From 8786118aa12399ab1f6831d9d3e03357625d1664 Mon Sep 17 00:00:00 2001
From: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
Date: Thu, 16 Oct 2025 18:24:09 +0200
Subject: [PATCH 1/6] Restructure data analysis section: rename to Machine
Learning, move observability metrics to reference/observability, update
navigation titles for clarity
---
.../anomaly-detection/geographic-anomalies.md | 2 +-
.../ml-configuring-aggregation.md | 2 +-
.../ml-configuring-categories.md | 2 +-
.../ml-configuring-transform.md | 2 +-
.../anomaly-detection/ml-functions.md | 2 +-
.../anomaly-detection/ml-getting-started.md | 2 +-
.../anomaly-detection/ml-limitations.md | 4 +-
.../anomaly-detection/ootb-ml-jobs.md | 2 +-
redirects.yml | 32 +
reference/data-analysis/index.md | 12 -
.../data-analysis/kibana/canvas-functions.md | 1857 -----------------
.../kibana/tinymath-functions.md | 695 ------
.../data-analysis/observability/index.md | 22 -
reference/data-analysis/toc.yml | 31 -
reference/index.md | 2 +-
reference/machine-learning/index.md | 8 +
.../machine-learning-functions.md | 14 +-
.../machine-learning/ml-count-functions.md | 6 +-
.../machine-learning/ml-geo-functions.md | 0
.../machine-learning/ml-info-functions.md | 0
.../machine-learning/ml-metric-functions.md | 12 +-
.../machine-learning/ml-rare-functions.md | 4 +-
.../machine-learning/ml-sum-functions.md | 4 +-
.../machine-learning/ml-time-functions.md | 4 +-
.../machine-learning/ootb-ml-jobs-apache.md | 2 +-
.../machine-learning/ootb-ml-jobs-apm.md | 0
.../ootb-ml-jobs-auditbeat.md | 0
.../machine-learning/ootb-ml-jobs-logs-ui.md | 0
.../ootb-ml-jobs-metricbeat.md | 0
.../ootb-ml-jobs-metrics-ui.md | 0
.../machine-learning/ootb-ml-jobs-nginx.md | 2 +-
.../machine-learning/ootb-ml-jobs-siem.md | 0
.../machine-learning/ootb-ml-jobs-uptime.md | 0
...pplied-anomaly-detection-configurations.md | 22 +-
reference/machine-learning/toc.yml | 22 +
reference/observability/metrics-reference.md | 22 +
.../observability-aws-metrics.md | 0
.../observability-container-metrics.md | 0
.../observability-host-metrics.md | 0
.../observability-kubernetes-pod-metrics.md | 0
reference/observability/toc.yml | 8 +-
reference/toc.yml | 2 +-
solutions/observability/infra-and-hosts.md | 2 +-
.../infra-and-hosts/analyze-compare-hosts.md | 4 +-
.../analyze-infrastructure-host-metrics.md | 2 +-
...xplore-infrastructure-metrics-over-time.md | 2 +-
.../tutorial-observe-nginx-instances.md | 10 +-
.../understanding-no-results-found-message.md | 2 +-
...infrastructure-metrics-by-resource-type.md | 2 +-
.../anomaly-detection.md | 2 +-
.../behavioral-detection-use-cases.md | 2 +-
.../advanced-entity-analytics/overview.md | 2 +-
.../dashboards/entity-analytics-dashboard.md | 2 +-
.../understanding-no-results-found-message.md | 2 +-
54 files changed, 154 insertions(+), 2681 deletions(-)
delete mode 100644 reference/data-analysis/index.md
delete mode 100644 reference/data-analysis/kibana/canvas-functions.md
delete mode 100644 reference/data-analysis/kibana/tinymath-functions.md
delete mode 100644 reference/data-analysis/observability/index.md
delete mode 100644 reference/data-analysis/toc.yml
create mode 100644 reference/machine-learning/index.md
rename reference/{data-analysis => }/machine-learning/machine-learning-functions.md (78%)
rename reference/{data-analysis => }/machine-learning/ml-count-functions.md (96%)
rename reference/{data-analysis => }/machine-learning/ml-geo-functions.md (100%)
rename reference/{data-analysis => }/machine-learning/ml-info-functions.md (100%)
rename reference/{data-analysis => }/machine-learning/ml-metric-functions.md (93%)
rename reference/{data-analysis => }/machine-learning/ml-rare-functions.md (96%)
rename reference/{data-analysis => }/machine-learning/ml-sum-functions.md (93%)
rename reference/{data-analysis => }/machine-learning/ml-time-functions.md (95%)
rename reference/{data-analysis => }/machine-learning/ootb-ml-jobs-apache.md (97%)
rename reference/{data-analysis => }/machine-learning/ootb-ml-jobs-apm.md (100%)
rename reference/{data-analysis => }/machine-learning/ootb-ml-jobs-auditbeat.md (100%)
rename reference/{data-analysis => }/machine-learning/ootb-ml-jobs-logs-ui.md (100%)
rename reference/{data-analysis => }/machine-learning/ootb-ml-jobs-metricbeat.md (100%)
rename reference/{data-analysis => }/machine-learning/ootb-ml-jobs-metrics-ui.md (100%)
rename reference/{data-analysis => }/machine-learning/ootb-ml-jobs-nginx.md (97%)
rename reference/{data-analysis => }/machine-learning/ootb-ml-jobs-siem.md (100%)
rename reference/{data-analysis => }/machine-learning/ootb-ml-jobs-uptime.md (100%)
rename reference/{data-analysis => }/machine-learning/supplied-anomaly-detection-configurations.md (64%)
create mode 100644 reference/machine-learning/toc.yml
create mode 100644 reference/observability/metrics-reference.md
rename reference/{data-analysis => }/observability/observability-aws-metrics.md (100%)
rename reference/{data-analysis => }/observability/observability-container-metrics.md (100%)
rename reference/{data-analysis => }/observability/observability-host-metrics.md (100%)
rename reference/{data-analysis => }/observability/observability-kubernetes-pod-metrics.md (100%)
diff --git a/explore-analyze/machine-learning/anomaly-detection/geographic-anomalies.md b/explore-analyze/machine-learning/anomaly-detection/geographic-anomalies.md
index a6853ca8e4..5aa4856de2 100644
--- a/explore-analyze/machine-learning/anomaly-detection/geographic-anomalies.md
+++ b/explore-analyze/machine-learning/anomaly-detection/geographic-anomalies.md
@@ -41,7 +41,7 @@ There are a few limitations to consider before you create this type of job:
1. You cannot create forecasts for {{anomaly-jobs}} that contain geographic functions.
2. You cannot add [custom rules with conditions](/explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs.md#ml-ad-rules) to detectors that use geographic functions.
