diff --git a/manage-data/data-store/data-streams.md b/manage-data/data-store/data-streams.md
index f551f9d291..ccd1437e39 100644
--- a/manage-data/data-store/data-streams.md
+++ b/manage-data/data-store/data-streams.md
@@ -32,7 +32,7 @@ Keep in mind that some features such as [Time Series Data Streams (TSDS)](../dat
A data stream consists of one or more [hidden](elasticsearch://reference/elasticsearch/index-settings/index-modules.md#index-hidden), auto-generated backing indices.
-:::{image} ../../images/elasticsearch-reference-data-streams-diagram.svg
+:::{image} /manage-data/images/elasticsearch-reference-data-streams-diagram.svg
:alt: data streams diagram
:::
@@ -49,7 +49,7 @@ The name pattern for the backing indices is an implementation detail and no inte
When you submit a read request to a data stream, the stream routes the request to all its backing indices.
-:::{image} ../../images/elasticsearch-reference-data-streams-search-request.svg
+:::{image} /manage-data/images/elasticsearch-reference-data-streams-search-request.svg
:alt: data streams search request
:::
@@ -58,7 +58,7 @@ When you submit a read request to a data stream, the stream routes the request t
The most recently created backing index is the data stream’s write index. The stream adds new documents to this index only.
-:::{image} ../../images/elasticsearch-reference-data-streams-index-request.svg
+:::{image} /manage-data/images/elasticsearch-reference-data-streams-index-request.svg
:alt: data streams index request
:::
diff --git a/manage-data/data-store/data-streams/downsampling-time-series-data-stream.md b/manage-data/data-store/data-streams/downsampling-time-series-data-stream.md
index 8e16085401..1017b07456 100644
--- a/manage-data/data-store/data-streams/downsampling-time-series-data-stream.md
+++ b/manage-data/data-store/data-streams/downsampling-time-series-data-stream.md
@@ -27,26 +27,26 @@ Check the following sections to learn more:
A [time series](time-series-data-stream-tsds.md#time-series) is a sequence of observations taken over time for a specific entity. The observed samples can be represented as a continuous function, where the time series dimensions remain constant and the time series metrics change over time.
-:::{image} ../../../images/elasticsearch-reference-time-series-function.png
+:::{image} /manage-data/images/elasticsearch-reference-time-series-function.png
:alt: time series function
:::
In an Elasticsearch index, a single document is created for each timestamp, containing the immutable time series dimensions, together with the metrics names and the changing metrics values. For a single timestamp, several time series dimensions and metrics may be stored.
-:::{image} ../../../images/elasticsearch-reference-time-series-metric-anatomy.png
+:::{image} /manage-data/images/elasticsearch-reference-time-series-metric-anatomy.png
:alt: time series metric anatomy
:::
For your most current and relevant data, the metrics series typically has a low sampling time interval, so it’s optimized for queries that require a high data resolution.
-:::{image} ../../../images/elasticsearch-reference-time-series-original.png
+:::{image} /manage-data/images/elasticsearch-reference-time-series-original.png
:alt: time series original
:title: Original metrics series
:::
Downsampling works on older, less frequently accessed data by replacing the original time series with both a data stream of a higher sampling interval and statistical representations of that data. Where the original metrics samples may have been taken, for example, every ten seconds, as the data ages you may choose to reduce the sample granularity to hourly or daily. You may choose to reduce the granularity of `cold` archival data to monthly or less.
-:::{image} ../../../images/elasticsearch-reference-time-series-downsampled.png
+:::{image} /manage-data/images/elasticsearch-reference-time-series-downsampled.png
:alt: time series downsampled
:title: Downsampled metrics series
:::
diff --git a/manage-data/data-store/data-streams/manage-data-stream.md b/manage-data/data-store/data-streams/manage-data-stream.md
index e948dff3a4..8311bfe926 100644
--- a/manage-data/data-store/data-streams/manage-data-stream.md
+++ b/manage-data/data-store/data-streams/manage-data-stream.md
@@ -14,7 +14,7 @@ A value in the data retention column indicates that the data stream is managed b
In {{es-serverless}}, indices matching the `logs-*-*` pattern use the logsDB index mode by default. The logsDB index mode creates a [logs data stream](./logs-data-stream.md).
-:::{image} ../../../images/serverless-management-data-stream.png
+:::{image} /manage-data/images/serverless-management-data-stream.png
:alt: Data stream details
:screenshot:
:::
diff --git a/manage-data/data-store/data-streams/time-series-data-stream-tsds.md b/manage-data/data-store/data-streams/time-series-data-stream-tsds.md
index d333e21a13..a8211cddc2 100644
--- a/manage-data/data-store/data-streams/time-series-data-stream-tsds.md
+++ b/manage-data/data-store/data-streams/time-series-data-stream-tsds.md
@@ -50,7 +50,7 @@ A time series is a sequence of observations for a specific entity. Together, the
* The price of a stock
* Temperature and humidity readings from a weather sensor.
-:::{image} ../../../images/elasticsearch-reference-time-series-chart.svg
+:::{image} /manage-data/images/elasticsearch-reference-time-series-chart.svg
:alt: time series chart
:title: Time series of weather sensor readings plotted as a graph
:::
@@ -146,7 +146,7 @@ In a TSDS, each backing index, including the most recent backing index, has a ra
When you add a document to a TSDS, {{es}} adds the document to the appropriate backing index based on its `@timestamp` value. As a result, a TSDS can add documents to any TSDS backing index that can receive writes. This applies even if the index isn’t the most recent backing index.
-:::{image} ../../../images/elasticsearch-reference-time-bound-indices.svg
+:::{image} /manage-data/images/elasticsearch-reference-time-bound-indices.svg
:alt: time bound indices
:::
diff --git a/manage-data/data-store/index-basics.md b/manage-data/data-store/index-basics.md
index 41f9d2361c..22f2d241b3 100644
--- a/manage-data/data-store/index-basics.md
+++ b/manage-data/data-store/index-basics.md
@@ -73,7 +73,7 @@ Go to **{{project-settings}} → {{manage-app}} → {{index-manage-app}}**.
Investigate your indices and perform operations from the **Indices** view.
-:::{image} /images/serverless-index-management-indices.png
+:::{image} /manage-data/images/serverless-index-management-indices.png
:alt: Index Management indices
:screenshot:
:::
@@ -89,7 +89,7 @@ A [data stream](/manage-data/data-store/data-streams.md) lets you store append-o
Investigate your data streams and address lifecycle management needs in the **Data Streams** view.
-:::{image} /images/serverless-management-data-stream.png
+:::{image} /manage-data/images/serverless-management-data-stream.png
:alt: Data stream details
:screenshot:
:::
@@ -107,7 +107,7 @@ An [index template](/manage-data/data-store/templates.md) is a way to tell {{es}
Create, edit, clone, and delete your index templates in the **Index Templates** view. Changes made to an index template do not affect existing indices.
-:::{image} /images/serverless-index-management-index-templates.png
+:::{image} /manage-data/images/serverless-index-management-index-templates.png
:alt: Index templates
:screenshot:
:::
@@ -123,7 +123,7 @@ Create, edit, clone, and delete your index templates in the **Index Templates**
Create, edit, clone, and delete your component templates in the **Component Templates** view.
-:::{image} /images/serverless-management-component-templates.png
+:::{image} /manage-data/images/serverless-management-component-templates.png
:alt: Component templates
:screenshot:
:::
@@ -137,7 +137,7 @@ An [enrich policy](/manage-data/ingest/transform-enrich/data-enrichment.md#enric
Add data from your existing indices to incoming documents using the **Enrich Policies** view.
-:::{image} /images/serverless-management-enrich-policies.png
+:::{image} /manage-data/images/serverless-management-enrich-policies.png
:alt: Enrich policies
:screenshot:
:::
diff --git a/manage-data/data-store/near-real-time-search.md b/manage-data/data-store/near-real-time-search.md
index f57309e9e2..8da8901fff 100644
--- a/manage-data/data-store/near-real-time-search.md
+++ b/manage-data/data-store/near-real-time-search.md
@@ -13,7 +13,7 @@ Lucene, the Java libraries on which {{es}} is based, introduced the concept of p
Sitting between {{es}} and the disk is the filesystem cache. Documents in the in-memory indexing buffer ([Figure 1](#img-pre-refresh)) are written to a new segment ([Figure 2](#img-post-refresh)). The new segment is written to the filesystem cache first (which is cheap) and only later is it flushed to disk (which is expensive). However, after a file is in the cache, it can be opened and read just like any other file.
-:::{image} /images/elasticsearch-reference-lucene-in-memory-buffer.png
+:::{image} /manage-data/images/elasticsearch-reference-lucene-in-memory-buffer.png
:alt: A Lucene index with new documents in the in-memory buffer
:title: A Lucene index with new documents in the in-memory buffer
:name: img-pre-refresh
@@ -21,7 +21,7 @@ Sitting between {{es}} and the disk is the filesystem cache. Documents in the in
Lucene allows new segments to be written and opened, making the documents they contain visible to search without performing a full commit. This is a much lighter process than a commit to disk, and can be done frequently without degrading performance.
-:::{image} /images/elasticsearch-reference-lucene-written-not-committed.png
+:::{image} /manage-data/images/elasticsearch-reference-lucene-written-not-committed.png
:alt: The buffer contents are written to a segment, which is searchable, but is not yet committed
:title: The buffer contents are written to a segment, which is searchable, but is not yet committed
:name: img-post-refresh
diff --git a/manage-data/data-store/templates/index-template-management.md b/manage-data/data-store/templates/index-template-management.md
index 4cfb74039d..91d0d5d1a0 100644
--- a/manage-data/data-store/templates/index-template-management.md
+++ b/manage-data/data-store/templates/index-template-management.md
@@ -11,7 +11,7 @@ applies_to:
Create, edit, clone, and delete your index templates in the **Index Templates** view. Changes made to an index template do not affect existing indices.
-:::{image} ../../../images/elasticsearch-reference-management-index-templates.png
+:::{image} /manage-data/images/elasticsearch-reference-management-index-templates.png
:alt: Index templates
:screenshot:
:::
@@ -28,7 +28,7 @@ In this tutorial, you’ll create an index template and use it to configure two
1. In the **Index Templates** view, open the **Create template** wizard.
- :::{image} ../../../images/elasticsearch-reference-management_index_create_wizard.png
+ :::{image} /manage-data/images/elasticsearch-reference-management_index_create_wizard.png
:alt: Create wizard
:screenshot:
:::
@@ -45,7 +45,7 @@ In this tutorial, you’ll create an index template and use it to configure two
Component templates are optional. For this tutorial, do not add any component templates.
- :::{image} ../../../images/elasticsearch-reference-management_index_component_template.png
+ :::{image} /manage-data/images/elasticsearch-reference-management_index_component_template.png
:alt: Component templates page
:screenshot:
:::
@@ -53,7 +53,7 @@ In this tutorial, you’ll create an index template and use it to configure two
2. Define index settings. These are optional. For this tutorial, leave this section blank.
3. Define a mapping that contains an [object](elasticsearch://reference/elasticsearch/mapping-reference/object.md) field named `geo` with a child [`geo_point`](elasticsearch://reference/elasticsearch/mapping-reference/geo-point.md) field named `coordinates`:
- :::{image} ../../../images/elasticsearch-reference-management-index-templates-mappings.png
+ :::{image} /manage-data/images/elasticsearch-reference-management-index-templates-mappings.png
:alt: Mapped fields page
:screenshot:
:::
diff --git a/manage-data/data-store/text-analysis/token-graphs.md b/manage-data/data-store/text-analysis/token-graphs.md
index 02d140f089..7261a83285 100644
--- a/manage-data/data-store/text-analysis/token-graphs.md
+++ b/manage-data/data-store/text-analysis/token-graphs.md
@@ -15,7 +15,7 @@ When a [tokenizer](anatomy-of-an-analyzer.md#analyzer-anatomy-tokenizer) convert
Using these, you can create a [directed acyclic graph](https://en.wikipedia.org/wiki/Directed_acyclic_graph), called a *token graph*, for a stream. In a token graph, each position represents a node. Each token represents an edge or arc, pointing to the next position.
