docset.yml

project: 'Elastic documentation'
max_toc_depth: 2

features:
  primary-nav: true

# API Explorer (staging only). This block is consumed by docs-builder when the
# assembler-api-explorer feature flag is enabled (staging today). Production and
# other environments ignore these declarations until the rollout completes.
api:
  # CloudFront remote specs - mirror https://d29hkgsdo66d1n.cloudfront.net/index.json.
  # No local spec files: each key fetches remotely on serve/build. Paths: /api/<key>/
  elasticsearch:
    - spec: elasticsearch.json
      product: elasticsearch
      repository: elastic/elasticsearch-specification
      catalog:
        categories:
          - self
          - ece
          - ess
  elasticsearch-serverless:
    - spec: elasticsearch-serverless.json
      product: serverless-elasticsearch
      repository: elastic/elasticsearch-specification
      catalog:
        categories:
          - serverless
  kibana:
    - spec: kibana.yaml
      product: kibana
      repository: elastic/kibana
      children:
        - file: kibana-api-overview.md
      catalog:
        categories:
          - self
          - ece
          - ess
  kibana-serverless:
    - spec: kibana-serverless.yaml
      product: kibana
      repository: elastic/kibana
      catalog:
        categories:
          - serverless
  cloud:
    - spec: cloud.json
      product: cloud-hosted
      repository: elastic/cloud
  cloud-enterprise:
    - spec: cloud-enterprise.json
      product: cloud-enterprise
      repository: elastic/cloud
  cloud-billing:
    - spec: cloud-billing.yaml
      product: ess
      repository: elastic/cloud
      catalog:
        categories:
          - ess
  cloud-connect:
    - spec: cloud-connect.yml
      product: ess
      repository: elastic/cloud-connected-api
  cloud-serverless:
    - spec: elastic-cloud-serverless.yml
      product: cloud-serverless
      repository: elastic/serverless-api-specification
      catalog:
        categories:
          - serverless
  logstash:
    - spec: logstash.yaml
      product: logstash
      repository: elastic/logstash
      catalog:
        categories:
          - self

cta:
  monitor-kubernetes:
    button:
      label: Get started free
      url: https://cloud.elastic.co/serverless-registration?onboarding_token=monitor-kubernetes
    benefits:
      - "14-day free trial"
      - "All features included"
      - "No setup required"
  monitor-aws:
    button:
      label: Get started free
      url: https://cloud.elastic.co/serverless-registration?onboarding_token=monitor-aws
    benefits:
      - "14-day free trial"
      - "All features included"
      - "No setup required"
  azure-mp:
    button:
      label: Get started on Azure
      url: https://portal.azure.com?sourceCampaignName=elasticweb-docs&sourceCampaignId=elasticweb-docs#view/Azure_Marketplace_Elastic/CreateBlade/offerId/elastic.ec-azure-pp
    benefits:
      - "Simplified billing and MACC burndown"
      - "Manage resources from the Azure portal"
      - "Built-in logs and metrics forwarding"
  observability:
    button:
      label: Get started free
      url: https://cloud.elastic.co/serverless-registration?onboarding_token=observability
    benefits:
      - "14-day free trial"
      - "All features included"
      - "No setup required"
  security:
    button:
      label: Get started free
      url: https://cloud.elastic.co/serverless-registration?onboarding_token=security
    benefits:
      - "14-day free trial"
      - "All features included"
      - "No setup required"
  search:
    button:
      label: Get started free
      url: https://cloud.elastic.co/serverless-registration?onboarding_token=search
    benefits:
      - "14-day free trial"
      - "All features included"
      - "No setup required"
  vector:
    button:
      label: Get started free
      url: https://cloud.elastic.co/serverless-registration?onboarding_token=vector
    benefits:
      - "14-day free trial"
      - "All features included"
      - "No setup required"

exclude:
  - 'README.md'
  - 'AGENTS.md'
  - 'AI.md'
  - '.agents/**'
  - 'CLAUDE.md'
  - 'GEMINI.md'
  - 'changelog/**'
  - 'releases/**'