-If those limitations are acceptable, try creating an {{anomaly-job}} that uses the [`lat_long` function](/reference/data-analysis/machine-learning/ml-geo-functions.md#ml-lat-long) to analyze your own data or the sample data sets.
+If those limitations are acceptable, try creating an {{anomaly-job}} that uses the [`lat_long` function](/reference/machine-learning/ml-geo-functions.md#ml-lat-long) to analyze your own data or the sample data sets.
To create an {{anomaly-job}} that uses the `lat_long` function, navigate to the **Anomaly Detection Jobs** page in the main menu, or use the [global search field](../../find-and-organize/find-apps-and-objects.md). Then click **Create job** and select the appropriate job wizard. Alternatively, use the [create {{anomaly-jobs}} API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ml-put-job).
diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-configuring-aggregation.md b/explore-analyze/machine-learning/anomaly-detection/ml-configuring-aggregation.md
index efb24f0432..446c6b3cc5 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ml-configuring-aggregation.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ml-configuring-aggregation.md
@@ -41,7 +41,7 @@ There are a number of requirements for using aggregations in {{dfeeds}}.
## Recommendations [aggs-recommendations-dfeeds]
* When your detectors use [metric](/reference/data-analysis/machine-learning/ml-metric-functions.md) or [sum](/reference/data-analysis/machine-learning/ml-sum-functions.md) analytical functions, it’s recommended to set the `date_histogram` or `composite` aggregation interval to a tenth of the bucket span. This creates finer, more granular time buckets, which are ideal for this type of analysis.
-* When your detectors use [count](/reference/data-analysis/machine-learning/ml-count-functions.md) or [rare](/reference/data-analysis/machine-learning/ml-rare-functions.md) functions, set the interval to the same value as the bucket span.
+* When your detectors use [count](/reference/data-analysis/machine-learning/ml-count-functions.md) or [rare](/reference/machine-learning/ml-rare-functions.md) functions, set the interval to the same value as the bucket span.
* If you have multiple influencers or partition fields or if your field cardinality is more than 1000, use [composite aggregations](elasticsearch://reference/aggregations/search-aggregations-bucket-composite-aggregation.md).
To determine the cardinality of your data, you can run searches such as:
diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-configuring-categories.md b/explore-analyze/machine-learning/anomaly-detection/ml-configuring-categories.md
index 9436279c79..3cc5a3a9ec 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ml-configuring-categories.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ml-configuring-categories.md
@@ -10,7 +10,7 @@ products:
# Detecting anomalous categories of data [ml-configuring-categories]
-Categorization is a {{ml}} process that tokenizes a text field, clusters similar data together, and classifies it into categories. It works best on machine-written messages and application output that typically consist of repeated elements. [Categorization jobs](ml-anomaly-detection-job-types.md#categorization-jobs) enable you to find anomalous behavior in your categorized data. Categorization is not natural language processing (NLP). When you create a categorization {{anomaly-job}}, the {{ml}} model learns what volume and pattern is normal for each category over time. You can then detect anomalies and surface rare events or unusual types of messages by using [count](/reference/data-analysis/machine-learning/ml-count-functions.md) or [rare](/reference/data-analysis/machine-learning/ml-rare-functions.md) functions. Categorization works well on finite set of possible messages, for example:
+Categorization is a {{ml}} process that tokenizes a text field, clusters similar data together, and classifies it into categories. It works best on machine-written messages and application output that typically consist of repeated elements. [Categorization jobs](ml-anomaly-detection-job-types.md#categorization-jobs) enable you to find anomalous behavior in your categorized data. Categorization is not natural language processing (NLP). When you create a categorization {{anomaly-job}}, the {{ml}} model learns what volume and pattern is normal for each category over time. You can then detect anomalies and surface rare events or unusual types of messages by using [count](/reference/data-analysis/machine-learning/ml-count-functions.md) or [rare](/reference/machine-learning/ml-rare-functions.md) functions. Categorization works well on finite set of possible messages, for example:
```js
{"@timestamp":1549596476000,
diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-configuring-transform.md b/explore-analyze/machine-learning/anomaly-detection/ml-configuring-transform.md
index 5ef8dae9cc..9fce68cc47 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ml-configuring-transform.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ml-configuring-transform.md
@@ -382,7 +382,7 @@ PUT _ml/anomaly_detectors/test3
GET _ml/datafeeds/datafeed-test3/_preview
```
-In {{es}}, location data can be stored in `geo_point` fields but this data type is not supported natively in {{ml}} analytics. This example of a runtime field transforms the data into an appropriate format. For more information, see [Geographic functions](/reference/data-analysis/machine-learning/ml-geo-functions.md).
+In {{es}}, location data can be stored in `geo_point` fields but this data type is not supported natively in {{ml}} analytics. This example of a runtime field transforms the data into an appropriate format. For more information, see [Geographic functions](/reference/machine-learning/ml-geo-functions.md).
The preview {{dfeed}} API returns the following results, which show that `41.44` and `90.5` have been combined into "41.44,90.5":
diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-functions.md b/explore-analyze/machine-learning/anomaly-detection/ml-functions.md
index b13fd45ca6..797fa2bc6a 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ml-functions.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ml-functions.md
@@ -25,6 +25,6 @@ If your data is sparse, there may be gaps in the data which means you might have
* [Geographic functions](/reference/data-analysis/machine-learning/ml-geo-functions.md)
* [Information content functions](/reference/data-analysis/machine-learning/ml-info-functions.md)
* [Metric functions](/reference/data-analysis/machine-learning/ml-metric-functions.md)
-* [Rare functions](/reference/data-analysis/machine-learning/ml-rare-functions.md)
+* [Rare functions](/reference/machine-learning/ml-rare-functions.md)
* [Sum functions](/reference/data-analysis/machine-learning/ml-sum-functions.md)
* [Time functions](/reference/data-analysis/machine-learning/ml-time-functions.md)
diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-getting-started.md b/explore-analyze/machine-learning/anomaly-detection/ml-getting-started.md
index becd20fd51..d0d51b9a7f 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ml-getting-started.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ml-getting-started.md
@@ -315,6 +315,6 @@ If you’re now thinking about where {{anomaly-detect}} can be most impactful fo
In general, it is a good idea to start with single metric {{anomaly-jobs}} for your key performance indicators. After you examine these simple analysis results, you will have a better idea of what the influencers might be. You can create multi-metric jobs and split the data or create more complex analysis functions as necessary. For examples of more complicated configuration options, see [Examples](/explore-analyze/machine-learning/anomaly-detection/anomaly-how-tos.md).