-:::{image} ../../../images/elasticsearch-reference-token-graph-qbf-ex.svg
+:::{image} /manage-data/images/elasticsearch-reference-token-graph-qbf-ex.svg
:alt: token graph qbf ex
:::
@@ -25,7 +25,7 @@ Some [token filters](anatomy-of-an-analyzer.md#analyzer-anatomy-token-filters) c
In the following graph, `quick` and its synonym `fast` both have a position of `0`. They span the same positions.
-:::{image} ../../../images/elasticsearch-reference-token-graph-qbf-synonym-ex.svg
+:::{image} /manage-data/images/elasticsearch-reference-token-graph-qbf-synonym-ex.svg
:alt: token graph qbf synonym ex
:::
@@ -43,7 +43,7 @@ Some tokenizers, such as the [`nori_tokenizer`](elasticsearch://reference/elasti
In the following graph, `domain name system` and its synonym, `dns`, both have a position of `0`. However, `dns` has a `positionLength` of `3`. Other tokens in the graph have a default `positionLength` of `1`.
-:::{image} ../../../images/elasticsearch-reference-token-graph-dns-synonym-ex.svg
+:::{image} /manage-data/images/elasticsearch-reference-token-graph-dns-synonym-ex.svg
:alt: token graph dns synonym ex
:::
@@ -60,7 +60,7 @@ A user runs a search for the following phrase using the `match_phrase` query:
During [search analysis](index-search-analysis.md), `dns`, a synonym for `domain name system`, is added to the query string’s token stream. The `dns` token has a `positionLength` of `3`.
-:::{image} ../../../images/elasticsearch-reference-token-graph-dns-synonym-ex.svg
+:::{image} /manage-data/images/elasticsearch-reference-token-graph-dns-synonym-ex.svg
:alt: token graph dns synonym ex
:::
@@ -88,7 +88,7 @@ This means these filters will produce invalid token graphs for streams containin
In the following graph, `dns` is a multi-position synonym for `domain name system`. However, `dns` has the default `positionLength` value of `1`, resulting in an invalid graph.
-:::{image} ../../../images/elasticsearch-reference-token-graph-dns-invalid-ex.svg
+:::{image} /manage-data/images/elasticsearch-reference-token-graph-dns-invalid-ex.svg
:alt: token graph dns invalid ex
:::
diff --git a/manage-data/images/cloud-ec-ce-remove-tier-filter-instances.png b/manage-data/images/cloud-ec-ce-remove-tier-filter-instances.png
new file mode 100644
index 0000000000..f06b613139
Binary files /dev/null and b/manage-data/images/cloud-ec-ce-remove-tier-filter-instances.png differ
diff --git a/manage-data/images/cloud-ec-logstash-beats-dataflow.png b/manage-data/images/cloud-ec-logstash-beats-dataflow.png
new file mode 100644
index 0000000000..2e7f48627a
Binary files /dev/null and b/manage-data/images/cloud-ec-logstash-beats-dataflow.png differ
diff --git a/manage-data/images/cloud-ec-logstash-beats-filebeat-dashboard.png b/manage-data/images/cloud-ec-logstash-beats-filebeat-dashboard.png
new file mode 100644
index 0000000000..f553f20cfa
Binary files /dev/null and b/manage-data/images/cloud-ec-logstash-beats-filebeat-dashboard.png differ
diff --git a/manage-data/images/cloud-ec-logstash-beats-metricbeat-dashboard.png b/manage-data/images/cloud-ec-logstash-beats-metricbeat-dashboard.png
new file mode 100644
index 0000000000..7eadc7015a
Binary files /dev/null and b/manage-data/images/cloud-ec-logstash-beats-metricbeat-dashboard.png differ
diff --git a/manage-data/images/cloud-ec-logstash-db-results-scenarios.png b/manage-data/images/cloud-ec-logstash-db-results-scenarios.png
new file mode 100644
index 0000000000..287f0dc39a
Binary files /dev/null and b/manage-data/images/cloud-ec-logstash-db-results-scenarios.png differ
diff --git a/manage-data/images/cloud-ec-node-logs-content.png b/manage-data/images/cloud-ec-node-logs-content.png
new file mode 100644
index 0000000000..4aab0e59c2
Binary files /dev/null and b/manage-data/images/cloud-ec-node-logs-content.png differ
diff --git a/manage-data/images/cloud-ec-node-logs-donut.png b/manage-data/images/cloud-ec-node-logs-donut.png
new file mode 100644
index 0000000000..1d659d67fb
Binary files /dev/null and b/manage-data/images/cloud-ec-node-logs-donut.png differ
diff --git a/manage-data/images/cloud-ec-node-logs-final-dashboard.png b/manage-data/images/cloud-ec-node-logs-final-dashboard.png
new file mode 100644
index 0000000000..4df038fcd5
Binary files /dev/null and b/manage-data/images/cloud-ec-node-logs-final-dashboard.png differ
diff --git a/manage-data/images/cloud-ec-node-logs-methods.png b/manage-data/images/cloud-ec-node-logs-methods.png
new file mode 100644
index 0000000000..f514b9ec16
Binary files /dev/null and b/manage-data/images/cloud-ec-node-logs-methods.png differ
diff --git a/manage-data/images/cloud-ec-python-logs-content.png b/manage-data/images/cloud-ec-python-logs-content.png
new file mode 100644
index 0000000000..875bd54d65
Binary files /dev/null and b/manage-data/images/cloud-ec-python-logs-content.png differ
diff --git a/manage-data/images/cloud-ec-python-logs-donut.png b/manage-data/images/cloud-ec-python-logs-donut.png
new file mode 100644
index 0000000000..2a8b8edd45
Binary files /dev/null and b/manage-data/images/cloud-ec-python-logs-donut.png differ
diff --git a/manage-data/images/cloud-ec-python-logs-final-dashboard.png b/manage-data/images/cloud-ec-python-logs-final-dashboard.png
new file mode 100644
index 0000000000..86c208566c
Binary files /dev/null and b/manage-data/images/cloud-ec-python-logs-final-dashboard.png differ
diff --git a/manage-data/images/cloud-ec-python-logs-levels.png b/manage-data/images/cloud-ec-python-logs-levels.png
new file mode 100644
index 0000000000..71258ae857
Binary files /dev/null and b/manage-data/images/cloud-ec-python-logs-levels.png differ
diff --git a/manage-data/images/cloud-enterprise-ec-ce-remove-tier-filter-instances.png b/manage-data/images/cloud-enterprise-ec-ce-remove-tier-filter-instances.png
new file mode 100644
index 0000000000..f06b613139
Binary files /dev/null and b/manage-data/images/cloud-enterprise-ec-ce-remove-tier-filter-instances.png differ
diff --git a/manage-data/images/cloud-enterprise-ec-ce-remove-tier-filter-snapshot-indices.png b/manage-data/images/cloud-enterprise-ec-ce-remove-tier-filter-snapshot-indices.png
new file mode 100644
index 0000000000..884956cb43
Binary files /dev/null and b/manage-data/images/cloud-enterprise-ec-ce-remove-tier-filter-snapshot-indices.png differ
diff --git a/manage-data/images/cloud-enterprise-ec-ce-remove-tier-filtered-cat-shards.png b/manage-data/images/cloud-enterprise-ec-ce-remove-tier-filtered-cat-shards.png
new file mode 100644
index 0000000000..0b04863db6
Binary files /dev/null and b/manage-data/images/cloud-enterprise-ec-ce-remove-tier-filtered-cat-shards.png differ
diff --git a/manage-data/images/cloud-enterprise-ec-ce-remove-tier-remove-alias.png b/manage-data/images/cloud-enterprise-ec-ce-remove-tier-remove-alias.png
new file mode 100644
index 0000000000..8cb2546350
Binary files /dev/null and b/manage-data/images/cloud-enterprise-ec-ce-remove-tier-remove-alias.png differ
diff --git a/manage-data/images/cloud-enterprise-ec-ce-remove-tier-remove-snapshots.png b/manage-data/images/cloud-enterprise-ec-ce-remove-tier-remove-snapshots.png
new file mode 100644
index 0000000000..040b167b97
Binary files /dev/null and b/manage-data/images/cloud-enterprise-ec-ce-remove-tier-remove-snapshots.png differ
diff --git a/manage-data/images/cloud-enterprise-ec-ce-remove-tier-restore-snapshot.png b/manage-data/images/cloud-enterprise-ec-ce-remove-tier-restore-snapshot.png
new file mode 100644
index 0000000000..d6c6f5c722
Binary files /dev/null and b/manage-data/images/cloud-enterprise-ec-ce-remove-tier-restore-snapshot.png differ
diff --git a/manage-data/images/elasticsearch-reference-create-index-template.png b/manage-data/images/elasticsearch-reference-create-index-template.png
new file mode 100644
index 0000000000..7506409897
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-create-index-template.png differ
diff --git a/manage-data/images/elasticsearch-reference-create-policy.png b/manage-data/images/elasticsearch-reference-create-policy.png
new file mode 100644
index 0000000000..738069bf1a
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-create-policy.png differ
diff --git a/manage-data/images/elasticsearch-reference-create-template-wizard-my_template.png b/manage-data/images/elasticsearch-reference-create-template-wizard-my_template.png
new file mode 100644
index 0000000000..fd712e2a6e
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-create-template-wizard-my_template.png differ
diff --git a/manage-data/images/elasticsearch-reference-create-template-wizard.png b/manage-data/images/elasticsearch-reference-create-template-wizard.png
new file mode 100644
index 0000000000..d16f785e92
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-create-template-wizard.png differ
diff --git a/manage-data/images/elasticsearch-reference-custom-logs-pipeline.png b/manage-data/images/elasticsearch-reference-custom-logs-pipeline.png
new file mode 100644
index 0000000000..215038a457
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-custom-logs-pipeline.png differ
diff --git a/manage-data/images/elasticsearch-reference-custom-logs.png b/manage-data/images/elasticsearch-reference-custom-logs.png
new file mode 100644
index 0000000000..d1350ae065
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-custom-logs.png differ
diff --git a/manage-data/images/elasticsearch-reference-data-streams-diagram.svg b/manage-data/images/elasticsearch-reference-data-streams-diagram.svg
new file mode 100644
index 0000000000..442317111e
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-data-streams-diagram.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-data-streams-index-request.svg b/manage-data/images/elasticsearch-reference-data-streams-index-request.svg
new file mode 100644
index 0000000000..05eca0f68a
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-data-streams-index-request.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-data-streams-search-request.svg b/manage-data/images/elasticsearch-reference-data-streams-search-request.svg
new file mode 100644
index 0000000000..0f03b45659
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-data-streams-search-request.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-enrich-policy-index.svg b/manage-data/images/elasticsearch-reference-enrich-policy-index.svg
new file mode 100644
index 0000000000..8ec6ae59a6
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-enrich-policy-index.svg
@@ -0,0 +1,40 @@
+
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-enrich-process.svg b/manage-data/images/elasticsearch-reference-enrich-process.svg
new file mode 100644
index 0000000000..a346f75923
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-enrich-process.svg
@@ -0,0 +1,64 @@
+
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-enrich-processor.svg b/manage-data/images/elasticsearch-reference-enrich-processor.svg
new file mode 100644
index 0000000000..95978c6026
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-enrich-processor.svg
@@ -0,0 +1,50 @@
+
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-ess-advanced-config-data-tiers.png b/manage-data/images/elasticsearch-reference-ess-advanced-config-data-tiers.png
new file mode 100644
index 0000000000..03333bfc89
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-ess-advanced-config-data-tiers.png differ
diff --git a/manage-data/images/elasticsearch-reference-index-lifecycle-policies.png b/manage-data/images/elasticsearch-reference-index-lifecycle-policies.png
