](/reference/fleet/elastic-agent-ssl-configuration.md#common-ssl-options) and [Table 8, Client configuration options](/reference/fleet/elastic-agent-ssl-configuration.md#client-ssl-options). |
| `match_fields` | No | | List of fields to match a container ID. At least one of the fields most hold a container ID to get the event enriched. |
| `match_pids` | No | `["process.pid", "process.parent.pid"]` | List of fields that contain process IDs. If the process is running in Docker, the event will be enriched. |
| `match_source` | No | `true` | Whether to match the container ID from a log path present in the `log.file.path` field. |
diff --git a/reference/fleet/agent-command-reference.md b/reference/fleet/agent-command-reference.md
index 115c1dd032..11b355b838 100644
--- a/reference/fleet/agent-command-reference.md
+++ b/reference/fleet/agent-command-reference.md
@@ -464,7 +464,7 @@ elastic-agent inspect components [--show-config]
: Use to display the configuration in all units.
`--show-spec`
- : Use to get input/output runtime spectification for a component.
+ : Use to get input/output runtime specification for a component.
`--help`
diff --git a/reference/fleet/certificates-rotation.md b/reference/fleet/certificates-rotation.md
index 9fe8dc0467..c6bfbc8958 100644
--- a/reference/fleet/certificates-rotation.md
+++ b/reference/fleet/certificates-rotation.md
@@ -8,7 +8,7 @@ products:
# Rotate SSL/TLS CA certificates [certificates-rotation]
-In some scenarioes you may want to rotate your configured certificate authorities (CAs), for instance if your chosen CAs are due to expire. Refer to the following steps to rotate certificates between connected components:
+In some scenarios you may want to rotate your configured certificate authorities (CAs), for instance if your chosen CAs are due to expire. Refer to the following steps to rotate certificates between connected components:
* [Rotating a {{fleet-server}} CA](#certificates-rotation-agent-fs)
* [Rotating an {{es}} CA for connections from {{fleet-server}}](#certificates-rotation-fs-es)
diff --git a/reference/fleet/community_id-processor.md b/reference/fleet/community_id-processor.md
index 09737b4a28..4c87093137 100644
--- a/reference/fleet/community_id-processor.md
+++ b/reference/fleet/community_id-processor.md
@@ -53,5 +53,5 @@ If the necessary fields are not present in the event, the processor silently con
| --- | --- | --- | --- |
| `fields` | No | | Field names that the processor reads from:
`source_ip`
: Field containing the source IP address.
`source_port`
: Field containing the source port.
`destination_ip`
: Field containing the destination IP address.
`destination_port`
: Field containing the destination port.
`iana_number`
: Field containing the IANA number. The following protocol numbers are currently supported: 1 ICMP, 2 IGMP, 6 TCP, 17 UDP, 47 GRE, 58 ICMP IPv6, 88 EIGRP, 89 OSPF, 103 PIM, and 132 SCTP.
`transport`
: Field containing the transport protocol. Used only when the `iana_number` field is not present.
`icmp_type`
: Field containing the ICMP type.
`icmp_code`
: Field containing the ICMP code.
|
| `target` | No | | Field that the computed hash is written to. |
-| `seed` | No | | Seed for the community ID hash. Must be between 0 and 65535 (inclusive). Theseed can prevent hash collisions between network domains, such as a staging andproduction network that use the same addressing scheme. This setting results ina 16-bit unsigned integer that gets incorporated into all generated hashes. |
+| `seed` | No | | Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme. This setting results ina 16-bit unsigned integer that gets incorporated into all generated hashes. |
diff --git a/reference/fleet/data-streams-ilm-tutorial.md b/reference/fleet/data-streams-ilm-tutorial.md
index f4e293e3c2..9030ad03b0 100644
--- a/reference/fleet/data-streams-ilm-tutorial.md
+++ b/reference/fleet/data-streams-ilm-tutorial.md
@@ -15,7 +15,7 @@ These tutorials explain how to apply a custom {{ilm-init}} policy to an integrat
For certain features you’ll need to use a slightly different procedure to manage the index lifecycle:
-* APM: For verions 8.15 and later, refer to [Index lifecycle management](/solutions/observability/apm/index-lifecycle-management.md).
+* APM: For versions 8.15 and later, refer to [Index lifecycle management](/solutions/observability/apm/index-lifecycle-management.md).
* Synthetic monitoring: Refer to [Manage data retention](/solutions/observability/synthetics/manage-data-retention.md).