-If you want to find more sample jobs, see [Supplied configurations](ootb-ml-jobs.md). In particular, there are sample jobs for [Apache](/reference/data-analysis/machine-learning/ootb-ml-jobs-apache.md) and [Nginx](/reference/data-analysis/machine-learning/ootb-ml-jobs-nginx.md) that are quite similar to the examples in this tutorial.
+If you want to find more sample jobs, see [Supplied configurations](ootb-ml-jobs.md). In particular, there are sample jobs for [Apache](/reference/data-analysis/machine-learning/ootb-ml-jobs-apache.md) and [Nginx](/reference/machine-learning/ootb-ml-jobs-nginx.md) that are quite similar to the examples in this tutorial.
If you encounter problems, we’re here to help. If you are an existing Elastic customer with a support contract, create a ticket in the [Elastic Support portal](http://support.elastic.co). Or post in the [Elastic forum](https://discuss.elastic.co/).
diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-limitations.md b/explore-analyze/machine-learning/anomaly-detection/ml-limitations.md
index 134450b68a..df9fe1120a 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ml-limitations.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ml-limitations.md
@@ -153,8 +153,8 @@ The charts can also look odd in circumstances where there is very little data to
| varp, high_varp, low_varp | [Varp, high_varp, low_varp](/reference/data-analysis/machine-learning/ml-metric-functions.md#ml-metric-varp) | yes (only if model plot is enabled) |
| lat_long | [Lat_long](/reference/data-analysis/machine-learning/ml-geo-functions.md#ml-lat-long) | no (but map is displayed in the Anomaly Explorer) |
| info_content, high_info_content, low_info_content | [Info_content, High_info_content, Low_info_content](/reference/data-analysis/machine-learning/ml-info-functions.md#ml-info-content) | yes (only if model plot is enabled) |
-| rare | [Rare](/reference/data-analysis/machine-learning/ml-rare-functions.md#ml-rare) | yes |
-| freq_rare | [Freq_rare](/reference/data-analysis/machine-learning/ml-rare-functions.md#ml-freq-rare) | no |
+| rare | [Rare](/reference/machine-learning/ml-rare-functions.md#ml-rare) | yes |
+| freq_rare | [Freq_rare](/reference/machine-learning/ml-rare-functions.md#ml-freq-rare) | no |
| time_of_day, time_of_week | [Time functions](/reference/data-analysis/machine-learning/ml-time-functions.md) | no |
### Jobs created in {{kib}} must use {{dfeeds}} [_jobs_created_in_kib_must_use_dfeeds]
diff --git a/explore-analyze/machine-learning/anomaly-detection/ootb-ml-jobs.md b/explore-analyze/machine-learning/anomaly-detection/ootb-ml-jobs.md
index 19d370a863..60313a4ae8 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ootb-ml-jobs.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ootb-ml-jobs.md
@@ -17,7 +17,7 @@ products:
* [APM](/reference/data-analysis/machine-learning/ootb-ml-jobs-apm.md)
* [{{auditbeat}}](/reference/data-analysis/machine-learning/ootb-ml-jobs-auditbeat.md)
* [Logs](/reference/data-analysis/machine-learning/ootb-ml-jobs-logs-ui.md)
-* [{{metricbeat}}](/reference/data-analysis/machine-learning/ootb-ml-jobs-metricbeat.md)
+* [{{metricbeat}}](/reference/machine-learning/ootb-ml-jobs-metricbeat.md)
* [Metrics](/reference/data-analysis/machine-learning/ootb-ml-jobs-metrics-ui.md)
* [Nginx](/reference/data-analysis/machine-learning/ootb-ml-jobs-nginx.md)
* [Security](/reference/data-analysis/machine-learning/ootb-ml-jobs-siem.md)
diff --git a/redirects.yml b/redirects.yml
index eb3e257f40..aa0e731052 100644
--- a/redirects.yml
+++ b/redirects.yml
@@ -519,5 +519,37 @@ redirects:
# Search sessions becoming background search
'explore-analyze/discover/search-sessions.md': 'explore-analyze/discover/background-search.md'
+# Deduplicate canvas function reference
+ 'reference/data-analysis/kibana/canvas-functions.md': 'explore-analyze/visualize/canvas/canvas-function-reference.md'
+ 'reference/data-analysis/kibana/tinymath-functions.md': 'explore-analyze/visualize/canvas/canvas-tinymath-functions.md'
+
+# Related to data-analysis restructure - moved observability metrics to reference/observability
+ 'reference/data-analysis/observability/index.md': 'reference/observability/metrics-reference.md'
+ 'reference/data-analysis/observability/observability-host-metrics.md': 'reference/observability/observability-host-metrics.md'
+ 'reference/data-analysis/observability/observability-container-metrics.md': 'reference/observability/observability-container-metrics.md'
+ 'reference/data-analysis/observability/observability-kubernetes-pod-metrics.md': 'reference/observability/observability-kubernetes-pod-metrics.md'
+ 'reference/data-analysis/observability/observability-aws-metrics.md': 'reference/observability/observability-aws-metrics.md'
+
+# Renamed data-analysis to machine-learning
+ 'reference/data-analysis/index.md': 'reference/machine-learning/index.md'
+ 'reference/data-analysis/machine-learning/supplied-anomaly-detection-configurations.md': 'reference/machine-learning/supplied-anomaly-detection-configurations.md'
+ 'reference/data-analysis/machine-learning/machine-learning-functions.md': 'reference/machine-learning/machine-learning-functions.md'
+ 'reference/data-analysis/machine-learning/ml-count-functions.md': 'reference/machine-learning/ml-count-functions.md'
+ 'reference/data-analysis/machine-learning/ml-geo-functions.md': 'reference/machine-learning/ml-geo-functions.md'
+ 'reference/data-analysis/machine-learning/ml-info-functions.md': 'reference/machine-learning/ml-info-functions.md'
+ 'reference/data-analysis/machine-learning/ml-metric-functions.md': 'reference/machine-learning/ml-metric-functions.md'
+ 'reference/data-analysis/machine-learning/ml-rare-functions.md': 'reference/machine-learning/ml-rare-functions.md'
+ 'reference/data-analysis/machine-learning/ml-sum-functions.md': 'reference/machine-learning/ml-sum-functions.md'
+ 'reference/data-analysis/machine-learning/ml-time-functions.md': 'reference/machine-learning/ml-time-functions.md'