new file mode 100644
index 0000000000..a2e5af9fbe
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-index-lifecycle-policies.png differ
diff --git a/manage-data/images/elasticsearch-reference-ingest-pipeline-list.png b/manage-data/images/elasticsearch-reference-ingest-pipeline-list.png
new file mode 100644
index 0000000000..2cf1e5fe76
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-ingest-pipeline-list.png differ
diff --git a/manage-data/images/elasticsearch-reference-ingest-pipeline-processor.png b/manage-data/images/elasticsearch-reference-ingest-pipeline-processor.png
new file mode 100644
index 0000000000..5fff064253
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-ingest-pipeline-processor.png differ
diff --git a/manage-data/images/elasticsearch-reference-ingest-process.svg b/manage-data/images/elasticsearch-reference-ingest-process.svg
new file mode 100644
index 0000000000..6655779853
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-ingest-process.svg
@@ -0,0 +1,42 @@
+
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-lucene-in-memory-buffer.png b/manage-data/images/elasticsearch-reference-lucene-in-memory-buffer.png
new file mode 100644
index 0000000000..3767488618
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-lucene-in-memory-buffer.png differ
diff --git a/manage-data/images/elasticsearch-reference-lucene-written-not-committed.png b/manage-data/images/elasticsearch-reference-lucene-written-not-committed.png
new file mode 100644
index 0000000000..9d295fb412
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-lucene-written-not-committed.png differ
diff --git a/manage-data/images/elasticsearch-reference-management-data-stream-fields.png b/manage-data/images/elasticsearch-reference-management-data-stream-fields.png
new file mode 100644
index 0000000000..605d49b80a
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-management-data-stream-fields.png differ
diff --git a/manage-data/images/elasticsearch-reference-management-enrich-policies.png b/manage-data/images/elasticsearch-reference-management-enrich-policies.png
new file mode 100644
index 0000000000..75911842ae
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-management-enrich-policies.png differ
diff --git a/manage-data/images/elasticsearch-reference-management-index-templates-mappings.png b/manage-data/images/elasticsearch-reference-management-index-templates-mappings.png
new file mode 100644
index 0000000000..5ec34c7797
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-management-index-templates-mappings.png differ
diff --git a/manage-data/images/elasticsearch-reference-management-index-templates.png b/manage-data/images/elasticsearch-reference-management-index-templates.png
new file mode 100644
index 0000000000..1ed004e85e
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-management-index-templates.png differ
diff --git a/manage-data/images/elasticsearch-reference-management_index_component_template.png b/manage-data/images/elasticsearch-reference-management_index_component_template.png
new file mode 100644
index 0000000000..766bfb8d71
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-management_index_component_template.png differ
diff --git a/manage-data/images/elasticsearch-reference-management_index_create_wizard.png b/manage-data/images/elasticsearch-reference-management_index_create_wizard.png
new file mode 100644
index 0000000000..0b5147e212
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-management_index_create_wizard.png differ
diff --git a/manage-data/images/elasticsearch-reference-management_index_details.png b/manage-data/images/elasticsearch-reference-management_index_details.png
new file mode 100644
index 0000000000..a975b9952c
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-management_index_details.png differ
diff --git a/manage-data/images/elasticsearch-reference-management_index_labels.png b/manage-data/images/elasticsearch-reference-management_index_labels.png
new file mode 100644
index 0000000000..caec6d5afc
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-management_index_labels.png differ
diff --git a/manage-data/images/elasticsearch-reference-test-a-pipeline.png b/manage-data/images/elasticsearch-reference-test-a-pipeline.png
new file mode 100644
index 0000000000..65ee2815eb
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-test-a-pipeline.png differ
diff --git a/manage-data/images/elasticsearch-reference-time-bound-indices.svg b/manage-data/images/elasticsearch-reference-time-bound-indices.svg
new file mode 100644
index 0000000000..bcd60e7475
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-time-bound-indices.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-time-series-chart.svg b/manage-data/images/elasticsearch-reference-time-series-chart.svg
new file mode 100644
index 0000000000..ce09bde046
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-time-series-chart.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-time-series-downsampled.png b/manage-data/images/elasticsearch-reference-time-series-downsampled.png
new file mode 100644
index 0000000000..954890f604
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-time-series-downsampled.png differ
diff --git a/manage-data/images/elasticsearch-reference-time-series-function.png b/manage-data/images/elasticsearch-reference-time-series-function.png
new file mode 100644
index 0000000000..f508ba1b83
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-time-series-function.png differ
diff --git a/manage-data/images/elasticsearch-reference-time-series-metric-anatomy.png b/manage-data/images/elasticsearch-reference-time-series-metric-anatomy.png
new file mode 100644
index 0000000000..8616f40f18
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-time-series-metric-anatomy.png differ
diff --git a/manage-data/images/elasticsearch-reference-time-series-original.png b/manage-data/images/elasticsearch-reference-time-series-original.png
new file mode 100644
index 0000000000..441f1a80a6
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-time-series-original.png differ
diff --git a/manage-data/images/elasticsearch-reference-token-graph-dns-invalid-ex.svg b/manage-data/images/elasticsearch-reference-token-graph-dns-invalid-ex.svg
new file mode 100644
index 0000000000..5614f39bfe
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-token-graph-dns-invalid-ex.svg
@@ -0,0 +1,72 @@
+
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-token-graph-dns-synonym-ex.svg b/manage-data/images/elasticsearch-reference-token-graph-dns-synonym-ex.svg
new file mode 100644
index 0000000000..cff5b1306b
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-token-graph-dns-synonym-ex.svg
@@ -0,0 +1,72 @@
+
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-token-graph-qbf-ex.svg b/manage-data/images/elasticsearch-reference-token-graph-qbf-ex.svg
new file mode 100644
index 0000000000..6397067309
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-token-graph-qbf-ex.svg
@@ -0,0 +1,45 @@
+
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-token-graph-qbf-synonym-ex.svg b/manage-data/images/elasticsearch-reference-token-graph-qbf-synonym-ex.svg
new file mode 100644
index 0000000000..2baa3d9e63
--- /dev/null
+++ b/manage-data/images/elasticsearch-reference-token-graph-qbf-synonym-ex.svg
@@ -0,0 +1,52 @@
+
+
\ No newline at end of file
diff --git a/manage-data/images/elasticsearch-reference-tutorial-ilm-delete-rollover.png b/manage-data/images/elasticsearch-reference-tutorial-ilm-delete-rollover.png
new file mode 100644
index 0000000000..2a4fabc550
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-tutorial-ilm-delete-rollover.png differ
diff --git a/manage-data/images/elasticsearch-reference-tutorial-ilm-enable-delete-phase.png b/manage-data/images/elasticsearch-reference-tutorial-ilm-enable-delete-phase.png
new file mode 100644
index 0000000000..4d4eb9b964
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-tutorial-ilm-enable-delete-phase.png differ
diff --git a/manage-data/images/elasticsearch-reference-tutorial-ilm-ess-add-warm-data-tier.png b/manage-data/images/elasticsearch-reference-tutorial-ilm-ess-add-warm-data-tier.png
new file mode 100644
index 0000000000..2194c6d10f
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-tutorial-ilm-ess-add-warm-data-tier.png differ
diff --git a/manage-data/images/elasticsearch-reference-tutorial-ilm-hotphaserollover-default.png b/manage-data/images/elasticsearch-reference-tutorial-ilm-hotphaserollover-default.png
new file mode 100644
index 0000000000..d7f314cedb
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-tutorial-ilm-hotphaserollover-default.png differ
diff --git a/manage-data/images/elasticsearch-reference-tutorial-ilm-modify-default-warm-phase-rollover.png b/manage-data/images/elasticsearch-reference-tutorial-ilm-modify-default-warm-phase-rollover.png
new file mode 100644
index 0000000000..683d8be328
Binary files /dev/null and b/manage-data/images/elasticsearch-reference-tutorial-ilm-modify-default-warm-phase-rollover.png differ
diff --git a/manage-data/images/ingest-ea-agent-installed.png b/manage-data/images/ingest-ea-agent-installed.png
new file mode 100644
index 0000000000..22d3b81cab
Binary files /dev/null and b/manage-data/images/ingest-ea-agent-installed.png differ
diff --git a/manage-data/images/ingest-ea-airgapped.png b/manage-data/images/ingest-ea-airgapped.png
new file mode 100644
index 0000000000..4c0b3ca704
Binary files /dev/null and b/manage-data/images/ingest-ea-airgapped.png differ
diff --git a/manage-data/images/ingest-ea-apis.png b/manage-data/images/ingest-ea-apis.png
new file mode 100644
index 0000000000..5dc1911659
Binary files /dev/null and b/manage-data/images/ingest-ea-apis.png differ
diff --git a/manage-data/images/ingest-ea-es-airgapped.png b/manage-data/images/ingest-ea-es-airgapped.png
new file mode 100644
index 0000000000..87d02e29e4
Binary files /dev/null and b/manage-data/images/ingest-ea-es-airgapped.png differ
diff --git a/manage-data/images/ingest-ea-es.png b/manage-data/images/ingest-ea-es.png
new file mode 100644
index 0000000000..889ebc33a0
Binary files /dev/null and b/manage-data/images/ingest-ea-es.png differ
diff --git a/manage-data/images/ingest-ea-fs-proxy-es.png b/manage-data/images/ingest-ea-fs-proxy-es.png
new file mode 100644
index 0000000000..7b8a9cbf77
Binary files /dev/null and b/manage-data/images/ingest-ea-fs-proxy-es.png differ
diff --git a/manage-data/images/ingest-ea-kafka.png b/manage-data/images/ingest-ea-kafka.png
new file mode 100644
index 0000000000..f5b8d55062
Binary files /dev/null and b/manage-data/images/ingest-ea-kafka.png differ
diff --git a/manage-data/images/ingest-ea-ls-airgapped.png b/manage-data/images/ingest-ea-ls-airgapped.png
new file mode 100644
index 0000000000..035978d1f2
Binary files /dev/null and b/manage-data/images/ingest-ea-ls-airgapped.png differ
diff --git a/manage-data/images/ingest-ea-ls-bridge.png b/manage-data/images/ingest-ea-ls-bridge.png
new file mode 100644
index 0000000000..9cbc548546
Binary files /dev/null and b/manage-data/images/ingest-ea-ls-bridge.png differ
diff --git a/manage-data/images/ingest-ea-ls-enrich.png b/manage-data/images/ingest-ea-ls-enrich.png
new file mode 100644
index 0000000000..9cdedb527c
Binary files /dev/null and b/manage-data/images/ingest-ea-ls-enrich.png differ
diff --git a/manage-data/images/ingest-ea-ls-es.png b/manage-data/images/ingest-ea-ls-es.png