* Universal Profiling: Refer to [Universal Profiling index life cycle management](/solutions/observability/infra-and-hosts/universal-profiling-index-life-cycle-management.md).
diff --git a/reference/fleet/data-streams-scenario3.md b/reference/fleet/data-streams-scenario3.md
index 9ac8ee874c..1315e9eaa3 100644
--- a/reference/fleet/data-streams-scenario3.md
+++ b/reference/fleet/data-streams-scenario3.md
@@ -153,4 +153,4 @@ To update the cloned index template:
7. Move the `ecs@mappings` component template right below the `@package` component template.
8. Save the index template.
-Roll over the data stream to apply the changes.
+Roll over the data stream to apply the changes.
\ No newline at end of file
diff --git a/reference/fleet/data-streams.md b/reference/fleet/data-streams.md
index 247dda3343..7e70f47de0 100644
--- a/reference/fleet/data-streams.md
+++ b/reference/fleet/data-streams.md
@@ -94,7 +94,7 @@ When you install an integration, {{fleet}} creates two default `@custom` compone
* A `@custom` component template allowing customization across all documents of a given data stream type, named following the pattern: `@custom`.
* A `@custom` component template for each data stream, named following the pattern: `@custom`.
-The `@custom` component template specific to a datastream has higher precedence over the data stream type `@custom` component template.
+The `@custom` component template specific to a data stream has higher precedence over the data stream type `@custom` component template.
You can edit a `@custom` component template to customize your {{es}} indices:
diff --git a/reference/fleet/detect_mime_type-processor.md b/reference/fleet/detect_mime_type-processor.md
index 15546dbcd8..3c93f6a0df 100644
--- a/reference/fleet/detect_mime_type-processor.md
+++ b/reference/fleet/detect_mime_type-processor.md
@@ -34,7 +34,7 @@ In this example, `http.request.body.content` is used as the source, and `http.re
| Name | Required | Default | Description |
| --- | --- | --- | --- |
| `field` | Yes | | Field used as the data source. |
-| `target` | Yes | | Field to populate with the detected type. You can use the `@metadata.` prefixto set the value in the event metadata instead of fields. |
+| `target` | Yes | | Field to populate with the detected type. You can use the `@metadata.` prefix to set the value in the event metadata instead of fields. |
See [Conditions](/reference/fleet/dynamic-input-configuration.md#conditions) for a list of supported conditions.
diff --git a/reference/fleet/elastic-agent-input-configuration.md b/reference/fleet/elastic-agent-input-configuration.md
index 87734ff212..04d37cee85 100644
--- a/reference/fleet/elastic-agent-input-configuration.md
+++ b/reference/fleet/elastic-agent-input-configuration.md
@@ -18,7 +18,7 @@ The `inputs` section of the `elastic-agent.yml` file specifies how {{agent}} loc
## Sample metrics input configuration [elastic-agent-input-configuration-sample-metrics]
-By default {{agent}} collects system metrics, such as CPU, memory, network, and file system metrics, and sends them to the default output. For example, to define datastreams for `cpu`, `memory`, `network` and `filesystem` metrics, this is the configuration:
+By default {{agent}} collects system metrics, such as CPU, memory, network, and file system metrics, and sends them to the default output. For example, to define data streams for `cpu`, `memory`, `network` and `filesystem` metrics, this is the configuration:
```yaml
- type: system/metrics <1>
diff --git a/reference/fleet/elastic-agent-unprivileged.md b/reference/fleet/elastic-agent-unprivileged.md
index 0cfc2febf2..bc275a6a88 100644
--- a/reference/fleet/elastic-agent-unprivileged.md
+++ b/reference/fleet/elastic-agent-unprivileged.md
@@ -10,7 +10,7 @@ products:
Beginning with {{stack}} version 8.15, {{agent}} is no longer required to be run by a user with superuser privileges. You can now run agents in an `unprivileged` mode that does not require `root` access on Linux or macOS, or `admin` access on Windows. Being able to run agents without full administrative privileges is often a requirement in organizations where this kind of access is often limited.
-In general, agents running without full administrative privileges will perform and behave exactly as those run by a superuser. There are certain integrations and datastreams that are not available, however. If an integration requires root access, this is [indicated on the integration main page](#unprivileged-integrations).
+In general, agents running without full administrative privileges will perform and behave exactly as those run by a superuser. There are certain integrations and data streams that are not available, however. If an integration requires root access, this is [indicated on the integration main page](#unprivileged-integrations).