cross_links:
  - apm-agent-android
  - apm-agent-ios
  - apm-agent-dotnet
  - apm-agent-go
  - apm-agent-java
  - apm-agent-nodejs
  - apm-agent-php
  - apm-agent-python
  - apm-agent-ruby
  - apm-agent-rum-js
  - apm-aws-lambda
  - apm-k8s-attacher
  - apm-server
  - autoops-insights
  - beats
  - cli
  - cloud
  - cloud-on-k8s
  - curator
  - detection-rules
  - docs-content
  - ecctl
  - ecs
  - ecs-dotnet
  - ecs-logging
  - ecs-logging-go-zap
  - ecs-logging-go-zerolog
  - ecs-logging-go-logrus
  - ecs-logging-java
  - ecs-logging-nodejs
  - ecs-logging-php
  - ecs-logging-python
  - ecs-logging-ruby
  - eland
  - elastic-agent
  - elastic-serverless-forwarder
  - elastic-otel-dotnet
  - elastic-otel-java
  - elastic-otel-node
  - elastic-otel-php
  - elastic-otel-python
  - elastic-otel-rum-js
  - elasticsearch
  - elasticsearch-hadoop
  - elasticsearch-java
  - elasticsearch-js
  - elasticsearch-net
  - elasticsearch-php
  - elasticsearch-py
  - elasticsearch-rs
  - elasticsearch-ruby
  - fleet-server
  - go-elasticsearch
  - integration-docs
  - integrations
  - kibana
  - logstash
  - logstash-docs-md
  - opentelemetry
  - search-ui

toc:
  - file: index.md
  - toc: get-started
  - toc: products
  - toc: deploy-manage
  - toc: solutions
  - toc: manage-data
  - toc: explore-analyze
  - toc: cloud-account
  - toc: troubleshoot
  - toc: release-notes
  - toc: reference
  - toc: contribute-docs
  - toc: extend
  - file: archive.md
  - file: versions.md
  - hidden: 404.md