new file mode 100644
index 0000000000..e549263e7a
Binary files /dev/null and b/manage-data/images/ingest-ea-ls-es.png differ
diff --git a/manage-data/images/ingest-ea-ls-multi.png b/manage-data/images/ingest-ea-ls-multi.png
new file mode 100644
index 0000000000..232f58ac2f
Binary files /dev/null and b/manage-data/images/ingest-ea-ls-multi.png differ
diff --git a/manage-data/images/ingest-ea-lspq-es.png b/manage-data/images/ingest-ea-lspq-es.png
new file mode 100644
index 0000000000..26c905e25a
Binary files /dev/null and b/manage-data/images/ingest-ea-lspq-es.png differ
diff --git a/manage-data/images/ingest-ea-proxy-es.png b/manage-data/images/ingest-ea-proxy-es.png
new file mode 100644
index 0000000000..c41f0b4e83
Binary files /dev/null and b/manage-data/images/ingest-ea-proxy-es.png differ
diff --git a/manage-data/images/ingest-ea-proxy-fs-es.png b/manage-data/images/ingest-ea-proxy-fs-es.png
new file mode 100644
index 0000000000..f42259af63
Binary files /dev/null and b/manage-data/images/ingest-ea-proxy-fs-es.png differ
diff --git a/manage-data/images/ingest-ls-es.png b/manage-data/images/ingest-ls-es.png
new file mode 100644
index 0000000000..adb5650416
Binary files /dev/null and b/manage-data/images/ingest-ls-es.png differ
diff --git a/manage-data/images/ingest-ls-kafka-essink.png b/manage-data/images/ingest-ls-kafka-essink.png
new file mode 100644
index 0000000000..827dadac7b
Binary files /dev/null and b/manage-data/images/ingest-ls-kafka-essink.png differ
diff --git a/manage-data/images/ingest-ls-kafka-ls.png b/manage-data/images/ingest-ls-kafka-ls.png
new file mode 100644
index 0000000000..aca5a91acf
Binary files /dev/null and b/manage-data/images/ingest-ls-kafka-ls.png differ
diff --git a/manage-data/images/kibana-management-create-rollup-bar-chart.png b/manage-data/images/kibana-management-create-rollup-bar-chart.png
new file mode 100644
index 0000000000..cf7b83c532
Binary files /dev/null and b/manage-data/images/kibana-management-create-rollup-bar-chart.png differ
diff --git a/manage-data/images/kibana-management_create_rollup_job.png b/manage-data/images/kibana-management_create_rollup_job.png
new file mode 100644
index 0000000000..f1dd1580c3
Binary files /dev/null and b/manage-data/images/kibana-management_create_rollup_job.png differ
diff --git a/manage-data/images/kibana-management_rollup_job_dashboard.png b/manage-data/images/kibana-management_rollup_job_dashboard.png
new file mode 100644
index 0000000000..9573ab7a86
Binary files /dev/null and b/manage-data/images/kibana-management_rollup_job_dashboard.png differ
diff --git a/manage-data/images/kibana-management_rollup_job_details.png b/manage-data/images/kibana-management_rollup_job_details.png
new file mode 100644
index 0000000000..5372ba4ad7
Binary files /dev/null and b/manage-data/images/kibana-management_rollup_job_details.png differ
diff --git a/manage-data/images/kibana-management_rollup_list.png b/manage-data/images/kibana-management_rollup_list.png
new file mode 100644
index 0000000000..505930bcb9
Binary files /dev/null and b/manage-data/images/kibana-management_rollup_list.png differ
diff --git a/manage-data/images/sample-data-sets.png b/manage-data/images/sample-data-sets.png
new file mode 100644
index 0000000000..48dfb0c5d3
Binary files /dev/null and b/manage-data/images/sample-data-sets.png differ
diff --git a/manage-data/images/sample-upload-a-file.png b/manage-data/images/sample-upload-a-file.png
new file mode 100644
index 0000000000..5c95b36073
Binary files /dev/null and b/manage-data/images/sample-upload-a-file.png differ
diff --git a/manage-data/images/serverless-es-badge.svg b/manage-data/images/serverless-es-badge.svg
new file mode 100644
index 0000000000..8176b81d2b
--- /dev/null
+++ b/manage-data/images/serverless-es-badge.svg
@@ -0,0 +1,14 @@
+
diff --git a/manage-data/images/serverless-file-uploader-UI.png b/manage-data/images/serverless-file-uploader-UI.png
new file mode 100644
index 0000000000..ae6f7b059e
Binary files /dev/null and b/manage-data/images/serverless-file-uploader-UI.png differ
diff --git a/manage-data/images/serverless-index-management-index-templates.png b/manage-data/images/serverless-index-management-index-templates.png
new file mode 100644
index 0000000000..d09e90e5e7
Binary files /dev/null and b/manage-data/images/serverless-index-management-index-templates.png differ
diff --git a/manage-data/images/serverless-index-management-indices.png b/manage-data/images/serverless-index-management-indices.png
new file mode 100644
index 0000000000..1079f71bca
Binary files /dev/null and b/manage-data/images/serverless-index-management-indices.png differ
diff --git a/manage-data/images/serverless-ingest-pipelines-management.png b/manage-data/images/serverless-ingest-pipelines-management.png
new file mode 100644
index 0000000000..d5f18cef7a
Binary files /dev/null and b/manage-data/images/serverless-ingest-pipelines-management.png differ
diff --git a/manage-data/images/serverless-ingest-pipelines-test.png b/manage-data/images/serverless-ingest-pipelines-test.png
new file mode 100644
index 0000000000..65ee2815eb
Binary files /dev/null and b/manage-data/images/serverless-ingest-pipelines-test.png differ
diff --git a/manage-data/images/serverless-logstash-pipelines-management.png b/manage-data/images/serverless-logstash-pipelines-management.png
new file mode 100644
index 0000000000..27e7922593
Binary files /dev/null and b/manage-data/images/serverless-logstash-pipelines-management.png differ
diff --git a/manage-data/images/serverless-management-component-templates.png b/manage-data/images/serverless-management-component-templates.png
new file mode 100644
index 0000000000..470229df51
Binary files /dev/null and b/manage-data/images/serverless-management-component-templates.png differ
diff --git a/manage-data/images/serverless-management-data-stream.png b/manage-data/images/serverless-management-data-stream.png
new file mode 100644
index 0000000000..cbe28d573e
Binary files /dev/null and b/manage-data/images/serverless-management-data-stream.png differ
diff --git a/manage-data/images/serverless-management-enrich-policies.png b/manage-data/images/serverless-management-enrich-policies.png
new file mode 100644
index 0000000000..e44fad7318
Binary files /dev/null and b/manage-data/images/serverless-management-enrich-policies.png differ
diff --git a/manage-data/images/serverless-obs-badge.svg b/manage-data/images/serverless-obs-badge.svg
new file mode 100644
index 0000000000..0996e309a2
--- /dev/null
+++ b/manage-data/images/serverless-obs-badge.svg
@@ -0,0 +1,14 @@
+
diff --git a/manage-data/images/serverless-sec-badge.svg b/manage-data/images/serverless-sec-badge.svg
new file mode 100644
index 0000000000..1e743a20cf
--- /dev/null
+++ b/manage-data/images/serverless-sec-badge.svg
@@ -0,0 +1,7 @@
+
diff --git a/manage-data/ingest/ingest-reference-architectures.md b/manage-data/ingest/ingest-reference-architectures.md
index 2596ba2e29..2147be6b1a 100644
--- a/manage-data/ingest/ingest-reference-architectures.md
+++ b/manage-data/ingest/ingest-reference-architectures.md
@@ -20,10 +20,10 @@ You can host {{es}} on your own hardware or send your data to {{es}} on {{ecloud
| **Ingest architecture** | **Use when** |
| --- | --- |
-| [*{{agent}} to Elasticsearch*](./ingest-reference-architectures/agent-to-es.md)
 | An [{{agent}} integration](https://docs.elastic.co/en/integrations) is available for your data source:
* Software components with [{{agent}} installed](./ingest-reference-architectures/agent-installed.md) * Software components using [APIs for data collection](./ingest-reference-architectures/agent-apis.md) |
-| [*{{agent}} to {{ls}} to Elasticsearch*](./ingest-reference-architectures/agent-ls.md)
 | You need additional capabilities offered by {{ls}}:
* [**enrichment**](./ingest-reference-architectures/ls-enrich.md) between {{agent}} and {{es}} * [**persistent queue (PQ) buffering**](./ingest-reference-architectures/lspq.md) to accommodate network issues and downstream unavailability * [**proxying**](./ingest-reference-architectures/ls-networkbridge.md) in cases where {{agent}}s have network restrictions for connecting outside of the {{agent}} network * data needs to be [**routed to multiple**](./ingest-reference-architectures/ls-multi.md) {{es}} clusters and other destinations depending on the content |
-| [*{{agent}} to proxy to Elasticsearch*](./ingest-reference-architectures/agent-proxy.md)
 | Agents have [network restrictions](./ingest-reference-architectures/agent-proxy.md) that prevent connecting outside of the {{agent}} network Note that [{{ls}} as proxy](./ingest-reference-architectures/ls-networkbridge.md) is one option. |
-| [*{{agent}} to {{es}} with Kafka as middleware message queue*](./ingest-reference-architectures/agent-kafka-es.md)
 | Kafka is your [middleware message queue](./ingest-reference-architectures/agent-kafka-es.md):
* [Kafka ES sink connector](./ingest-reference-architectures/agent-kafka-essink.md) to write from Kafka to {{es}} * [{{ls}} to read from Kafka and route to {{es}}](./ingest-reference-architectures/agent-kafka-ls.md) |
-| [*{{ls}} to Elasticsearch*](./ingest-reference-architectures/ls-for-input.md)
 | You need to collect data from a source that {{agent}} can’t read (such as databases, AWS Kinesis). Check out the [{{ls}} input plugins](logstash://reference/input-plugins.md). |
-| [*Elastic air-gapped architectures*](./ingest-reference-architectures/airgapped-env.md)
 | You want to deploy {{agent}} and {{stack}} in an air-gapped environment (no access to outside networks) |
+| [*{{agent}} to Elasticsearch*](./ingest-reference-architectures/agent-to-es.md)
 | An [{{agent}} integration](https://docs.elastic.co/en/integrations) is available for your data source:
* Software components with [{{agent}} installed](./ingest-reference-architectures/agent-installed.md) * Software components using [APIs for data collection](./ingest-reference-architectures/agent-apis.md) |
+| [*{{agent}} to {{ls}} to Elasticsearch*](./ingest-reference-architectures/agent-ls.md)
 | You need additional capabilities offered by {{ls}}:
* [**enrichment**](./ingest-reference-architectures/ls-enrich.md) between {{agent}} and {{es}} * [**persistent queue (PQ) buffering**](./ingest-reference-architectures/lspq.md) to accommodate network issues and downstream unavailability * [**proxying**](./ingest-reference-architectures/ls-networkbridge.md) in cases where {{agent}}s have network restrictions for connecting outside of the {{agent}} network * data needs to be [**routed to multiple**](./ingest-reference-architectures/ls-multi.md) {{es}} clusters and other destinations depending on the content |
+| [*{{agent}} to proxy to Elasticsearch*](./ingest-reference-architectures/agent-proxy.md)
 | Agents have [network restrictions](./ingest-reference-architectures/agent-proxy.md) that prevent connecting outside of the {{agent}} network Note that [{{ls}} as proxy](./ingest-reference-architectures/ls-networkbridge.md) is one option. |
+| [*{{agent}} to {{es}} with Kafka as middleware message queue*](./ingest-reference-architectures/agent-kafka-es.md)
 | Kafka is your [middleware message queue](./ingest-reference-architectures/agent-kafka-es.md):
* [Kafka ES sink connector](./ingest-reference-architectures/agent-kafka-essink.md) to write from Kafka to {{es}} * [{{ls}} to read from Kafka and route to {{es}}](./ingest-reference-architectures/agent-kafka-ls.md) |