+ 'reference/data-analysis/machine-learning/ootb-ml-jobs-apache.md': 'reference/machine-learning/ootb-ml-jobs-apache.md'
+ 'reference/data-analysis/machine-learning/ootb-ml-jobs-apm.md': 'reference/machine-learning/ootb-ml-jobs-apm.md'
+ 'reference/data-analysis/machine-learning/ootb-ml-jobs-auditbeat.md': 'reference/machine-learning/ootb-ml-jobs-auditbeat.md'
+ 'reference/data-analysis/machine-learning/ootb-ml-jobs-logs-ui.md': 'reference/machine-learning/ootb-ml-jobs-logs-ui.md'
+ 'reference/data-analysis/machine-learning/ootb-ml-jobs-metricbeat.md': 'reference/machine-learning/ootb-ml-jobs-metricbeat.md'
+ 'reference/data-analysis/machine-learning/ootb-ml-jobs-metrics-ui.md': 'reference/machine-learning/ootb-ml-jobs-metrics-ui.md'
+ 'reference/data-analysis/machine-learning/ootb-ml-jobs-nginx.md': 'reference/machine-learning/ootb-ml-jobs-nginx.md'
+ 'reference/data-analysis/machine-learning/ootb-ml-jobs-siem.md': 'reference/machine-learning/ootb-ml-jobs-siem.md'
+ 'reference/data-analysis/machine-learning/ootb-ml-jobs-uptime.md': 'reference/machine-learning/ootb-ml-jobs-uptime.md'
+
diff --git a/reference/data-analysis/index.md b/reference/data-analysis/index.md
deleted file mode 100644
index 7d6a7c394e..0000000000
--- a/reference/data-analysis/index.md
+++ /dev/null
@@ -1,12 +0,0 @@
-# Data analysis
-
-This section contains reference information for data analysis features, including:
-
-* [Supplied {{anomaly-detect}} configurations](/reference/data-analysis/machine-learning/supplied-anomaly-detection-configurations.md)
-* [Function reference for anomaly detection jobs](/reference/data-analysis/machine-learning/machine-learning-functions.md)
-* [Metrics reference for the Infrastructure app](/reference/data-analysis/observability/index.md)
-* [Canvas functions](/reference/data-analysis/kibana/canvas-functions.md)
-* [Text analysis components](elasticsearch://reference/text-analysis/index.md)
-* [Aggregations](elasticsearch://reference/aggregations/index.md)
-
-Visit the [Explore and analyze](/explore-analyze/index.md) section to learn how to use the Elasticsearch platform to explore and analyze your data effectively.
diff --git a/reference/data-analysis/kibana/canvas-functions.md b/reference/data-analysis/kibana/canvas-functions.md
deleted file mode 100644
index 16cf493734..0000000000
--- a/reference/data-analysis/kibana/canvas-functions.md
+++ /dev/null
@@ -1,1857 +0,0 @@
----
-mapped_pages:
- - https://www.elastic.co/guide/en/kibana/current/canvas-function-reference.html
-navigation_tile: Canvas function reference
-products:
- - id: kibana
----
-
-# Explore Canvas functions and its expression language for {{kib}} [canvas-function-reference]
-
-Behind the scenes, Canvas is driven by a powerful expression language, with dozens of functions and other capabilities, including table transforms, type casting, and sub-expressions.
-
-The Canvas expression language also supports [TinyMath functions](/reference/data-analysis/kibana/tinymath-functions.md), which perform complex math calculations.
-
-A * denotes a required argument.
-
-A † denotes an argument can be passed multiple times.
-
-[A](#a_fns) | B | [C](#c_fns) | [D](#d_fns) | [E](#e_fns) | [F](#f_fns) | [G](#g_fns) | [H](#h_fns) | [I](#i_fns) | [J](#j_fns) | [K](#k_fns) | [L](#l_fns) | [M](#m_fns) | [N](#n_fns) | O | [P](#p_fns) | Q | [R](#r_fns) | [S](#s_fns) | [T](#t_fns) | [U](#u_fns) | [V](#v_fns) | W | X | Y | Z
-
-
-## A [a_fns]
-
-
-### `all` [all_fn]
-
-Returns `true` if all of the conditions are met. See also [`any`](#any_fn).
-
-**Expression syntax**
-
-```js
-all {neq "foo"} {neq "bar"} {neq "fizz"}
-all condition={gt 10} condition={lt 20}
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| math "mean(percent_uptime)"
-| formatnumber "0.0%"
-| metric "Average uptime"
- metricFont={
- font size=48 family="'Open Sans', Helvetica, Arial, sans-serif"
- color={
- if {all {gte 0} {lt 0.8}} then="red" else="green"
- }
- align="center" lHeight=48
- }
-| render
-```
-
-This sets the color of the metric text to `"red"` if the context passed into `metric` is greater than or equal to 0 and less than 0.8. Otherwise, the color is set to `"green"`.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* * †
Alias: `condition` | `boolean` | The conditions to check. |
-
-**Returns:** `boolean`
-
-
-### `alterColumn` [alterColumn_fn]
-
-Converts between core types, including `string`, `number`, `null`, `boolean`, and `date`, and renames columns. See also [`mapColumn`](#mapColumn_fn), [`mathColumn`](#mathColumn_fn), and [`staticColumn`](#staticColumn_fn).
-
-**Expression syntax**
-
-```js
-alterColumn "cost" type="string"
-alterColumn column="@timestamp" name="foo"
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| alterColumn "time" name="time_in_ms" type="number"
-| table
-| render
-```
-
-This renames the `time` column to `time_in_ms` and converts the type of the column’s values from `date` to `number`.
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `column` | `string` | The name of the column to alter. |
-| `name` | `string` | The resultant column name. Leave blank to not rename. |
-| `type` | `string` | The type to convert the column to. Leave blank to not change the type. |
-
-**Returns:** `datatable`
-
-
-### `any` [any_fn]
-
-Returns `true` if at least one of the conditions is met. See also [`all`](#all_fn).
-
-**Expression syntax**
-
-```js
-any {eq "foo"} {eq "bar"} {eq "fizz"}
-any condition={lte 10} condition={gt 30}
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| filterrows {
- getCell "project" | any {eq "elasticsearch"} {eq "kibana"} {eq "x-pack"}
- }
-| pointseries color="project" size="max(price)"
-| pie
-| render
-```
-
-This filters out any rows that don’t contain `"elasticsearch"`, `"kibana"` or `"x-pack"` in the `project` field.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* * †
Alias: `condition` | `boolean` | The conditions to check. |
-
-**Returns:** `boolean`
-
-
-### `as` [as_fn]
-
-Creates a `datatable` with a single value. See also [`getCell`](#getCell_fn).