You can also [change the privilege mode](#unprivileged-change-mode) of an {{agent}} after it has been installed.
diff --git a/reference/fleet/fleet-server-scalability.md b/reference/fleet/fleet-server-scalability.md
index dabf92f37f..8ec20fd47a 100644
--- a/reference/fleet/fleet-server-scalability.md
+++ b/reference/fleet/fleet-server-scalability.md
@@ -106,7 +106,7 @@ Deprecated: Use the `action_limit` settings instead.
: Number of transactions allowed for a burst, controlling oversubscription on outbound buffer.
`artifact_limit.max_body_byte_size`
-: Maximum size in bytes of the artficact API request body.
+: Maximum size in bytes of the artifact API request body.
`ack_limit.max`
: Maximum number of agents that can call the ack API concurrently. It allows the user to avoid overloading the {{fleet-server}} from Ack API calls.
@@ -139,7 +139,7 @@ Deprecated: Use the `action_limit` settings instead.
: How frequently agents can submit status requests to the Fleet Server.
`status_limit.burst`
-: Burst of status requests to accomodate before falling back to the rate defined by interval.
+: Burst of status requests to accommodate before falling back to the rate defined by interval.
`status_limit.max_body_byte_size`
: Maximum size in bytes of the status API request body.
@@ -151,7 +151,7 @@ Deprecated: Use the `action_limit` settings instead.
: How frequently agents can submit file start upload requests to the Fleet Server.
`upload_start_limit.burst`
-: Burst of file start upload requests to accomodate before falling back to the rate defined by interval.
+: Burst of file start upload requests to accommodate before falling back to the rate defined by interval.
`upload_start_limit.max_body_byte_size`
: Maximum size in bytes of the uploadStart API request body.
@@ -163,7 +163,7 @@ Deprecated: Use the `action_limit` settings instead.
: How frequently agents can submit file end upload requests to the Fleet Server.
`upload_end_limit.burst`
-: Burst of file end upload requests to accomodate before falling back to the rate defined by interval.
+: Burst of file end upload requests to accommodate before falling back to the rate defined by interval.
`upload_end_limit.max_body_byte_size`
: Maximum size in bytes of the uploadEnd API request body.
@@ -175,7 +175,7 @@ Deprecated: Use the `action_limit` settings instead.
: How frequently agents can submit file chunk upload requests to the Fleet Server.
`upload_chunk_limit.burst`
-: Burst of file chunk upload requests to accomodate before falling back to the rate defined by interval.
+: Burst of file chunk upload requests to accommodate before falling back to the rate defined by interval.
`upload_chunk_limit.max_body_byte_size`
: Maximum size in bytes of the uploadChunk API request body.
@@ -183,7 +183,7 @@ Deprecated: Use the `action_limit` settings instead.
## Scaling recommendations ({{ecloud}}) [scaling-recommendations]
-The following tables provide the minimum resource requirements and scaling guidelines based on the number of agents required by your deployment. It should be noted that these compute resource can be spread across multiple availability zones (for example: a 32GB RAM requirement can be satisfed with 16GB of RAM in 2 different zones).
+The following tables provide the minimum resource requirements and scaling guidelines based on the number of agents required by your deployment. It should be noted that these compute resource can be spread across multiple availability zones (for example: a 32GB RAM requirement can be satisfied with 16GB of RAM in 2 different zones).
* [Resource requirements by number of agents](#resource-requirements-by-number-agents)
diff --git a/reference/fleet/hints-annotations-autodiscovery.md b/reference/fleet/hints-annotations-autodiscovery.md
index cca3077eac..abd67710a7 100644
--- a/reference/fleet/hints-annotations-autodiscovery.md
+++ b/reference/fleet/hints-annotations-autodiscovery.md
@@ -144,7 +144,7 @@ co.elastic.hints/processors.dissect.tokenizer: "%{key2} %{key1}"
In the above sample the processor definition tagged with `1` would be executed first.
::::{important}
-Processor configuration is not supported on the datastream level, so annotations like `co.elastic.hints/.processors` are ignored.
+Processor configuration is not supported on the data stream level, so annotations like `co.elastic.hints/.processors` are ignored.
::::
diff --git a/reference/fleet/ingest-pipeline-kubernetes.md b/reference/fleet/ingest-pipeline-kubernetes.md
index 82cf7b1b6f..bb48f687f5 100644
--- a/reference/fleet/ingest-pipeline-kubernetes.md
+++ b/reference/fleet/ingest-pipeline-kubernetes.md
@@ -37,7 +37,7 @@ Enabling deployment and cronjob metadata enrichment leads to an increase of Elas
As an alternative to keeping the feature enabled and using more memory resources for {{agent}}, users can make use of ingest pipelines to add the missing fields of `kubernetes.deployment.name` and `kubernetes.cronjob.name`.