+| [*{{ls}} to Elasticsearch*](./ingest-reference-architectures/ls-for-input.md)
 | You need to collect data from a source that {{agent}} can’t read (such as databases, AWS Kinesis). Check out the [{{ls}} input plugins](logstash://reference/input-plugins.md). |
+| [*Elastic air-gapped architectures*](./ingest-reference-architectures/airgapped-env.md)
 | You want to deploy {{agent}} and {{stack}} in an air-gapped environment (no access to outside networks) |
diff --git a/manage-data/ingest/ingest-reference-architectures/agent-apis.md b/manage-data/ingest/ingest-reference-architectures/agent-apis.md
index 38b57f019f..6253ba0e07 100644
--- a/manage-data/ingest/ingest-reference-architectures/agent-apis.md
+++ b/manage-data/ingest/ingest-reference-architectures/agent-apis.md
@@ -5,7 +5,7 @@ mapped_pages:
# Elastic Agent to Elasticsearch: APIs for collection [agent-apis]
-:::{image} ../../../images/ingest-ea-apis.png
+:::{image} /manage-data/images/ingest-ea-apis.png
:alt: Image showing {{agent}} collecting data using APIs and sending to {{es}}
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/agent-es-airgapped.md b/manage-data/ingest/ingest-reference-architectures/agent-es-airgapped.md
index d4108d5a6c..8a0291684d 100644
--- a/manage-data/ingest/ingest-reference-architectures/agent-es-airgapped.md
+++ b/manage-data/ingest/ingest-reference-architectures/agent-es-airgapped.md
@@ -5,7 +5,7 @@ mapped_pages:
# Elastic Agent to Elasticsearch: Air-gapped environment [agent-es-airgapped]
-:::{image} ../../../images/ingest-ea-es-airgapped.png
+:::{image} /manage-data/images/ingest-ea-es-airgapped.png
:alt: Image showing {{agent}} and {{es}} in an air-gapped environment
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/agent-installed.md b/manage-data/ingest/ingest-reference-architectures/agent-installed.md
index 35605a4da5..a57eb1ada3 100644
--- a/manage-data/ingest/ingest-reference-architectures/agent-installed.md
+++ b/manage-data/ingest/ingest-reference-architectures/agent-installed.md
@@ -5,7 +5,7 @@ mapped_pages:
# Elastic Agent to Elasticsearch: Agent installed [agent-installed]
-:::{image} ../../../images/ingest-ea-agent-installed.png
+:::{image} /manage-data/images/ingest-ea-agent-installed.png
:alt: Image showing {{agent}} collecting data and sending to {{es}}
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/agent-kafka-es.md b/manage-data/ingest/ingest-reference-architectures/agent-kafka-es.md
index a7bdebb7df..77a5757518 100644
--- a/manage-data/ingest/ingest-reference-architectures/agent-kafka-es.md
+++ b/manage-data/ingest/ingest-reference-architectures/agent-kafka-es.md
@@ -5,7 +5,7 @@ mapped_pages:
# Elastic Agent to Elasticsearch with Kafka as middleware message queue [agent-kafka-es]
-:::{image} ../../../images/ingest-ea-kafka.png
+:::{image} /manage-data/images/ingest-ea-kafka.png
:alt: Image showing {{agent}} collecting data and using Kafka as a message queue enroute to {{es}}
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/agent-kafka-essink.md b/manage-data/ingest/ingest-reference-architectures/agent-kafka-essink.md
index 45142ac28b..7730aca771 100644
--- a/manage-data/ingest/ingest-reference-architectures/agent-kafka-essink.md
+++ b/manage-data/ingest/ingest-reference-architectures/agent-kafka-essink.md
@@ -5,7 +5,7 @@ mapped_pages:
# Elastic Agent to Logstash to Kafka to Kafka ES Sink to Elasticsearch: Kafka as middleware message queue [agent-kafka-essink]
-:::{image} ../../../images/ingest-ls-kafka-essink.png
+:::{image} /manage-data/images/ingest-ls-kafka-essink.png
:alt: Image showing {{agent}} collecting data and using Kafka as a message queue enroute to {{es}}
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/agent-kafka-ls.md b/manage-data/ingest/ingest-reference-architectures/agent-kafka-ls.md
index 60d230ea4a..240224e840 100644
--- a/manage-data/ingest/ingest-reference-architectures/agent-kafka-ls.md
+++ b/manage-data/ingest/ingest-reference-architectures/agent-kafka-ls.md
@@ -5,7 +5,7 @@ mapped_pages:
# Elastic Agent to Logstash to Kafka to Logstash to Elasticsearch: Kafka as middleware message queue [agent-kafka-ls]
-:::{image} ../../../images/ingest-ls-kafka-ls.png
+:::{image} /manage-data/images/ingest-ls-kafka-ls.png
:alt: Image showing connections between {{agent}} and {{es}} using a Kafka messaging queue
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/agent-ls-airgapped.md b/manage-data/ingest/ingest-reference-architectures/agent-ls-airgapped.md
index 0a41237060..d64df0bd4a 100644
--- a/manage-data/ingest/ingest-reference-architectures/agent-ls-airgapped.md
+++ b/manage-data/ingest/ingest-reference-architectures/agent-ls-airgapped.md
@@ -5,7 +5,7 @@ mapped_pages:
# Elastic Agent to Logstash: Air-gapped environment [agent-ls-airgapped]
-:::{image} ../../../images/ingest-ea-ls-airgapped.png
+:::{image} /manage-data/images/ingest-ea-ls-airgapped.png
:alt: Image showing {{agent}}
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/agent-ls.md b/manage-data/ingest/ingest-reference-architectures/agent-ls.md
index 70b208e3e4..9a2b99d34a 100644
--- a/manage-data/ingest/ingest-reference-architectures/agent-ls.md
+++ b/manage-data/ingest/ingest-reference-architectures/agent-ls.md
@@ -5,7 +5,7 @@ mapped_pages:
# Elastic Agent to Logstash to Elasticsearch [agent-ls]
-:::{image} ../../../images/ingest-ea-ls-es.png
+:::{image} /manage-data/images/ingest-ea-ls-es.png
:alt: Image showing {{agent}} to {{ls}} to {{es}}
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/agent-proxy.md b/manage-data/ingest/ingest-reference-architectures/agent-proxy.md
index 436c68982d..0a7cb57491 100644
--- a/manage-data/ingest/ingest-reference-architectures/agent-proxy.md
+++ b/manage-data/ingest/ingest-reference-architectures/agent-proxy.md
@@ -5,11 +5,11 @@ mapped_pages:
# Elastic Agent to proxy to Elasticsearch [agent-proxy]
-:::{image} ../../../images/ingest-ea-proxy-fs-es.png
+:::{image} /manage-data/images/ingest-ea-proxy-fs-es.png
:alt: Image showing connections between {{agent}} and {{es}} using a proxy when Fleet Server is managed by Elastic
:::
-:::{image} ../../../images/ingest-ea-fs-proxy-es.png
+:::{image} /manage-data/images/ingest-ea-fs-proxy-es.png
:alt: Image showing connections between {{agent}} and {{es}} using a proxy
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/agent-to-es.md b/manage-data/ingest/ingest-reference-architectures/agent-to-es.md
index cdd2378436..13dd9cfda3 100644
--- a/manage-data/ingest/ingest-reference-architectures/agent-to-es.md
+++ b/manage-data/ingest/ingest-reference-architectures/agent-to-es.md
@@ -9,7 +9,7 @@ To ingest data into {{es}}, use the *simplest option that meets your needs* and
Integrations offer advantages beyond easier data collection—advantages such as dashboards, central agent management, and easy enablement of [Elastic solutions](https://www.elastic.co/products/), such as Security and Observability.
-:::{image} ../../../images/ingest-ea-es.png
+:::{image} /manage-data/images/ingest-ea-es.png
:alt: Image showing {{agent}} collecting data and sending to {{es}}
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/ls-enrich.md b/manage-data/ingest/ingest-reference-architectures/ls-enrich.md
index f66d41141d..d5548641a3 100644
--- a/manage-data/ingest/ingest-reference-architectures/ls-enrich.md
+++ b/manage-data/ingest/ingest-reference-architectures/ls-enrich.md
@@ -5,7 +5,7 @@ mapped_pages:
# Elastic Agent to Logstash (for enrichment) to Elasticsearch [ls-enrich]
-:::{image} ../../../images/ingest-ea-ls-enrich.png
+:::{image} /manage-data/images/ingest-ea-ls-enrich.png
:alt: Image showing {{agent}} collecting data
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/ls-for-input.md b/manage-data/ingest/ingest-reference-architectures/ls-for-input.md
index ed5c660221..ebbf7f995e 100644
--- a/manage-data/ingest/ingest-reference-architectures/ls-for-input.md
+++ b/manage-data/ingest/ingest-reference-architectures/ls-for-input.md
@@ -5,7 +5,7 @@ mapped_pages:
# Logstash to Elasticsearch [ls-for-input]
-:::{image} ../../../images/ingest-ls-es.png
+:::{image} /manage-data/images/ingest-ls-es.png
:alt: Image showing {{ls}} collecting data and sending to {{es}}
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/ls-multi.md b/manage-data/ingest/ingest-reference-architectures/ls-multi.md
index 7015094e76..3052d541b3 100644
--- a/manage-data/ingest/ingest-reference-architectures/ls-multi.md
+++ b/manage-data/ingest/ingest-reference-architectures/ls-multi.md
@@ -5,7 +5,7 @@ mapped_pages:
# Elastic Agent to Logstash for routing to multiple Elasticsearch clusters and additional destinations [ls-multi]
-:::{image} ../../../images/ingest-ea-ls-multi.png
+:::{image} /manage-data/images/ingest-ea-ls-multi.png
:alt: Image showing {{agent}} collecting and routing data to multiple destinations
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/ls-networkbridge.md b/manage-data/ingest/ingest-reference-architectures/ls-networkbridge.md
index 36a9034618..1f20ef243b 100644
--- a/manage-data/ingest/ingest-reference-architectures/ls-networkbridge.md
+++ b/manage-data/ingest/ingest-reference-architectures/ls-networkbridge.md
@@ -5,7 +5,7 @@ mapped_pages:
# Elastic Agent to Logstash to Elasticsearch: Logstash as a proxy [ls-networkbridge]
-:::{image} ../../../images/ingest-ea-ls-bridge.png
+:::{image} /manage-data/images/ingest-ea-ls-bridge.png
:alt: Image showing {{agent}}s collecting data and sending to {{ls}} for proxying before sending on to {{es}}
:::
diff --git a/manage-data/ingest/ingest-reference-architectures/lspq.md b/manage-data/ingest/ingest-reference-architectures/lspq.md
index 7042c84c03..0c4a8dc624 100644
--- a/manage-data/ingest/ingest-reference-architectures/lspq.md
+++ b/manage-data/ingest/ingest-reference-architectures/lspq.md
@@ -5,7 +5,7 @@ mapped_pages:
# Elastic Agent to Logstash to Elasticsearch: Logstash Persistent Queue (PQ) for buffering [lspq]
-:::{image} ../../../images/ingest-ea-lspq-es.png
+:::{image} /manage-data/images/ingest-ea-lspq-es.png
:alt: Image showing {{agent}} collecting data
:::
diff --git a/manage-data/ingest/ingesting-data-from-applications/ingest-data-from-beats-to-elasticsearch-service-with-logstash-as-proxy.md b/manage-data/ingest/ingesting-data-from-applications/ingest-data-from-beats-to-elasticsearch-service-with-logstash-as-proxy.md
index d697608117..00ec830be9 100644
--- a/manage-data/ingest/ingesting-data-from-applications/ingest-data-from-beats-to-elasticsearch-service-with-logstash-as-proxy.md
+++ b/manage-data/ingest/ingesting-data-from-applications/ingest-data-from-beats-to-elasticsearch-service-with-logstash-as-proxy.md
@@ -12,7 +12,7 @@ This guide explains how to ingest data from Filebeat and Metricbeat to {{ls}} as
* You can send multiple instances of Beats data through your local network’s demilitarized zone (DMZ) to {{ls}}. {{ls}} then acts as a proxy through your firewall to send the Beats data to your deployment, as shown in the following diagram:
- 
+ 
* This proxying reduces the firewall exceptions or rules necessary for Beats to communicate with your {{ech}} or {{ece}} deployment. It’s common to have many Beats dispersed across a network, each installed close to the data that it monitors, and each Beat individually communicating with a deployment. Multiple Beats support multiple servers. Rather than configure each Beat to send its data directly to your {{ech}} or {{ece}} deployment, you can use {{ls}} to proxy this traffic through one firewall exception or rule.