-
-**Expression syntax**
-
-```js
-as
-as "foo"
-as name="bar"
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| ply by="project" fn={math "count(username)" | as "num_users"} fn={math "mean(price)" | as "price"}
-| pointseries x="project" y="num_users" size="price" color="project"
-| plot
-| render
-```
-
-`as` casts any primitive value (`string`, `number`, `date`, `null`) into a `datatable` with a single row and a single column with the given name (or defaults to `"value"` if no name is provided). This is useful when piping a primitive value into a function that only takes `datatable` as an input.
-
-In the example, `ply` expects each `fn` subexpression to return a `datatable` in order to merge the results of each `fn` back into a `datatable`, but using a `math` aggregation in the subexpressions returns a single `math` value, which is then cast into a `datatable` using `as`.
-
-**Accepts:** `string`, `boolean`, `number`, `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `name` | `string` | The name to give the column.
Default: `"value"` |
-
-**Returns:** `datatable`
-
-
-### `asset` [asset_fn]
-
-Retrieves Canvas workpad asset objects to provide as argument values. Usually images.
-
-**Expression syntax**
-
-```js
-asset "asset-52f14f2b-fee6-4072-92e8-cd2642665d02"
-asset id="asset-498f7429-4d56-42a2-a7e4-8bf08d98d114"
-```
-
-**Code example**
-
-```text
-image dataurl={asset "asset-c661a7cc-11be-45a1-a401-d7592ea7917a"} mode="contain"
-| render
-```
-
-The image asset stored with the ID `"asset-c661a7cc-11be-45a1-a401-d7592ea7917a"` is passed into the `dataurl` argument of the `image` function to display the stored asset.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `id` | `string` | The ID of the asset to retrieve. |
-
-**Returns:** `string`
-
-
-### `axisConfig` [axisConfig_fn]
-
-Configures the axis of a visualization. Only used with [`plot`](#plot_fn).
-
-**Expression syntax**
-
-```js
-axisConfig show=false
-axisConfig position="right" min=0 max=10 tickSize=1
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| pointseries x="size(cost)" y="project" color="project"
-| plot defaultStyle={seriesStyle bars=0.75 horizontalBars=true}
- legend=false
- xaxis={axisConfig position="top" min=0 max=400 tickSize=100}
- yaxis={axisConfig position="right"}
-| render
-```
-
-This sets the `x-axis` to display on the top of the chart and sets the range of values to `0-400` with ticks displayed at `100` intervals. The `y-axis` is configured to display on the `right`.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `max` | `number`, `string`, `null` | The maximum value displayed in the axis. Must be a number, a date in milliseconds since epoch, or an ISO8601 string. |
-| `min` | `number`, `string`, `null` | The minimum value displayed in the axis. Must be a number, a date in milliseconds since epoch, or an ISO8601 string. |
-| `position` | `string` | The position of the axis labels. For example, `"top"`, `"bottom"`, `"left"`, or `"right"`.
Default: `"left"` |
-| `show` | `boolean` | Show the axis labels?
Default: `true` |
-| `tickSize` | `number`, `null` | The increment size between each tick. Use for `number` axes only. |
-
-**Returns:** `axisConfig`
-
-
-## C [c_fns]
-
-
-### `case` [case_fn]
-
-Builds a [`case`](#case_fn), including a condition and a result, to pass to the [`switch`](#switch_fn) function.
-
-**Expression syntax**
-
-```js
-case 0 then="red"
-case when=5 then="yellow"
-case if={lte 50} then="green"
-```
-
-**Code example**
-
-```text
-math "random()"
-| progress shape="gauge" label={formatnumber "0%"}
- font={
- font size=24 family="'Open Sans', Helvetica, Arial, sans-serif" align="center"
- color={
- switch {case if={lte 0.5} then="green"}
- {case if={all {gt 0.5} {lte 0.75}} then="orange"}
- default="red"
- }
- }
- valueColor={
- switch {case if={lte 0.5} then="green"}
- {case if={all {gt 0.5} {lte 0.75}} then="orange"}
- default="red"
- }
-| render
-```
-
-This sets the color of the progress indicator and the color of the label to `"green"` if the value is less than or equal to `0.5`, `"orange"` if the value is greater than `0.5` and less than or equal to `0.75`, and `"red"` if `none` of the case conditions are met.
-
-**Accepts:** `any`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `when` | `any` | The value compared to the *context* to see if they are equal. The `when` argument is ignored when the `if` argument is also specified. |
-| `if` | `boolean` | This value indicates whether the condition is met. The `if` argument overrides the `when` argument when both are provided. |
-| `then` * | `any` | The value returned if the condition is met. |
-
-**Returns:** `case`
-
-
-### `clear` [clear_fn]
-
-Clears the *context*, and returns `null`.
-
-**Accepts:** `null`
-
-**Returns:** `null`
-
-
-### `clog` [clog_fn]
-
-Outputs the *input* in the console. This function is for debug purposes
-
-**Expression syntax**
-
-```js
-clog
-```
-
-**Code example**
-
-```text
-kibana
-| demodata
-| clog
-| filterrows fn={getCell "age" | gt 70}
-| clog
-| pointseries x="time" y="mean(price)"
-| plot defaultStyle={seriesStyle lines=1 fill=1}
-| render
-```
-
-This prints the `datatable` objects in the browser console before and after the `filterrows` function.
-
-**Accepts:** `any`
-
-**Returns:** Depends on your input and arguments
-
-
-### `columns` [columns_fn]
-
-Includes or excludes columns from a `datatable`. When both arguments are specified, the excluded columns will be removed first.
-
-**Expression syntax**
-
-```js
-columns include="@timestamp, projects, cost"
-columns exclude="username, country, age"
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| columns include="price, cost, state, project"
-| table
-| render
-```
-
-This only keeps the `price`, `cost`, `state`, and `project` columns from the `demodata` data source and removes all other columns.
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `include` | `string` | A comma-separated list of column names to keep in the `datatable`. |
-| `exclude` | `string` | A comma-separated list of column names to remove from the `datatable`. |
-
-**Returns:** `datatable`
-
-
-### `compare` [compare_fn]
-
-Compares the *context* to specified value to determine `true` or `false`. Usually used in combination with `<>` or [`case`](#case_fn). This only works with primitive types, such as `number`, `string`, `boolean`, `null`. See also [`eq`](#eq_fn), [`gt`](#gt_fn), [`gte`](#gte_fn), [`lt`](#lt_fn), [`lte`](#lte_fn), [`neq`](#neq_fn)
-
-**Expression syntax**
-
-```js
-compare "neq" to="elasticsearch"
-compare op="lte" to=100
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| mapColumn project
- fn={getCell project |
- switch
- {case if={compare eq to=kibana} then=kibana}
- {case if={compare eq to=elasticsearch} then=elasticsearch}
- default="other"
- }
-| pointseries size="size(cost)" color="project"
-| pie
-| render
-```
-
-This maps all `project` values that aren’t `"kibana"` and `"elasticsearch"` to `"other"`. Alternatively, you can use the individual comparator functions instead of compare.