-Navigate to `state_pod` datastream under: **Kubernetes Integration Policy > Collect Kubernetes metrics from Kube-state-metrics > Kubernetes Pod Metrics**.
+Navigate to `state_pod` data stream under: **Kubernetes Integration Policy > Collect Kubernetes metrics from Kube-state-metrics > Kubernetes Pod Metrics**.
Create the following custom ingest pipeline with two processors:
diff --git a/reference/fleet/install-elastic-agents.md b/reference/fleet/install-elastic-agents.md
index 46874b8908..84c746dc65 100644
--- a/reference/fleet/install-elastic-agents.md
+++ b/reference/fleet/install-elastic-agents.md
@@ -24,9 +24,9 @@ Note the following restrictions when installing {{agent}} on your system:
::::{admonition} New FIPS compatible install packages
-:class: note
+:applies_to: stack: preview 9.1
-{applies_to}`stack: preview 9.1` FIPS compatible binaries for {{agent}}, {{fleet}}, and other ingest tools are available for download. Look for the `Linux 64-bit (FIPS)` or `Linux aarch64 (FIPS)` platform option on the product [download page](https://www.elastic.co/downloads). Get more details about FIPS compatibility for {{agent}}, {{fleet}} and other ingest tools in [FIPS mode for Ingest tools](/deploy-manage/security/fips-ingest.md).
+FIPS compatible binaries for {{agent}}, {{fleet}}, and other ingest tools are available for download. Look for the `Linux 64-bit (FIPS)` or `Linux aarch64 (FIPS)` platform option on the product [download page](https://www.elastic.co/downloads). Get more details about FIPS compatibility for {{agent}}, {{fleet}} and other ingest tools in [FIPS mode for Ingest tools](/deploy-manage/security/fips-ingest.md).
::::
diff --git a/reference/fleet/integrations-assets-best-practices.md b/reference/fleet/integrations-assets-best-practices.md
index 83e63c578d..d3b9f20f74 100644
--- a/reference/fleet/integrations-assets-best-practices.md
+++ b/reference/fleet/integrations-assets-best-practices.md
@@ -64,7 +64,7 @@ While creating a `@custom` component template for a package integration is suppo
For example:
-* If the `@package` component template of an integration is changed from a "normal" datastream to `TSDB` or `LogsDB`, some of the custom settings or mappings introduced may not be compatible with these indexing modes.
+* If the `@package` component template of an integration is changed from a "normal" data stream to `TSDB` or `LogsDB`, some of the custom settings or mappings introduced may not be compatible with these indexing modes.
* If the type of an ECS field is overridden from, for example, `keyword` to `text`, aggregations based on that field may be prevented for built-in dashboards.
A similar caution against custom index mappings is noted in [Edit the {{es}} index template](/reference/fleet/data-streams.md#data-streams-index-templates-edit).
@@ -83,6 +83,6 @@ When you clone the index template of an integration package, this involves risk
Additionally, cloning index templates to add or inject additional component templates cannot be tested by Elastic, so we cannot guarantee that the template will work in future releases.
-If you want to change the ILM Policy, the number of shards, or other settings for the datastreams of one or more integrations, but the changes do not need to be specific to a given namespace, it’s highly recommended to use the `package@custom` component templates, as described in [Scenario 1](/reference/fleet/data-streams-scenario1.md) and [Scenario 2](/reference/fleet/data-streams-scenario2.md) of the Customize data retention policies tutorial, so as to avoid the problems mentioned above.
+If you want to change the ILM Policy, the number of shards, or other settings for the data streams of one or more integrations, but the changes do not need to be specific to a given namespace, it’s highly recommended to use the `package@custom` component templates, as described in [Scenario 1](/reference/fleet/data-streams-scenario1.md) and [Scenario 2](/reference/fleet/data-streams-scenario2.md) of the Customize data retention policies tutorial, so as to avoid the problems mentioned above.