* This setup is not suitable in simple scenarios when there is only one or a couple of Beats in use. {{ls}} makes the most sense for proxying when there are many Beats.
@@ -499,7 +499,7 @@ In this section, you log into {{ech}} or {{ece}}, open Kibana, and view the Kiba
3. In the search box, search for *metricbeat system*. The search results show several dashboards available for you to explore.
4. In the search results, choose *[Metricbeat System] Overview ECS*. A Metricbeat dashboard opens:
-
+
**View the Filebeat dashboard**
@@ -507,7 +507,7 @@ In this section, you log into {{ech}} or {{ece}}, open Kibana, and view the Kiba
2. In the search box, search for *filebeat system*.
3. In the search results, choose *[Filebeat System] Syslog dashboard ECS*. A Filebeat dashboard displaying your Filebeat data:
-
+
Now, you should have a good understanding of how to configure {{ls}} to ingest data from multiple Beats. You have the basics needed to begin experimenting with your own combination of Beats and modules.
diff --git a/manage-data/ingest/ingesting-data-from-applications/ingest-data-from-relational-database-into-elasticsearch-service.md b/manage-data/ingest/ingesting-data-from-applications/ingest-data-from-relational-database-into-elasticsearch-service.md
index b461ac67af..598b069306 100644
--- a/manage-data/ingest/ingesting-data-from-applications/ingest-data-from-relational-database-into-elasticsearch-service.md
+++ b/manage-data/ingest/ingesting-data-from-applications/ingest-data-from-relational-database-into-elasticsearch-service.md
@@ -402,7 +402,7 @@ In this section, we configure Logstash to send the MySQL data to Elasticsearch.
4. The Results pane lists the `client_name` records originating from your MySQL database, similar to the following example:
- 
+ 
Now, you should have a good understanding of how to configure Logstash to ingest data from your relational database through the JDBC Plugin. You have some design considerations to track records that are new, modified, and deleted. You should have the basics needed to begin experimenting with your own database and Elasticsearch.
diff --git a/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md b/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md
index 8e931941be..93561d624a 100644
--- a/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md
+++ b/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md
@@ -486,7 +486,7 @@ Now it’s time to create visualizations based off of the application log data.
7. Drag and drop the **http.request.method** field onto the visualization builder.
8. A stacked bar chart now shows the relative frequency of each of the three request methods used in our example, measured over time.
- 
+ 
9. Select **Save and return** to add this visualization to your dashboard.
@@ -499,7 +499,7 @@ Let’s create a second visualization.
5. In the chart settings area, under **Break down by**, select **Top values of http.request.headers.from** and set **Number of values** to *12*. In this example there are twelve different email addresses used in the HTTP *from* header, so this parameter sets all of them to appear in the chart legend.
6. Select **Refresh**. A stacked bar chart now shows the relative frequency of each of the HTTP *from* headers over time.
- 
+ 
7. Select **Save and return** to add this visualization to your dashboard.
@@ -509,7 +509,7 @@ And now for the final visualization.
2. In the **CHART TYPE** dropdown box, select **Donut**.
3. From the list of available fields, drag and drop the **http.request.method** field onto the visualization builder. A donut chart appears.
- 
+ 
4. Select **Save and return** to add this visualization to your dashboard.
5. Select **Save** and add a title to save your new dashboard.
@@ -522,7 +522,7 @@ You can add titles to the visualizations, resize and position them as you like,
1. Select **Refresh** on the Kibana dashboard. Since the application `webrequests.js` continues to run and send HTTP requests to the Node.js server, `webserver.js` continues to generate log data, and your Kibana visualizations update with that data with each page refresh.
- 
+ 
2. As your final step, remember to stop Filebeat, the Node.js web server, and the client. Enter *CTRL + C* in the terminal window for each application to stop them.
diff --git a/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-python-application-using-filebeat.md b/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-python-application-using-filebeat.md
index 91043cf5cc..98aa3589cf 100644
--- a/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-python-application-using-filebeat.md
+++ b/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-python-application-using-filebeat.md
@@ -381,7 +381,7 @@ Now it’s time to create visualizations based off of the Python application log
8. In the chart settings area, under **Break down by**, select **Top values of log.level** and set **Number of values** to *4*. Since there are four log severity levels, this parameter sets all of them to appear in the chart legend.
9. Select **Refresh**. A stacked bar chart now shows the relative frequency of each of the four log severity levels over time.
- 
+ 
10. Select **Save and return** to add this visualization to your dashboard.
@@ -394,7 +394,7 @@ Let’s create a second visualization.
5. In the chart settings area, under **Break down by**, select **Top values of http.request.body.content** and set **Number of values** to *12*. Since there are twelve different log messages, this parameter sets all of them to appear in the chart legend.
6. Select **Refresh**. A stacked bar chart now shows the relative frequency of each of the log messages over time.
- 
+ 
7. Select **Save and return** to add this visualization to your dashboard.
@@ -404,7 +404,7 @@ And now for the final visualization.
2. In the **Visualization type dropdown** dropdown, select **Donut**.
3. From the list of available fields, drag and drop the **log.level** field onto the visualization builder. A donut chart appears.
- 
+ 
4. Select **Save and return** to add this visualization to your dashboard.
5. Select **Save** and add a title to save your new dashboard.
@@ -417,7 +417,7 @@ You can add titles to the visualizations, resize and position them as you like,
1. Select **Refresh** on the Kibana dashboard. Since *elvis.py* continues to run and generate log data, your Kibana visualizations update with each refresh.
- 
+ 
2. As your final step, remember to stop Filebeat and the Python script. Enter *CTRL + C* in both your Filebeat terminal and in your `elvis.py` terminal.
diff --git a/manage-data/ingest/sample-data.md b/manage-data/ingest/sample-data.md
index 690f4f5364..e221c4e084 100644
--- a/manage-data/ingest/sample-data.md
+++ b/manage-data/ingest/sample-data.md
@@ -19,7 +19,7 @@ If you have no data, you will be prompted to install these packages when running
You can also access and install them from the **Integrations** page. Go to **Integrations** and search for **Sample Data**. On the **Sample Data** page, expand the **Other sample data sets** section and add the type of data you want.
-:::{image} /images/sample-data-sets.png
+:::{image} /manage-data/images/sample-data-sets.png
:alt: Sample data sets
:screenshot:
:::
@@ -44,7 +44,7 @@ You can also upload your own sample data using the **Upload a file** option on t
Go to **Integrations** and search for **Upload a file**. On the **Upload file** page, select or drag and drop a file to add your data.
-:::{image} /images/sample-upload-a-file.png
+:::{image} /manage-data/images/sample-upload-a-file.png
:alt: Upload a sample data file
:screenshot:
:::
\ No newline at end of file
diff --git a/manage-data/ingest/transform-enrich/data-enrichment.md b/manage-data/ingest/transform-enrich/data-enrichment.md
index adcc892e62..d4ed37521c 100644
--- a/manage-data/ingest/transform-enrich/data-enrichment.md
+++ b/manage-data/ingest/transform-enrich/data-enrichment.md
@@ -23,13 +23,13 @@ For example, you can use the enrich processor to:
Most processors are self-contained and only change *existing* data in incoming documents.
-:::{image} ../../../images/elasticsearch-reference-ingest-process.svg
+:::{image} /manage-data/images/elasticsearch-reference-ingest-process.svg
:alt: ingest process
:::
The enrich processor adds *new* data to incoming documents and requires a few special components:
-:::{image} ../../../images/elasticsearch-reference-enrich-process.svg
+:::{image} /manage-data/images/elasticsearch-reference-enrich-process.svg
:alt: enrich process
:::
@@ -77,7 +77,7 @@ Use the **Enrich Policies** view to add data from your existing indices to incom
* The enrich fields containing enrich data from the source indices that you want to add to incoming documents
* An optional [query](elasticsearch://reference/query-languages/query-dsl-match-all-query.md).
-:::{image} ../../../images/elasticsearch-reference-management-enrich-policies.png
+:::{image} /manage-data/images/elasticsearch-reference-management-enrich-policies.png
:alt: Enrich policies
:screenshot:
:::
diff --git a/manage-data/ingest/transform-enrich/example-parse-logs.md b/manage-data/ingest/transform-enrich/example-parse-logs.md
index d53d0e87b2..797d1d9ed0 100644
--- a/manage-data/ingest/transform-enrich/example-parse-logs.md
+++ b/manage-data/ingest/transform-enrich/example-parse-logs.md
@@ -24,7 +24,7 @@ These logs contain a timestamp, IP address, and user agent. You want to give the
1. In {{kib}}, open the main menu and click **Stack Management** > **Ingest Pipelines**.
- :::{image} ../../../images/elasticsearch-reference-ingest-pipeline-list.png
+ :::{image} /manage-data/images/elasticsearch-reference-ingest-pipeline-list.png
:alt: Kibana's Ingest Pipelines list view
:screenshot:
:::
@@ -53,7 +53,7 @@ These logs contain a timestamp, IP address, and user agent. You want to give the
Your form should look similar to this:
- :::{image} ../../../images/elasticsearch-reference-ingest-pipeline-processor.png
+ :::{image} /manage-data/images/elasticsearch-reference-ingest-pipeline-processor.png
:alt: Processors for Ingest Pipelines
:screenshot:
:::
diff --git a/manage-data/ingest/transform-enrich/ingest-pipelines-serverless.md b/manage-data/ingest/transform-enrich/ingest-pipelines-serverless.md
index 53243c008c..b983e9a012 100644
--- a/manage-data/ingest/transform-enrich/ingest-pipelines-serverless.md
+++ b/manage-data/ingest/transform-enrich/ingest-pipelines-serverless.md
@@ -8,13 +8,13 @@ applies_to:
# Elasticsearch ingest pipelines (Serverless) [ingest-pipelines]
-This content applies to: [](../../../solutions/search.md) [](../../../solutions/observability.md) [](../../../solutions/security/elastic-security-serverless.md)
+This content applies to: [](../../../solutions/search.md) [](../../../solutions/observability.md) [](../../../solutions/security/elastic-security-serverless.md)
{{es}} ingest pipelines let you perform common transformations on your data before indexing. For example, you can use pipelines to remove fields, extract values from text, and enrich your data.
A pipeline consists of a series of configurable tasks called processors. Each processor runs sequentially, making specific changes to incoming documents. After the processors have run, {{es}} adds the transformed documents to your data stream or index.
-:::{image} ../../../images/elasticsearch-reference-ingest-process.svg
+:::{image} /manage-data/images/elasticsearch-reference-ingest-process.svg
:alt: Ingest pipeline diagram
:::
@@ -26,7 +26,7 @@ In **{{project-settings}} → {{manage-app}} → {{ingest-pipelines-app}}**, you
* Edit or clone existing pipelines
* Delete pipelines
-:::{image} ../../../images/serverless-ingest-pipelines-management.png
+:::{image} /manage-data/images/serverless-ingest-pipelines-management.png
:alt: {{ingest-pipelines-app}}
:screenshot:
:::
@@ -40,7 +40,7 @@ The **New pipeline from CSV** option lets you use a file with comma-separated va
Before you use a pipeline in production, you should test it using sample documents. When creating or editing a pipeline in **{{ingest-pipelines-app}}**, click **Add documents***. In the ***Documents** tab, provide sample documents and click **Run the pipeline**:
-:::{image} ../../../images/serverless-ingest-pipelines-test.png
+:::{image} /manage-data/images/serverless-ingest-pipelines-test.png
:alt: Test a pipeline in {{ingest-pipelines-app}}
:screenshot:
:::
diff --git a/manage-data/ingest/transform-enrich/ingest-pipelines.md b/manage-data/ingest/transform-enrich/ingest-pipelines.md
index a019c7db8b..9d0663efc2 100644
--- a/manage-data/ingest/transform-enrich/ingest-pipelines.md
+++ b/manage-data/ingest/transform-enrich/ingest-pipelines.md
@@ -12,7 +12,7 @@ applies_to:
A pipeline consists of a series of configurable tasks called [processors](elasticsearch://reference/ingestion-tools/enrich-processor/index.md). Each processor runs sequentially, making specific changes to incoming documents. After the processors have run, {{es}} adds the transformed documents to your data stream or index.