-
-**Accepts:** `string`, `number`, `boolean`, `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `op` | `string` | The operator to use in the comparison: `"eq"` (equal to), `"gt"` (greater than), `"gte"` (greater than or equal to), `"lt"` (less than), `"lte"` (less than or equal to), `"ne"` or `"neq"` (not equal to).
Default: `"eq"` |
-| `to`
Aliases: `b`, `this` | `any` | The value compared to the *context*. |
-
-**Returns:** `boolean`
-
-
-### `containerStyle` [containerStyle_fn]
-
-Creates an object used for styling an element’s container, including background, border, and opacity.
-
-**Expression syntax**
-
-```js
-containerStyle backgroundColor="red"’
-containerStyle borderRadius="50px"
-containerStyle border="1px solid black"
-containerStyle padding="5px"
-containerStyle opacity="0.5"
-containerStyle overflow="hidden"
-containerStyle backgroundImage={asset id=asset-f40d2292-cf9e-4f2c-8c6f-a504a25e949c}
- backgroundRepeat="no-repeat"
- backgroundSize="cover"
-```
-
-**Code example**
-
-```text
-shape "star" fill="#E61D35" maintainAspect=true
-| render containerStyle={
- containerStyle backgroundColor="#F8D546"
- borderRadius="200px"
- border="4px solid #05509F"
- padding="0px"
- opacity="0.9"
- overflow="hidden"
- }
-```
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `backgroundColor` | `string` | A valid CSS background color. |
-| `backgroundImage` | `string` | A valid CSS background image. |
-| `backgroundRepeat` | `string` | A valid CSS background repeat.
Default: `"no-repeat"` |
-| `backgroundSize` | `string` | A valid CSS background size.
Default: `"contain"` |
-| `border` | `string` | A valid CSS border. |
-| `borderRadius` | `string` | The number of pixels to use when rounding the corners. |
-| `opacity` | `number` | A number between 0 and 1 that represents the degree of transparency of the element. |
-| `overflow` | `string` | A valid CSS overflow.
Default: `"hidden"` |
-| `padding` | `string` | The distance of the content, in pixels, from the border. |
-
-**Returns:** `containerStyle`
-
-
-### `context` [context_fn]
-
-Returns whatever you pass into it. This can be useful when you need to use *context* as argument to a function as a sub-expression.
-
-**Expression syntax**
-
-```js
-context
-```
-
-**Code example**
-
-```text
-date
-| formatdate "LLLL"
-| markdown "Last updated: " {context}
-| render
-```
-
-Using the `context` function allows us to pass the output, or *context*, of the previous function as a value to an argument in the next function. Here we get the formatted date string from the previous function and pass it as `content` for the markdown element.
-
-**Accepts:** `any`
-
-**Returns:** Depends on your input and arguments
-
-
-### `createTable` [createTable_fn]
-
-Creates a datatable with a list of columns, and 1 or more empty rows. To populate the rows, use [`mapColumn`](#mapColumn_fn) or [`mathColumn`](#mathColumn_fn).
-
-**Expression syntax**
-
-```js
-createTable id="a" id="b"
-createTable id="a" name="A" id="b" name="B" rowCount=5
-```
-
-**Code example**
-
-```text
-var_set
-name="logs" value={essql "select count(*) as a from kibana_sample_data_logs"}
-name="commerce" value={essql "select count(*) as b from kibana_sample_data_ecommerce"}
-| createTable ids="totalA" ids="totalB"
-| staticColumn name="totalA" value={var "logs" | getCell "a"}
-| alterColumn column="totalA" type="number"
-| staticColumn name="totalB" value={var "commerce" | getCell "b"}
-| alterColumn column="totalB" type="number"
-| mathColumn id="percent" name="percent" expression="totalA / totalB"
-| render
-```
-
-This creates a table based on the results of two `essql` queries, joined into one table.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `ids` † | `string` | Column ids to generate in positional order. ID represents the key in the row. |
-| `names` † | `string` | Column names to generate in positional order. Names are not required to be unique, and default to the ID if not provided. |
-| `rowCount` | `number` | The number of empty rows to add to the table, to be assigned a value later
Default: `1` |
-
-**Returns:** `datatable`
-
-
-### `csv` [csv_fn]
-
-Creates a `datatable` from CSV input.
-
-**Expression syntax**
-
-```js
-csv "fruit, stock
- kiwi, 10
- Banana, 5"
-```
-
-**Code example**
-
-```text
-csv "fruit,stock
- kiwi,10
- banana,5"
-| pointseries color=fruit size=stock
-| pie
-| render
-```
-
-This creates a `datatable` with `fruit` and `stock` columns with two rows. This is useful for quickly mocking data.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `data` | `string` | The CSV data to use. |
-| `delimiter` | `string` | The data separation character. |
-| `newline` | `string` | The row separation character. |
-
-**Returns:** `datatable`
-
-
-## D [d_fns]
-
-
-### `date` [date_fn]
-
-Returns the current time, or a time parsed from a specified string, as milliseconds since epoch.
-
-**Expression syntax**
-
-```js
-date
-date value=1558735195
-date "2019-05-24T21:59:55+0000"
-date "01/31/2019" format="MM/DD/YYYY"
-```
-
-**Code example**
-
-```text
-date
-| formatdate "LLL"
-| markdown {context}
- font={font family="Arial, sans-serif" size=30 align="left"
- color="#000000"
- weight="normal"
- underline=false
- italic=false}
-| render
-```
-
-Using `date` without passing any arguments will return the current date and time.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `value` | `string` | An optional date string that is parsed into milliseconds since epoch. The date string can be either a valid JavaScript `Date` input or a string to parse using the `format` argument. Must be an ISO8601 string, or you must provide the format. |
-| `format` | `string` | The MomentJS format used to parse the specified date string. For more information, see [https://momentjs.com/docs/#/displaying/](https://momentjs.com/docs/#/displaying/). |
-
-**Returns:** `number`
-
-
-### `demodata` [demodata_fn]
-
-A sample data set that includes project CI times with usernames, countries, and run phases.
-
-**Expression syntax**
-
-```js
-demodata
-demodata "ci"
-demodata type="shirts"
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| table
-| render
-```
-
-`demodata` is a mock data set that you can use to start playing around in Canvas.