If you want to change these settings for the data streams in one or more integrations and the changes **need to be namespace specific**, then you can do so following the steps in [Scenario 3](/reference/fleet/data-streams-scenario3.md) of the Customize data retention policies tutorial, but be aware of the restrictions mentioned above.
diff --git a/reference/fleet/migrate-auditbeat-to-agent.md b/reference/fleet/migrate-auditbeat-to-agent.md
index 2d193a726f..ea80433de8 100644
--- a/reference/fleet/migrate-auditbeat-to-agent.md
+++ b/reference/fleet/migrate-auditbeat-to-agent.md
@@ -8,7 +8,7 @@ products:
# Migrate from Auditbeat to Elastic Agent [migrate-auditbeat-to-agent]
-Before you begin, read [*Migrate from {{beats}} to {{agent}}*](/reference/fleet/migrate-from-beats-to-elastic-agent.md) to learn how to deploy {{agent}} and install integrations.
+Before you begin, read [Migrate from {{beats}} to {{agent}}](/reference/fleet/migrate-from-beats-to-elastic-agent.md) to learn how to deploy {{agent}} and install integrations.
Then come back to this page to learn about the integrations available to replace functionality provided by {{auditbeat}}.
@@ -36,7 +36,7 @@ The following table describes the integrations you can use instead of {{auditbea
| [Osquery](integration-docs://reference/osquery/index.md) or [Osquery Manager](integration-docs://reference/osquery_manager/index.md) integration | Schedule collection of information like:
* [rpm_packages](https://www.osquery.io/schema/5.1.0/#rpm_packages)
* [deb_packages](https://www.osquery.io/schema/5.1.0/#deb_packages)
* [homebrew_packages](https://www.osquery.io/schema/5.1.0/#homebrew_packages)
* [apps](https://www.osquery.io/schema/5.1.0/#apps) (MacOS)
* [programs](https://www.osquery.io/schema/5.1.0/#programs) (Windows)
* [npm_packages](https://www.osquery.io/schema/5.1.0/#npm_packages)
* [atom_packages](https://www.osquery.io/schema/5.1.0/#atom_packages)
* [chocolatey_packages](https://www.osquery.io/schema/5.1.0/#chocolatey_packages)
* [portage_packages](https://www.osquery.io/schema/5.1.0/#portage_packages)
* [python_packages](https://www.osquery.io/schema/5.1.0/#python_packages)
|
| [System.process](beats://reference/auditbeat/auditbeat-dataset-system-process.md) dataset | [Endpoint](/solutions/security/configure-elastic-defend/install-elastic-defend.md) | Best replacement because out of the box it reports events for every process in [ECS](integration-docs://reference/index.md) format and has excellent integration in {{kib}}. |
| [Custom Windows event log](integration-docs://reference/winlog/index.md) and [Sysmon](integration-docs://reference/sysmon_linux/index.md) integrations | Provide process data. |
-| [Osquery](integration-docs://reference/osquery/index.md) or [Osquery Manager](integration-docs://reference/osquery_manager/index.md) integration | Collect data from the [process](https://www.osquery.io/schema/5.1.0/#process) table on some OSes without polling. |
+| [Osquery](integration-docs://reference/osquery/index.md) or [Osquery Manager](integration-docs://reference/osquery_manager/index.md) integration | Collect data from the [process](https://www.osquery.io/schema/5.1.0/#process) table on some operating systems without polling. |
| [System.socket](beats://reference/auditbeat/auditbeat-dataset-system-socket.md) dataset | [Endpoint](/solutions/security/configure-elastic-defend/install-elastic-defend.md) | Best replacement because it supports monitoring network connections on Linux, Windows, and MacOS. Includes process and user metadata. Currently does not do flow accounting (byte and packet counts) or domain name enrichment (but does collect DNS queries separately). |
| [Osquery](integration-docs://reference/osquery/index.md) or [Osquery Manager](integration-docs://reference/osquery_manager/index.md) integration | Monitor socket events via the [socket_events](https://www.osquery.io/schema/5.1.0/#socket_events) table for Linux and MacOS. |
| [System.user](beats://reference/auditbeat/auditbeat-dataset-system-user.md) dataset | [Osquery](integration-docs://reference/osquery/index.md) or [Osquery Manager](integration-docs://reference/osquery_manager/index.md) integration | Monitor local users via the [user](https://www.osquery.io/schema/5.1.0/#user) table for Linux, Windows, and MacOS. |
diff --git a/reference/fleet/monitor-elastic-agent.md b/reference/fleet/monitor-elastic-agent.md
index c9433900d1..4a24fcb9d4 100644
--- a/reference/fleet/monitor-elastic-agent.md
+++ b/reference/fleet/monitor-elastic-agent.md
@@ -244,9 +244,9 @@ You can access the health status of {{fleet}}-managed {{agents}} and other {{fle
This functionality allows you to effectively track an agent’s status, and identify scenarios where it has gone offline, is experiencing health issues, or is facing challenges related to input or output.