-:::{image} ../../../images/elasticsearch-reference-ingest-process.svg
+:::{image} /manage-data/images/elasticsearch-reference-ingest-process.svg
:alt: Ingest pipeline diagram
:::
@@ -37,7 +37,7 @@ In {{kib}}, open the main menu and click **Stack Management > Ingest Pipelines**
* Edit or clone existing pipelines
* Delete pipelines
-:::{image} ../../../images/elasticsearch-reference-ingest-pipeline-list.png
+:::{image} /manage-data/images/elasticsearch-reference-ingest-pipeline-list.png
:alt: Kibana's Ingest Pipelines list view
:screenshot:
:::
@@ -99,7 +99,7 @@ To unset the `version` number using the API, replace or update the pipeline with
Before using a pipeline in production, we recommend you test it using sample documents. When creating or editing a pipeline in {{kib}}, click **Add documents**. In the **Documents** tab, provide sample documents and click **Run the pipeline**.
-:::{image} ../../../images/elasticsearch-reference-test-a-pipeline.png
+:::{image} /manage-data/images/elasticsearch-reference-test-a-pipeline.png
:alt: Test a pipeline in Kibana
:screenshot:
:::
@@ -303,7 +303,7 @@ $$$pipeline-custom-logs-index-template$$$
For example, if your dataset’s name was `my_app`, {{fleet}} adds new data to the `logs-my_app-default` data stream.
- :::{image} ../../../images/elasticsearch-reference-custom-logs.png
+ :::{image} /manage-data/images/elasticsearch-reference-custom-logs.png
:alt: Set up custom log integration in Fleet
:screenshot:
:::
@@ -337,7 +337,7 @@ $$$pipeline-custom-logs-configuration$$$
4. In **Custom Configurations**, specify your pipeline in the `pipeline` policy setting.
- :::{image} ../../../images/elasticsearch-reference-custom-logs-pipeline.png
+ :::{image} /manage-data/images/elasticsearch-reference-custom-logs-pipeline.png
:alt: Custom pipeline configuration for custom log integration
:screenshot:
:::
diff --git a/manage-data/ingest/transform-enrich/logstash-pipelines.md b/manage-data/ingest/transform-enrich/logstash-pipelines.md
index 003c219e0e..0a979ff426 100644
--- a/manage-data/ingest/transform-enrich/logstash-pipelines.md
+++ b/manage-data/ingest/transform-enrich/logstash-pipelines.md
@@ -8,11 +8,11 @@ applies_to:
# Logstash pipelines [logstash-pipelines]
-This content applies to: [](../../../solutions/search.md) [](../../../solutions/observability.md) [](../../../solutions/security/elastic-security-serverless.md)
+This content applies to: [](../../../solutions/search.md) [](../../../solutions/observability.md) [](../../../solutions/security/elastic-security-serverless.md)
In **{{project-settings}} → {{manage-app}} → {{ls-pipelines-app}}**, you can control multiple {{ls}} instances and pipeline configurations.
-:::{image} ../../../images/serverless-logstash-pipelines-management.png
+:::{image} /manage-data/images/serverless-logstash-pipelines-management.png
:alt: {{ls-pipelines-app}}"
:screenshot:
:::
diff --git a/manage-data/ingest/transform-enrich/set-up-an-enrich-processor.md b/manage-data/ingest/transform-enrich/set-up-an-enrich-processor.md
index 37b0d21da4..158f821ce1 100644
--- a/manage-data/ingest/transform-enrich/set-up-an-enrich-processor.md
+++ b/manage-data/ingest/transform-enrich/set-up-an-enrich-processor.md
@@ -61,7 +61,7 @@ Once created, you can’t update or change an enrich policy. See [Update an enri
Once the enrich policy is created, you need to execute it using the [execute enrich policy API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-enrich-execute-policy) or [Index Management in {{kib}}](../../lifecycle/index-lifecycle-management/index-management-in-kibana.md#manage-enrich-policies) to create an [enrich index](data-enrichment.md#enrich-index).
-:::{image} ../../../images/elasticsearch-reference-enrich-policy-index.svg
+:::{image} /manage-data/images/elasticsearch-reference-enrich-policy-index.svg
:alt: enrich policy index
:::
@@ -78,7 +78,7 @@ Enrich indices should only be used by the [enrich processor](elasticsearch://ref
Once you have source indices, an enrich policy, and the related enrich index in place, you can set up an ingest pipeline that includes an enrich processor for your policy.
-:::{image} ../../../images/elasticsearch-reference-enrich-processor.svg
+:::{image} /manage-data/images/elasticsearch-reference-enrich-processor.svg
:alt: enrich processor
:::
@@ -101,7 +101,7 @@ You also can add other [processors](elasticsearch://reference/ingestion-tools/en
You can now use your ingest pipeline to enrich and index documents.
-:::{image} ../../../images/elasticsearch-reference-enrich-process.svg
+:::{image} /manage-data/images/elasticsearch-reference-enrich-process.svg
:alt: enrich process
:::
diff --git a/manage-data/ingest/upload-data-files.md b/manage-data/ingest/upload-data-files.md
index 324b200f1a..0da66c3071 100644
--- a/manage-data/ingest/upload-data-files.md
+++ b/manage-data/ingest/upload-data-files.md
@@ -22,7 +22,7 @@ You can upload files, view their fields and metrics, and optionally import them
To use the Data Visualizer, click **Upload a file** on the {{es}} **Getting Started** page or navigate to the **Integrations** view and search for **Upload a file**. Clicking **Upload a file** opens the Data Visualizer UI.
-:::{image} /images/serverless-file-uploader-UI.png
+:::{image} /manage-data/images/serverless-file-uploader-UI.png
:alt: File upload UI
:screenshot:
:::
diff --git a/manage-data/lifecycle/data-tiers.md b/manage-data/lifecycle/data-tiers.md
index 8ba1965602..5793151f67 100644
--- a/manage-data/lifecycle/data-tiers.md
+++ b/manage-data/lifecycle/data-tiers.md
@@ -96,7 +96,7 @@ To add a warm, cold, or frozen tier when you create a deployment:
2. Click **+ Add capacity** for any data tiers to add.
3. Click **Create deployment** at the bottom of the page to save your changes.
-:::{image} ../../images/elasticsearch-reference-ess-advanced-config-data-tiers.png
+:::{image} /manage-data/images/elasticsearch-reference-ess-advanced-config-data-tiers.png
:alt: {{ecloud}}'s deployment Advanced configuration page
:screenshot:
:::
@@ -160,7 +160,7 @@ To make sure that all data can be migrated from the data tier you want to disabl
3. Filter the list of instances by the Data tier you want to disable.
- :::{image} ../../images/cloud-ec-ce-remove-tier-filter-instances.png
+ :::{image} /manage-data/images/cloud-ec-ce-remove-tier-filter-instances.png
:alt: A screenshot showing a filtered instance list
:::
@@ -176,7 +176,7 @@ To make sure that all data can be migrated from the data tier you want to disabl
3. Filter the list of instances by the Data tier you want to disable.
- :::{image} ../../images/cloud-enterprise-ec-ce-remove-tier-filter-instances.png
+ :::{image} /manage-data/images/cloud-enterprise-ec-ce-remove-tier-filter-instances.png
:alt: A screenshot showing a filtered instance list
:::
@@ -199,7 +199,7 @@ To make sure that all data can be migrated from the data tier you want to disabl
Parse the output, looking for shards allocated to the nodes to be removed from the cluster. Note that `Instance #2` is shown as `instance-0000000002` in the output.
- :::{image} ../../images/cloud-enterprise-ec-ce-remove-tier-filtered-cat-shards.png
+ :::{image} /manage-data/images/cloud-enterprise-ec-ce-remove-tier-filtered-cat-shards.png
:alt: A screenshot showing a filtered shard list
:::
@@ -347,7 +347,7 @@ When data reaches the `cold` or `frozen` phases, it is automatically converted t
In the example we have a list of 4 indices, which need to be moved away from the frozen tier.
- :::{image} ../../images/cloud-enterprise-ec-ce-remove-tier-filter-snapshot-indices.png
+ :::{image} /manage-data/images/cloud-enterprise-ec-ce-remove-tier-filter-snapshot-indices.png
:alt: A screenshot showing a snapshot indices list
:::
@@ -375,7 +375,7 @@ When data reaches the `cold` or `frozen` phases, it is automatically converted t
In the example we are removing the alias for the `frozen-index-1` index.
- :::{image} ../../images/cloud-enterprise-ec-ce-remove-tier-remove-alias.png
+ :::{image} /manage-data/images/cloud-enterprise-ec-ce-remove-tier-remove-alias.png
:alt: A screenshot showing the process of removing a searchable snapshot indice alias
:::
@@ -403,7 +403,7 @@ When data reaches the `cold` or `frozen` phases, it is automatically converted t
In the example we are restoring `frozen-index-1` from the snapshot in `found-snapshots` (default snapshot repository) and placing it in the warm tier.
- :::{image} ../../images/cloud-enterprise-ec-ce-remove-tier-restore-snapshot.png
+ :::{image} /manage-data/images/cloud-enterprise-ec-ce-remove-tier-restore-snapshot.png
:alt: A screenshot showing the process of restoring a searchable snapshot to a regular index
:::
@@ -426,7 +426,7 @@ When data reaches the `cold` or `frozen` phases, it is automatically converted t
In the example we are deleting the snapshots associated with the `policy_with_frozen_phase`.
- :::{image} ../../images/cloud-enterprise-ec-ce-remove-tier-remove-snapshots.png
+ :::{image} /manage-data/images/cloud-enterprise-ec-ce-remove-tier-remove-snapshots.png
:alt: A screenshot showing the process of deleting snapshots
:::
diff --git a/manage-data/lifecycle/index-lifecycle-management.md b/manage-data/lifecycle/index-lifecycle-management.md
index 5d4395c8f7..f4546274be 100644
--- a/manage-data/lifecycle/index-lifecycle-management.md
+++ b/manage-data/lifecycle/index-lifecycle-management.md
@@ -72,7 +72,7 @@ You can create and manage index lifecycle policies through [{{kib}} Management](
Default {{ilm}} policies are created automatically when you use {{agent}}, {{beats}}, or the {{ls}} {{es}} output plugin to send data to the {{stack}}.
-
+
::::{tip}
To automatically back up your indices and manage snapshots, use [snapshot lifecycle policies](/deploy-manage/tools/snapshot-and-restore/create-snapshots.md#automate-snapshots-slm).
diff --git a/manage-data/lifecycle/index-lifecycle-management/configure-lifecycle-policy.md b/manage-data/lifecycle/index-lifecycle-management/configure-lifecycle-policy.md
index 2e822e0692..1f16fe885f 100644
--- a/manage-data/lifecycle/index-lifecycle-management/configure-lifecycle-policy.md
+++ b/manage-data/lifecycle/index-lifecycle-management/configure-lifecycle-policy.md
@@ -26,7 +26,7 @@ When you enable {{ilm}} for {{beats}} or the {{ls}} {{es}} output plugin, the ne
To create a lifecycle policy from {{kib}}, open the menu and go to **Stack Management > Index Lifecycle Policies**. Click **Create policy**.