-
-**Accepts:** `filter`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `type` | `string` | The name of the demo data set to use.
Default: `"ci"` |
-
-**Returns:** `datatable`
-
-
-### `do` [do_fn]
-
-Executes multiple sub-expressions, then returns the original *context*. Use for running functions that produce an action or a side effect without changing the original *context*.
-
-**Accepts:** `any`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* †
Aliases: `exp`, `expression`, `fn`, `function` | `any` | The sub-expressions to execute. The return values of these sub-expressions are not available in the root pipeline as this function simply returns the original *context*. |
-
-**Returns:** Depends on your input and arguments
-
-
-### `dropdownControl` [dropdownControl_fn]
-
-Configures a dropdown filter control element.
-
-**Expression syntax**
-
-```js
-dropdownControl valueColumn=project filterColumn=project
-dropdownControl valueColumn=agent filterColumn=agent.keyword filterGroup=group1
-```
-
-**Code example**
-
-```text
-demodata
-| dropdownControl valueColumn=project filterColumn=project
-| render
-```
-
-This creates a dropdown filter element. It requires a data source and uses the unique values from the given `valueColumn` (i.e. `project`) and applies the filter to the `project` column. Note: `filterColumn` should point to a keyword type field for Elasticsearch data sources.
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `filterColumn` * | `string` | The column or field that you want to filter. |
-| `filterGroup` | `string` | The group name for the filter. |
-| `labelColumn` | `string` | The column or field to use as the label in the dropdown control |
-| `valueColumn` * | `string` | The column or field from which to extract the unique values for the dropdown control. |
-
-**Returns:** `render`
-
-
-## E [e_fns]
-
-
-### `embeddable` [embeddable_fn]
-
-Returns an embeddable with the provided configuration
-
-**Accepts:** `filter`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `config` | `string` | The base64 encoded embeddable input object |
-| `type` * | `string` | The embeddable type |
-
-**Returns:** `embeddable`
-
-
-### `eq` [eq_fn]
-
-Returns whether the *context* is equal to the argument.
-
-**Expression syntax**
-
-```js
-eq true
-eq null
-eq 10
-eq "foo"
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| mapColumn project
- fn={getCell project |
- switch
- {case if={eq kibana} then=kibana}
- {case if={eq elasticsearch} then=elasticsearch}
- default="other"
- }
-| pointseries size="size(cost)" color="project"
-| pie
-| render
-```
-
-This changes all values in the project column that don’t equal `"kibana"` or `"elasticsearch"` to `"other"`.
-
-**Accepts:** `boolean`, `number`, `string`, `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `value` | `boolean`, `number`, `string`, `null` | The value compared to the *context*. |
-
-**Returns:** `boolean`
-
-
-### `escount` [escount_fn]
-
-Query Elasticsearch for the number of hits matching the specified query.
-
-**Expression syntax**
-
-```js
-escount index="logstash-*"
-escount "currency:"EUR"" index="kibana_sample_data_ecommerce"
-escount query="response:404" index="kibana_sample_data_logs"
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| escount "Cancelled:true" index="kibana_sample_data_flights"
-| math "value"
-| progress shape="semicircle"
- label={formatnumber 0,0}
- font={font size=24 family="'Open Sans', Helvetica, Arial, sans-serif" color="#000000" align=center}
- max={filters | escount index="kibana_sample_data_flights"}
-| render
-```
-
-The first `escount` expression retrieves the number of flights that were cancelled. The second `escount` expression retrieves the total number of flights.
-
-**Accepts:** `filter`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Aliases: `q`, `query` | `string` | A Lucene query string.
Default: `"-_index:.kibana"` |
-| `index`
Alias: `dataView` | `string` | An index or data view. For example, `"logstash-*"`.
Default: `"_all"` |
-
-**Returns:** `number`
-
-
-### `esdocs` [esdocs_fn]
-
-Query Elasticsearch for raw documents. Specify the fields you want to retrieve, especially if you are asking for a lot of rows.
-
-**Expression syntax**
-
-```js
-esdocs index="logstash-*"
-esdocs "currency:"EUR"" index="kibana_sample_data_ecommerce"
-esdocs query="response:404" index="kibana_sample_data_logs"
-esdocs index="kibana_sample_data_flights" count=100
-esdocs index="kibana_sample_data_flights" sort="AvgTicketPrice, asc"
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| esdocs index="kibana_sample_data_ecommerce"
- fields="customer_gender, taxful_total_price, order_date"
- sort="order_date, asc"
- count=10000
-| mapColumn "order_date"
- fn={getCell "order_date" | date {context} | rounddate "YYYY-MM-DD"}
-| alterColumn "order_date" type="date"
-| pointseries x="order_date" y="sum(taxful_total_price)" color="customer_gender"
-| plot defaultStyle={seriesStyle lines=3}
- palette={palette "#7ECAE3" "#003A4D" gradient=true}
-| render
-```
-
-This retrieves the first 10000 documents data from the `kibana_sample_data_ecommerce` index sorted by `order_date` in ascending order, and only requests the `customer_gender`, `taxful_total_price`, and `order_date` fields.
-
-**Accepts:** `filter`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Aliases: `q`, `query` | `string` | A Lucene query string.
Default: `"-_index:.kibana"` |
-| `count` | `number` | The number of documents to retrieve. For better performance, use a smaller data set.
Default: `1000` |
-| `fields` | `string` | A comma-separated list of fields. For better performance, use fewer fields. |
-| `index`
Alias: `dataView` | `string` | An index or data view. For example, `"logstash-*"`.
Default: `"_all"` |
-| `metaFields` | `string` | Comma separated list of meta fields. For example, `"_index,_type"`. |
-| `sort` | `string` | The sort direction formatted as `"field, direction"`. For example, `"@timestamp, desc"` or `"bytes, asc"`. |
-
-**Returns:** `datatable`
-
-
-### `essql` [essql_fn]
-
-Queries Elasticsearch using Elasticsearch SQL.
-
-**Expression syntax**
-
-```js
-essql query="SELECT * FROM "logstash*""
-essql "SELECT * FROM "apm*"" count=10000
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| essql query="SELECT Carrier, FlightDelayMin, AvgTicketPrice FROM "kibana_sample_data_flights""
-| table
-| render
-```
-
-This retrieves the `Carrier`, `FlightDelayMin`, and `AvgTicketPrice` fields from the "kibana_sample_data_flights" index.
-
-**Accepts:** `kibana_context`, `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Aliases: `q`, `query` | `string` | An Elasticsearch SQL query. |
-| `count` | `number` | The number of documents to retrieve. For better performance, use a smaller data set.