-The following datastreams and fields are available.
+The following data streams and fields are available.
-Datastream
+Data stream
: `metrics-fleet_server.agent_status-default`
This data stream publishes the number of {{agents}} in various states.
@@ -268,7 +268,7 @@ Datastream
::::
-Datastream
+Data stream
: `metrics-fleet_server.agent_versions-default`
This index publishes a separate document for each version number and a count of enrolled agents only.
diff --git a/reference/fleet/processor-parse-aws-vpc-flow-log.md b/reference/fleet/processor-parse-aws-vpc-flow-log.md
index 7bccf04753..8e29320f01 100644
--- a/reference/fleet/processor-parse-aws-vpc-flow-log.md
+++ b/reference/fleet/processor-parse-aws-vpc-flow-log.md
@@ -125,7 +125,7 @@ This mode maps the original VPC flow log fields into their associated Elastic Co
### ECS and Original [_ecs_and_original]
-This mode maps the fields into ECS and retains all the original fields. Below is an example document produced using `ecs_and_orignal` mode.
+This mode maps the fields into ECS and retains all the original fields. Below is an example document produced using `ecs_and_original` mode.
```json
{
diff --git a/reference/fleet/scaling-on-kubernetes.md b/reference/fleet/scaling-on-kubernetes.md
index 07a97fdcc5..18cffe2813 100644
--- a/reference/fleet/scaling-on-kubernetes.md
+++ b/reference/fleet/scaling-on-kubernetes.md
@@ -49,7 +49,7 @@ The {{k8s}} {{observability}} is based on [Elastic {{k8s}} integration](integrat
* apiserver
-Controller manager and Scheduler datastreams are being enabled only on the specific node that actually runs based on autodiscovery rules
+Controller manager and Scheduler data streams are being enabled only on the specific node that actually runs based on autodiscovery rules
The default manifest provided deploys {{agent}} as DaemonSet which results in an {{agent}} being deployed on every node of the {{k8s}} cluster.
@@ -142,7 +142,7 @@ Tests have run until 10K pods per cluster. Scaling to bigger number of pods migh
Setting the low priority to {{agent}} comparing to other pods might also result to {{agent}} being in Pending State.The scheduler tries to preempt (evict) lower priority Pods to make scheduling of the higher pending Pods possible.
-Trying to prioritise the agent installation before rest of application microservices, [PriorityClasses suggested](https://github.com/elastic/elastic-agent/blob/main/docs/manifests/elastic-agent-managed-gke-autopilot.yaml#L8-L16)
+Trying to prioritize the agent installation before rest of application microservices, [PriorityClasses suggested](https://github.com/elastic/elastic-agent/blob/main/docs/manifests/elastic-agent-managed-gke-autopilot.yaml#L8-L16)
#### {{k8s}} Package configuration [_k8s_package_configuration]
@@ -156,18 +156,18 @@ Policy configuration of {{k8s}} package can heavily affect the amount of metrics
* Disable {{k8s}} control plane datasets in Cloud managed {{k8s}} instances (see more info ** [Run {{agent}} on GKE managed by {{fleet}}](/reference/fleet/running-on-gke-managed-by-fleet.md), [Run {{agent}} on Amazon EKS managed by {{fleet}}](/reference/fleet/running-on-eks-managed-by-fleet.md), [Run {{agent}} on Azure AKS managed by {{fleet}}](/reference/fleet/running-on-aks-managed-by-fleet.md) pages)
-#### Dashboards and visualisations [_dashboards_and_visualisations]
+#### Dashboards and visualizations [_dashboards_and_visualisations]
The [Dashboard Guidelines](https://github.com/elastic/integrations/blob/main/docs/dashboard_guidelines.md) document provides guidance on how to implement your dashboards and is constantly updated to track the needs of Observability at scale.
-User experience regarding Dashboard responses, is also affected from the size of data being requested. As dashboards can contain multiple visualisations, the general consideration is to split visualisations and group them according to the frequency of access. The less number of visualisations tends to improve user experience.
+User experience regarding Dashboard responses, is also affected from the size of data being requested. As dashboards can contain multiple visualizations, the general consideration is to split visualizations and group them according to the frequency of access. The less number of visualizations tends to improve user experience.
#### Disabling indexing host.ip and host.mac fields [_disabling_indexing_host_ip_and_host_mac_fields]
-A new environemntal variable `ELASTIC_NETINFO: false` has been introduced to globally disable the indexing of `host.ip` and `host.mac` fields in your {{k8s}} integration. For more information see [Environment variables](/reference/fleet/agent-environment-variables.md).