subs:
  subscriptions:   "https://www.elastic.co/subscriptions"
  ecloud:   "Elastic Cloud"
  ech:   "Elastic Cloud Hosted"
  ece:   "Elastic Cloud Enterprise"
  eck:   "Elastic Cloud on Kubernetes"
  edot:  "Elastic OpenTelemetry"
  motlp: "Elastic Cloud Managed OTLP Endpoint"
  serverless-full:   "Elastic Cloud Serverless"
  serverless-short:   "Serverless"
  es-serverless:   "Elasticsearch Serverless"
  obs-serverless:   "Elastic Observability Serverless"
  sec-serverless:   "Elastic Security Serverless"
  vectordb:   "Vector Database"
  apm-app:   "APM app"
  uptime-app:   "Uptime app"
  synthetics-app:   "Synthetics app"
  logs-app:   "Logs app"
  infrastructure-app:   "Infrastructure app"
  security-app:   "Elastic Security app"
  ml-app:   "Machine Learning"
  dev-tools-app:   "Dev Tools"
  stack-manage-app:   "Stack Management"
  stack-monitor-app:   "Stack Monitoring"
  rules-ui:   "Rules"
  siem-rules-ui: "Detection rules (SIEM)"
  connectors-ui:   "Connectors"
  connectors-feature:   "Actions and Connectors"
  stack-rules-feature:   "Stack Rules"
  user-experience:   "User Experience"
  ems:   "Elastic Maps Service"
  ems-init:   "EMS"
  hosted-ems:   "Elastic Maps Server"
  ipm-app:   "Index Pattern Management"
  ls-pipelines-app:   "Logstash Pipelines"
  maint-windows-app:   "Maintenance Windows"
  maint-windows-cap:   "Maintenance windows"
  alerting-v2-system:   "Kibana Universal Alerting"
  alerting-v2-system-cap:   "Kibana Universal Alerting"
  alerting-v1-system:   "Kibana Classic Alerting"
  alerting-v1-system-cap:   "Kibana Classic Alerting"
  custom-roles-app:   "Custom Roles"
  data-source:   "data view"
  data-sources:   "data views"
  data-sources-caps:   "Data Views"
  data-source-cap:   "Data view"
  data-sources-cap:   "Data views"
  project-settings:   "Project settings"
  manage-app:   "Management"
  index-manage-app:   "Index Management"
  saved-objects-app:   "Saved Objects"
  reports-app:   "Reports"
  app-search-crawler:   "App Search web crawler"
  agent:   "Elastic Agent"
  agents:   "Elastic Agents"
  fleet:   "Fleet"
  fleet-server:   "Fleet Server"
  integrations-server:   "Integrations Server"
  integrations:   "Integrations"
  managed-integration:   "Elastic Managed integration"
  managed-integrations:   "Elastic Managed integrations"
  package-registry:   "Elastic Package Registry"
  artifact-registry:   "Elastic Artifact Registry"
  aws:   "AWS"
  gcp:   "GCP"
  stack:   "Elastic Stack"
  es:   "Elasticsearch"
  kib:   "Kibana"
  ls:   "Logstash"
  beats:   "Beats"
  auditbeat:   "Auditbeat"
  filebeat:   "Filebeat"
  heartbeat:   "Heartbeat"
  metricbeat:   "Metricbeat"
  packetbeat:   "Packetbeat"
  winlogbeat:   "Winlogbeat"
  esql:   "ES|QL"
  k8s:   "Kubernetes"
  security-features:   "security features"
  operator-feature:   "operator privileges feature"
  es-security-features:   "Elasticsearch security features"
  stack-security-features:   "Elastic Stack security features"
  endpoint-sec:   "Endpoint Security"
  elastic-defend:   "Elastic Defend"
  elastic-sec:   "Elastic Security"
  elastic-endpoint:   "Elastic Endpoint"
  swimlane:   "Swimlane"
  sn:   "ServiceNow"
  sn-itsm:   "ServiceNow ITSM"
  sn-itom:   "ServiceNow ITOM"
  sn-sir:   "ServiceNow SecOps"
  jira:   "Jira"
  ibm-r:   "IBM Resilient"
  webhook:   "Webhook"
  webhook-cm:   "Webhook - Case Management"
  opsgenie:   "Opsgenie"
  hive:   "TheHive"
  monitor-features:   "monitoring features"
  stack-monitor-features:   "Elastic Stack monitoring features"
  watcher:   "Watcher"
  alert-features:   "alerting features"
  report-features:   "reporting features"
  graph-features:   "graph analytics features"
  searchprofiler:   "Search Profiler"
  ml:   "machine learning"
  ml-cap:   "Machine learning"
  ml-features:   "machine learning features"
  stack-ml-features:   "Elastic Stack machine learning features"
  ccr:   "cross-cluster replication"
  ccr-cap:   "Cross-cluster replication"
  ccr-init:   "CCR"
  ccs:   "cross-cluster search"
  ccs-cap:   "Cross-cluster search"
  ccs-init:   "CCS"
  cps: "cross-project search"
  cps-cap: "Cross-project search"
  cps-init: "CPS"
  ilm:   "index lifecycle management"
  ilm-cap:   "Index lifecycle management"
  ilm-init:   "ILM"
  dlm-init:   "DLM"
  search-snap:   "searchable snapshot"
  search-snaps:   "searchable snapshots"
  search-snaps-cap:   "Searchable snapshots"
  slm:   "snapshot lifecycle management"
  slm-cap:   "Snapshot lifecycle management"
  slm-init:   "SLM"
  rollup-features:   "data rollup features"
  ipm-cap:   "Index pattern"
  rollup:   "rollup"
  rollup-job:   "rollup job"
  rollup-jobs:   "rollup jobs"
  dfeed:   "datafeed"
  dfeeds:   "datafeeds"
  dfeeds-cap:   "Datafeeds"
  ml-jobs:   "machine learning jobs"
  ml-jobs-cap:   "Machine learning jobs"
  anomaly-detect:   "anomaly detection"
  anomaly-detect-cap:   "Anomaly detection"
  anomaly-job:   "anomaly detection job"
  anomaly-job-cap:   "Anomaly detection job"
  anomaly-jobs:   "anomaly detection jobs"
  anomaly-jobs-cap:   "Anomaly detection jobs"
  dataframe:   "data frame"
  dataframes:   "data frames"
  watcher-transform:   "payload transform"
  watcher-transforms:   "payload transforms"
  watcher-transforms-cap:   "Payload transforms"
  dfanalytics-cap:   "Data frame analytics"
  dfanalytics:   "data frame analytics"