-
+
You specify the lifecycle phases for the policy and the actions to perform in each phase.
@@ -80,7 +80,7 @@ An `index.lifecycle.rollover_alias` setting is only required if using {{ilm}} wi
You can use the {{kib}} Create template wizard to create a template. To access the wizard, open the menu and go to **Stack Management > Index Management**. In the **Index Templates** tab, click **Create template**.
-
+
The wizard invokes the [create or update index template API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-put-index-template) to add templates to a cluster.
diff --git a/manage-data/lifecycle/index-lifecycle-management/index-management-in-kibana.md b/manage-data/lifecycle/index-lifecycle-management/index-management-in-kibana.md
index 1ca8927b1d..e0bd073a30 100644
--- a/manage-data/lifecycle/index-lifecycle-management/index-management-in-kibana.md
+++ b/manage-data/lifecycle/index-lifecycle-management/index-management-in-kibana.md
@@ -28,7 +28,7 @@ To add these privileges, go to **Stack Management > Security > Roles** or use th
Investigate your indices and perform operations from the **Indices** view.
-:::{image} ../../../images/elasticsearch-reference-management_index_labels.png
+:::{image} /manage-data/images/elasticsearch-reference-management_index_labels.png
:alt: Index Management UI
:screenshot:
:::
@@ -37,7 +37,7 @@ Investigate your indices and perform operations from the **Indices** view.
* To filter the list of indices, use the search bar or click a badge. Badges indicate if an index is a [follower index](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ccr-follow), a [rollup index](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-rollup-get-rollup-index-caps), or [frozen](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-unfreeze).
* To drill down into the index [mappings](../../data-store/mapping.md), [settings](elasticsearch://reference/elasticsearch/index-settings/index.md), and statistics, click an index name. From this view, you can navigate to **Discover** to further explore the documents in the index.
- :::{image} ../../../images/elasticsearch-reference-management_index_details.png
+ :::{image} /manage-data/images/elasticsearch-reference-management_index_details.png
:alt: Index Management UI
:screenshot:
:::
@@ -52,7 +52,7 @@ The value in the **Indices** column indicates the number of backing indices. Cli
A value in the data retention column indicates that the data stream is managed by a [data stream lifecycle policy](../data-stream.md). This value is the time period for which your data is guaranteed to be stored. Data older than this period can be deleted by Elasticsearch at a later time.
-:::{image} ../../../images/elasticsearch-reference-management-data-stream-fields.png
+:::{image} /manage-data/images/elasticsearch-reference-management-data-stream-fields.png
:alt: Data stream details
:screenshot:
:::
@@ -65,7 +65,7 @@ A value in the data retention column indicates that the data stream is managed b
Create, edit, clone, and delete your index templates in the **Index Templates** view. Changes made to an index template do not affect existing indices.
-:::{image} ../../../images/elasticsearch-reference-management-index-templates.png
+:::{image} /manage-data/images/elasticsearch-reference-management-index-templates.png
:alt: Index templates
:screenshot:
:::
@@ -79,7 +79,7 @@ In this tutorial, you’ll create an index template and use it to configure two
1. In the **Index Templates** view, open the **Create template** wizard.
- :::{image} ../../../images/elasticsearch-reference-management_index_create_wizard.png
+ :::{image} /manage-data/images/elasticsearch-reference-management_index_create_wizard.png
:alt: Create wizard
:screenshot:
:::
@@ -96,7 +96,7 @@ In this tutorial, you’ll create an index template and use it to configure two
Component templates are optional. For this tutorial, do not add any component templates.
- :::{image} ../../../images/elasticsearch-reference-management_index_component_template.png
+ :::{image} /manage-data/images/elasticsearch-reference-management_index_component_template.png
:alt: Component templates page
:screenshot:
:::
@@ -104,7 +104,7 @@ In this tutorial, you’ll create an index template and use it to configure two
2. Define index settings. These are optional. For this tutorial, leave this section blank.
3. Define a mapping that contains an [object](elasticsearch://reference/elasticsearch/mapping-reference/object.md) field named `geo` with a child [`geo_point`](elasticsearch://reference/elasticsearch/mapping-reference/geo-point.md) field named `coordinates`:
- :::{image} ../../../images/elasticsearch-reference-management-index-templates-mappings.png
+ :::{image} /manage-data/images/elasticsearch-reference-management-index-templates-mappings.png
:alt: Mapped fields page
:screenshot:
:::
@@ -194,7 +194,7 @@ Use the **Enrich Policies** view to add data from your existing indices to incom
* The enrich fields containing enrich data from the source indices that you want to add to incoming documents
* An optional [query](elasticsearch://reference/query-languages/query-dsl-match-all-query.md).
-:::{image} ../../../images/elasticsearch-reference-management-enrich-policies.png
+:::{image} /manage-data/images/elasticsearch-reference-management-enrich-policies.png
:alt: Enrich policies
:screenshot:
:::
diff --git a/manage-data/lifecycle/index-lifecycle-management/tutorial-automate-rollover.md b/manage-data/lifecycle/index-lifecycle-management/tutorial-automate-rollover.md
index 15d76ac59b..66084801c6 100644
--- a/manage-data/lifecycle/index-lifecycle-management/tutorial-automate-rollover.md
+++ b/manage-data/lifecycle/index-lifecycle-management/tutorial-automate-rollover.md
@@ -45,7 +45,7 @@ The `min_age` value is relative to the rollover time, not the index creation tim
You can create the policy through {{kib}} or with the [create or update policy](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ilm-put-lifecycle) API. To create the policy from {{kib}}, open the menu and go to **Stack Management > Index Lifecycle Policies**. Click **Create policy**.
-:::{image} ../../../images/elasticsearch-reference-create-policy.png
+:::{image} /manage-data/images/elasticsearch-reference-create-policy.png
:alt: Create policy page
:screenshot:
:::
@@ -97,7 +97,7 @@ To enable the {{ilm-init}} to manage the data stream, the template configures on
You can use the {{kib}} Create template wizard to add the template. From Kibana, open the menu and go to **Stack Management > Index Management**. In the **Index Templates** tab, click **Create template**.
-:::{image} ../../../images/elasticsearch-reference-create-index-template.png
+:::{image} /manage-data/images/elasticsearch-reference-create-index-template.png
:alt: Create template page
:::
@@ -236,7 +236,7 @@ To enable automatic rollover, the template configures two {{ilm-init}} settings:
You can use the {{kib}} Create template wizard to add the template. To access the wizard, open the menu and go to **Stack Management > Index Management**. In the **Index Templates** tab, click **Create template**.
-
+
The create template request for the example template looks like this:
diff --git a/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md b/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md
index 7b2f1b4a2f..fd6bf3c6a2 100644
--- a/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md
+++ b/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md
@@ -40,7 +40,7 @@ To complete this tutorial, you’ll need:
* {{ech}}: Elastic Stack deployments on {{ecloud}} include a hot tier by default. To add a warm tier, edit your deployment and click **Add capacity** for the warm data tier.
- :::{image} ../../../images/elasticsearch-reference-tutorial-ilm-ess-add-warm-data-tier.png
+ :::{image} /manage-data/images/elasticsearch-reference-tutorial-ilm-ess-add-warm-data-tier.png
:alt: Add a warm data tier to your deployment
:screenshot:
:::
@@ -78,7 +78,7 @@ The `logs@lifecycle` policy uses the recommended rollover defaults: Start writin
To view or change the rollover settings, click **Advanced settings** for the hot phase. Then disable **Use recommended defaults** to display the rollover settings.
-:::{image} ../../../images/elasticsearch-reference-tutorial-ilm-hotphaserollover-default.png
+:::{image} /manage-data/images/elasticsearch-reference-tutorial-ilm-hotphaserollover-default.png
:alt: View rollover defaults
:screenshot:
:::
@@ -94,21 +94,21 @@ The default `logs@lifecycle` policy is designed to prevent the creation of many
2. Enable **Set replicas** and change **Number of replicas** to **1**.
3. Enable **Force merge data** and set **Number of segments** to **1**.
- :::{image} ../../../images/elasticsearch-reference-tutorial-ilm-modify-default-warm-phase-rollover.png
+ :::{image} /manage-data/images/elasticsearch-reference-tutorial-ilm-modify-default-warm-phase-rollover.png
:alt: Add a warm phase with custom settings
:screenshot:
:::
2. In the warm phase, click the trash icon to enable the delete phase.
- :::{image} ../../../images/elasticsearch-reference-tutorial-ilm-enable-delete-phase.png
+ :::{image} /manage-data/images/elasticsearch-reference-tutorial-ilm-enable-delete-phase.png
:alt: Enable the delete phase
:screenshot:
:::
In the delete phase, set **Move data into phase when** to **90 days old**. This deletes indices 90 days after rollover.
- :::{image} ../../../images/elasticsearch-reference-tutorial-ilm-delete-rollover.png
+ :::{image} /manage-data/images/elasticsearch-reference-tutorial-ilm-delete-rollover.png
:alt: Add a delete phase
:screenshot:
:::
diff --git a/manage-data/lifecycle/rollup/getting-started-kibana.md b/manage-data/lifecycle/rollup/getting-started-kibana.md
index 32d23f0742..e2c15bf1b6 100644
--- a/manage-data/lifecycle/rollup/getting-started-kibana.md
+++ b/manage-data/lifecycle/rollup/getting-started-kibana.md
@@ -19,7 +19,7 @@ A rollup job is a periodic task that aggregates data from indices specified by a
You can go to the **Rollup Jobs** page using the navigation menu or the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
-:::{image} ../../../images/kibana-management_rollup_list.png
+:::{image} /manage-data/images/kibana-management_rollup_list.png
:alt: List of currently active rollup jobs
:screenshot:
:::
@@ -36,7 +36,7 @@ To add the privilege, go to the **Roles** management page using the navigation m
When defining the index pattern, you must enter a name that is different than the output rollup index. Otherwise, the job will attempt to capture the data in the rollup index. For example, if your index pattern is `metricbeat-*`, you can name your rollup index `rollup-metricbeat`, but not `metricbeat-rollup`.
-:::{image} ../../../images/kibana-management_create_rollup_job.png
+:::{image} /manage-data/images/kibana-management_create_rollup_job.png
:alt: Wizard that walks you through creation of a rollup job
:screenshot:
:::
@@ -45,7 +45,7 @@ When defining the index pattern, you must enter a name that is different than th
Once you’ve saved a rollup job, you’ll see it the **Rollup Jobs** overview page, where you can drill down for further investigation. The **Manage** menu enables you to start, stop, and delete the rollup job. You must first stop a rollup job before deleting it.
-:::{image} ../../../images/kibana-management_rollup_job_details.png
+:::{image} /manage-data/images/kibana-management_rollup_job_details.png
:alt: Rollup job details
:screenshot:
:::
@@ -104,7 +104,7 @@ Your next step is to visualize your rolled up data in a vertical bar chart. Most
6. On the dashboard, click **Create visualization**.
7. Choose `rollup_logstash,kibana_sample_data_logs` as your source to see both the raw and rolled up data.
- :::{image} ../../../images/kibana-management-create-rollup-bar-chart.png
+ :::{image} /manage-data/images/kibana-management-create-rollup-bar-chart.png
:alt: Create visualization of rolled up data
:screenshot:
:::
@@ -115,7 +115,7 @@ Your next step is to visualize your rolled up data in a vertical bar chart. Most
{{kib}} creates a vertical bar chart of your data. Select a section of the chart to zoom in.
- :::{image} ../../../images/kibana-management_rollup_job_dashboard.png
+ :::{image} /manage-data/images/kibana-management_rollup_job_dashboard.png
:alt: Dashboard with rolled up data
:screenshot:
:::