+A new environmental variable `ELASTIC_NETINFO: false` has been introduced to globally disable the indexing of `host.ip` and `host.mac` fields in your {{k8s}} integration. For more information see [Environment variables](/reference/fleet/agent-environment-variables.md).
-Setting this to `false` is recommended for large scale setups where the `host.ip` and `host.mac` fields' index size increases. The number of IPs and MAC addresses reported increases significantly as a Kubenetes cluster grows. This leads to considerably increased indexing time, as well as the need for extra storage and additional overhead for visualization rendering.
+Setting this to `false` is recommended for large scale setups where the `host.ip` and `host.mac` fields' index size increases. The number of IPs and MAC addresses reported increases significantly as a Kubernetes cluster grows. This leads to considerably increased indexing time, as well as the need for extra storage and additional overhead for visualization rendering.
#### Elastic Stack configuration [_elastic_stack_configuration]
@@ -186,7 +186,7 @@ After {{agent}} deployment, we need to verify that Agent services are healthy, n
**For stability:**
-If {{agent}} is configured as managed, in {{kib}} you can observe under **Fleet>Agents**
+If {{agent}} is configured as managed, in {{kib}} you can observe under **Fleet** > **Agents**
:::{image} images/kibana-fleet-agents.png
:alt: {{agent}} Status
@@ -236,7 +236,7 @@ It is a common problem of lack of CPU/memory resources that agent process restar
```json
kubectl logs -n kube-system elastic-agent-qw6f4 | grep "kubernetes/metrics"
-[ouptut truncated ...]
+[output truncated ...]
(HEALTHY->STOPPED): Suppressing FAILED state due to restart for '46554' exited with code '-1'","log":{"source":"elastic-agent"},"component":{"id":"kubernetes/metrics-default","state":"STOPPED"},"unit":{"id":"kubernetes/metrics-default-kubernetes/metrics-kube-state-metrics-c6180794-70ce-4c0d-b775-b251571b6d78","type":"input","state":"STOPPED","old_state":"HEALTHY"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-04-03T09:33:38.919Z","log.origin":{"file.name":"coordinator/coordinator.go","file.line":861},"message":"Unit state changed kubernetes/metrics-default-kubernetes/metrics-kube-apiserver-c6180794-70ce-4c0d-b775-b251571b6d78 (HEALTHY->STOPPED): Suppressing FAILED state due to restart for '46554' exited with code '-1'","log":{"source":"elastic-agent"}
@@ -275,7 +275,7 @@ Identify how many events have been sent to {{es}}:
```bash
kubectl logs -n kube-system elastic-agent-h24hh -f | grep -i state_pod
-[ouptut truncated ...]
+[output truncated ...]
"state_pod":{"events":2936,"success":2936}
```
@@ -286,9 +286,9 @@ For example, in a cluster with 798 pods, then 798 docs should be depicted in blo
#### Define if {{es}} is the bottleneck of ingestion [_define_if_es_is_the_bottleneck_of_ingestion]
-In some cases maybe the {{es}} can not cope with the rate of data that are trying to be ingested. In order to verify the resource utilisation, installation of an [{{stack}} monitoring cluster](/deploy-manage/monitor/stack-monitoring.md) is advised.
+In some cases maybe the {{es}} can not cope with the rate of data that are trying to be ingested. In order to verify the resource utilization, installation of an [{{stack}} monitoring cluster](/deploy-manage/monitor/stack-monitoring.md) is advised.
-Additionally, in {{ecloud}} deployments you can navigate to **Manage Deployment > Deployments > Monitoring > Performance**. Corresponding dashboards for `CPU Usage`, `Index Response Times` and `Memory Pressure` can reveal possible problems and suggest vertical scaling of {{stack}} resources.
+Additionally, in {{ecloud}} deployments you can navigate to **Manage Deployment** > **Deployments** > **Monitoring** > **Performance**. Corresponding dashboards for `CPU Usage`, `Index Response Times` and `Memory Pressure` can reveal possible problems and suggest vertical scaling of {{stack}} resources.
## Relevant links [_relevant_links]
diff --git a/reference/fleet/script-processor.md b/reference/fleet/script-processor.md
index 95ffd9e6e9..85cc43d3dc 100644
--- a/reference/fleet/script-processor.md
+++ b/reference/fleet/script-processor.md
@@ -99,11 +99,11 @@ The `Event` object passed to the `process` method has the following API.
| Method | Description |
| --- | --- |
-| `Get(string)` | Get a value from the event (either a scalar or an object). If the key does notexist `null` is returned. If no key is provided then an object containing allfields is returned.