  dfanalytics-job:   "data frame analytics analytics job"
  dfanalytics-jobs:   "data frame analytics analytics jobs"
  dfanalytics-jobs-cap:   "Data frame analytics analytics jobs"
  ctransform:   "continuous transform"
  ctransform-cap:   "Continuous transform"
  ctransforms:   "continuous transforms"
  ctransforms-cap:   "Continuous transforms"
  oldetection:   "outlier detection"
  oldetection-cap:   "Outlier detection"
  olscore:   "outlier score"
  olscores:   "outlier scores"
  evaluatedf-api:   "evaluate data frame analytics API"
  regression:   "regression"
  regression-cap:   "Regression"
  reganalysis:   "regression analysis"
  reganalysis-cap:   "Regression analysis"
  depvar:   "dependent variable"
  feature-vars:   "feature variables"
  classification:   "classification"
  classification-cap:   "Classification"
  classanalysis:   "classification analysis"
  classanalysis-cap:   "Classification analysis"
  infer-cap:   "Inference"
  infer:   "inference"
  lang-ident-cap:   "Language identification"
  lang-ident:   "language identification"
  data-viz:   "Data Visualizer"
  feat-imp:   "feature importance"
  feat-imp-cap:   "Feature importance"
  nlp:   "natural language processing"
  nlp-cap:   "Natural language processing"
  apm-agent:   "APM agent"
  apm-java-agent:   "Elastic APM Java agent"
  project-monitors:   "project monitors"
  project-monitors-cap:   "Project monitors"
  private-location:   "Private Location"
  private-locations:   "Private Locations"
  esh:   "ES-Hadoop"
  observability:   "Observability"
  agent-pull:   "https://github.com/elastic/elastic-agent/pull/"
  es-pull:   "https://github.com/elastic/elasticsearch/pull/"
  kib-pull:   "https://github.com/elastic/kibana/pull/"
  eck_helm_minimum_version: 3.2.0
  eck_resources_list: "Elasticsearch, Kibana, APM Server, Beats, Elastic Agent, Elastic Maps Server, Logstash, AutoOps Agent Policy and Package Registry"
  eck_resources_list_short: "APM Server, Beats, Elastic Agent, Elastic Maps Server, and Logstash"
  heroku: "Elasticsearch Add-on for Heroku"
  obs-ai-assistant: "Elastic AI Assistant for Observability and Search"
  apm-server: "APM Server"
  apm-server-or-mis: "APM Server or managed inputs"
  apis: https://www.elastic.co/docs/api/
  es-apis: https://www.elastic.co/docs/api/doc/elasticsearch/
  es-serverless-apis: https://www.elastic.co/docs/api/doc/elasticsearch-serverless/
  kib-apis: https://www.elastic.co/docs/api/doc/kibana/
  kib-serverless-apis: https://www.elastic.co/docs/api/doc/serverless/
  ls-apis: https://www.elastic.co/docs/api/doc/logstash/
  cloud-apis: https://www.elastic.co/docs/api/doc/cloud/
  cloud-billing-apis: https://www.elastic.co/docs/api/doc/cloud-billing/
  cloud-serverless-apis: https://www.elastic.co/docs/api/doc/elastic-cloud-serverless/
  ece-apis: https://www.elastic.co/docs/api/doc/cloud-enterprise/
  intake-apis: https://www.elastic.co/docs/api/doc/observability-serverless/
  models-app: "Trained Models"
  agent-builder: "Elastic Agent Builder"
  context-engine: "Context Engine"
  # AlertZero
  alertzero: "AlertZero"
  az-watch: "Watch"
  az-watches: "Watches"
  az-worker: "Worker"
  az-workers: "Workers"
  # Common nouns, lowercase mid-sentence to match the UI. If they become proper nouns, change
  # proposed action, investigation, and escalation together, and update the UI to match.
  az-proposed-action: "proposed action"
  az-proposed-actions: "proposed actions"
  az-proposed-action-cap: "Proposed action"
  az-proposed-actions-cap: "Proposed actions"
  az-investigation: "investigation"
  az-investigations: "investigations"
  az-investigation-cap: "Investigation"
  az-investigations-cap: "Investigations"
  az-escalation: "escalation"
  az-escalations: "escalations"
  az-escalation-cap: "Escalation"
  az-escalations-cap: "Escalations"
  az-autonomy: "autonomy"
  az-autonomy-cap: "Autonomy"
  az-manual: "Manual"
  az-assisted: "Assisted"
  az-supervised: "Supervised"
  az-triage-watch: "Triage Watch"
  az-detection-watch: "Detection Watch"
  az-hunt-watch: "Hunt Watch"
  az-forensics-watch: "Forensics Watch"
  az-alert-triage: "Alert Triage"
  az-attack-discovery: "Attack Discovery"
  az-continuous-threat-hunt: "Continuous Threat Hunt"
  az-rule-tuning: "Rule Tuning"
  az-rule-coverage: "Rule Coverage"
  az-endpoint-analysis: "Endpoint Analysis"
  az-hunt-finding: "hunt finding"
  az-hunt-findings: "hunt findings"
  az-hunt-finding-cap: "Hunt finding"
  az-hunt-findings-cap: "Hunt findings"
  az-threat-report: "threat report"
  az-threat-reports: "threat reports"
  az-threat-report-cap: "Threat report"
  az-threat-reports-cap: "Threat reports"
  az-threat-intel-supply: "threat intel supply"
  az-threat-intel-supply-cap: "Threat intel supply"
  az-efficient-models: "Efficient models"
  az-balanced-models: "Balanced models"
  az-frontier-models: "Frontier models"
  az-cyber-domain-models: "Cyber domain models"
  kube-stack-version: 0.16.0
  helm-version: 4.3.0
  ece-docker-images-8: 8.19.23
  ece-docker-images-9: 9.5.5
  search-platform: "Search AI Platform"
  fedramp-mod: "FedRAMP Moderate"
  fedramp-high: "FedRAMP High"
  fedramp-il5: "FedRAMP IL5"
  tsds: "time series data stream"
  tsdses: "time series data streams"
  tsds-cap: "Time series data stream"
  tsds-init: "TSDS"
release_notes:
  - product: cloud-serverless