**Example**: `var value = event.Get(key);` |
-| `Put(string, value)` | Put a value into the event. If the key was already set then theprevious value is returned. It throws an exception if the key cannot be setbecause one of the intermediate values is not an object.
**Example**: `var old = event.Put(key, value);` |
-| `Rename(string, string)` | Rename a key in the event. The target key must not exist. Itreturns true if the source key was successfully renamed to the target key.
**Example**: `var success = event.Rename("source", "target");` |
+| `Get(string)` | Get a value from the event (either a scalar or an object). If the key does not exist `null` is returned. If no key is provided then an object containing all fields is returned.
**Example**: `var value = event.Get(key);` |
+| `Put(string, value)` | Put a value into the event. If the key was already set then the previous value is returned. It throws an exception if the key cannot be set because one of the intermediate values is not an object.
**Example**: `var old = event.Put(key, value);` |
+| `Rename(string, string)` | Rename a key in the event. The target key must not exist. It returns true if the source key was successfully renamed to the target key.
**Example**: `var success = event.Rename("source", "target");` |
| `Delete(string)` | Delete a field from the event. It returns true on success.
**Example**: `var deleted = event.Delete("user.email");` |
-| `Cancel()` | Flag the event as cancelled which causes the processor to dropevent.
**Example**: `event.Cancel(); return;` |
-| `Tag(string)` | Append a tag to the `tags` field if the tag does not alreadyexist. Throws an exception if `tags` exists and is not a string or a list ofstrings.
**Example**: `event.Tag("user_event");` |
-| `AppendTo(string, string)` | `AppendTo` is a specialized `Put` method that converts the existing value to anarray and appends the value if it does not already exist. If there is anexisting value that’s not a string or array of strings then an exception isthrown.
**Example**: `event.AppendTo("error.message", "invalid file hash");` |
+| `Cancel()` | Flag the event as cancelled which causes the processor to drop event.
**Example**: `event.Cancel(); return;` |
+| `Tag(string)` | Append a tag to the `tags` field if the tag does not already exist. Throws an exception if `tags` exists and is not a string or a list of strings.
**Example**: `event.Tag("user_event");` |
+| `AppendTo(string, string)` | `AppendTo` is a specialized `Put` method that converts the existing value to an array and appends the value if it does not already exist. If there is an existing value that’s not a string or array of strings then an exception is thrown.
**Example**: `event.AppendTo("error.message", "invalid file hash");` |
diff --git a/reference/fleet/upgrade-standalone.md b/reference/fleet/upgrade-standalone.md
index 3e5c127ac2..d092ebdd16 100644
--- a/reference/fleet/upgrade-standalone.md
+++ b/reference/fleet/upgrade-standalone.md
@@ -25,7 +25,7 @@ This command upgrades the binary. Your agent policy should continue to work, but
For more command-line options, see the help for the [`upgrade`](/reference/fleet/agent-command-reference.md#elastic-agent-upgrade-command) command.
-## Upgrading standalone {{agent}} in an air-gapped environmment [upgrade-standalone-air-gapped]
+## Upgrading standalone {{agent}} in an air-gapped environment [upgrade-standalone-air-gapped]
The basic upgrade scenario should work for most use cases. However, in an air-gapped environment {{agent}} is not able to access the {{artifact-registry}} at `artifacts.elastic.co` directly.
@@ -41,7 +41,7 @@ Refer to [Air-gapped environments](/reference/fleet/air-gapped.md) for more deta
## Verifying {{agent}} package signatures [upgrade-standalone-verify-package]
-Standalone {{agent}} verifies each package that it downloads using publically available SHA hash and .asc PGP signature files. The SHA file is used to verify that the package has not been modified, and the .asc file is used to verify that the package was released by Elastic. For this purpose, the Elastic public GPG key is embedded in {{agent}} itself.
+Standalone {{agent}} verifies each package that it downloads using publicly available SHA hash and .asc PGP signature files. The SHA file is used to verify that the package has not been modified, and the .asc file is used to verify that the package was released by Elastic. For this purpose, the Elastic public GPG key is embedded in {{agent}} itself.
At times, the Elastic private GPG key may need to be rotated, either due to the key expiry or due to the private key having been exposed. In this case, standalone {{agent}} upgrades can fail because the embedded public key no longer works.