Default: `1000` |
-| `parameter` †
Alias: `param` | `string`, `number`, `boolean` | A parameter to be passed to the SQL query. |
-| `timeField`
Alias: `timeField` | `string` | The time field to use in the time range filter, which is set in the context. |
-| `timezone`
Alias: `tz` | `string` | The timezone to use for date operations. Valid ISO8601 formats and UTC offsets both work.
Default: `"UTC"` |
-
-**Returns:** `datatable`
-
-
-### `exactly` [exactly_fn]
-
-Creates a filter that matches a given column to an exact value.
-
-**Expression syntax**
-
-```js
-exactly "state" value="running"
-exactly "age" value=50 filterGroup="group2"
-exactly column="project" value="beats"
-```
-
-**Accepts:** `filter`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `column` *
Aliases: `c`, `field` | `string` | The column or field that you want to filter. |
-| `filterGroup` | `string` | The group name for the filter. |
-| `value` *
Aliases: `v`, `val` | `string` | The value to match exactly, including white space and capitalization. |
-
-**Returns:** `filter`
-
-
-## F [f_fns]
-
-
-### `filterrows` [filterrows_fn]
-
-Filters rows in a `datatable` based on the return value of a sub-expression.
-
-**Expression syntax**
-
-```js
-filterrows {getCell "project" | eq "kibana"}
-filterrows fn={getCell "age" | gt 50}
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| filterrows {getCell "country" | any {eq "IN"} {eq "US"} {eq "CN"}}
-| mapColumn "@timestamp"
- fn={getCell "@timestamp" | rounddate "YYYY-MM"}
-| alterColumn "@timestamp" type="date"
-| pointseries x="@timestamp" y="mean(cost)" color="country"
-| plot defaultStyle={seriesStyle points="2" lines="1"}
- palette={palette "#01A4A4" "#CC6666" "#D0D102" "#616161" "#00A1CB" "#32742C" "#F18D05" "#113F8C" "#61AE24" "#D70060" gradient=false}
-| render
-```
-
-This uses `filterrows` to only keep data from India (`IN`), the United States (`US`), and China (`CN`).
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Aliases: `exp`, `expression`, `fn`, `function` | `boolean` | An expression to pass into each row in the `datatable`. The expression should return a `boolean`. A `true` value preserves the row, and a `false` value removes it. |
-
-**Returns:** `datatable`
-
-
-### `filters` [filters_fn]
-
-Aggregates element filters from the workpad for use elsewhere, usually a data source. [`filters`](#filters_fn) is deprecated and will be removed in a future release. Use `kibana | selectFilter` instead.
-
-**Expression syntax**
-
-```js
-filters
-filters group="timefilter1"
-filters group="timefilter2" group="dropdownfilter1" ungrouped=true
-```
-
-**Code example**
-
-```text
-filters group=group2 ungrouped=true
-| demodata
-| pointseries x="project" y="size(cost)" color="project"
-| plot defaultStyle={seriesStyle bars=0.75} legend=false
- font={
- font size=14
- family="'Open Sans', Helvetica, Arial, sans-serif"
- align="left"
- color="#FFFFFF"
- weight="lighter"
- underline=true
- italic=true
- }
-| render
-```
-
-`filters` sets the existing filters as context and accepts a `group` parameter to opt into specific filter groups. Setting `ungrouped` to `true` opts out of using global filters.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* †
Alias: `group` | `string` | The name of the filter group to use. |
-| `ungrouped`
Aliases: `nogroup`, `nogroups` | `boolean` | Exclude filters that belong to a filter group?
Default: `false` |
-
-**Returns:** `filter`
-
-
-### `font` [font_fn]
-
-Create a font style.
-
-**Expression syntax**
-
-```js
-font size=12
-font family=Arial
-font align=middle
-font color=pink
-font weight=lighter
-font underline=true
-font italic=false
-font lHeight=32
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| pointseries x="project" y="size(cost)" color="project"
-| plot defaultStyle={seriesStyle bars=0.75} legend=false
- font={
- font size=14
- family="'Open Sans', Helvetica, Arial, sans-serif"
- align="left"
- color="#FFFFFF"
- weight="lighter"
- underline=true
- italic=true
- }
-| render
-```
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `align` | `string` | The horizontal text alignment.
Default: `${ theme "font.align" default="left" }` |
-| `color` | `string` | The text color.
Default: `${ theme "font.color" }` |
-| `family` | `string` | An acceptable CSS web font string
Default: `${ theme "font.family" default="'Open Sans', Helvetica, Arial, sans-serif" }` |
-| `italic` | `boolean` | Italicize the text?
Default: `${ theme "font.italic" default=false }` |
-| `lHeight`
Alias: `lineHeight` | `number`, `null` | The line height in pixels
Default: `${ theme "font.lHeight" }` |
-| `size` | `number` | The font size
Default: `${ theme "font.size" default=14 }` |
-| `sizeUnit` | `string` | The font size unit
Default: `"px"` |
-| `underline` | `boolean` | Underline the text?
Default: `${ theme "font.underline" default=false }` |
-| `weight` | `string` | The font weight. For example, `"normal"`, `"bold"`, `"bolder"`, `"lighter"`, `"100"`, `"200"`, `"300"`, `"400"`, `"500"`, `"600"`, `"700"`, `"800"`, or `"900"`.
Default: `${ theme "font.weight" default="normal" }` |
-
-**Returns:** `style`
-
-
-### `formatdate` [formatdate_fn]
-
-Formats an ISO8601 date string or a date in milliseconds since epoch using MomentJS. See [https://momentjs.com/docs/#/displaying/](https://momentjs.com/docs/#/displaying/).
-
-**Expression syntax**
-
-```js
-formatdate format="YYYY-MM-DD"
-formatdate "MM/DD/YYYY"
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| mapColumn "time" fn={getCell time | formatdate "MMM 'YY"}
-| pointseries x="time" y="sum(price)" color="state"
-| plot defaultStyle={seriesStyle points=5}
-| render
-```
-
-This transforms the dates in the `time` field into strings that look like `"Jan ‘19"`, `"Feb ‘19"`, etc. using a MomentJS format.
-
-**Accepts:** `number`, `string`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `format` | `string` | A MomentJS format. For example, `"MM/DD/YYYY"`. See [https://momentjs.com/docs/#/displaying/](https://momentjs.com/docs/#/displaying/). |
-
-**Returns:** `string`
-
-
-### `formatnumber` [formatnumber_fn]
-
-Formats a number into a formatted number string using the Numeral pattern.
-
-**Expression syntax**
-
-```js
-formatnumber format="$0,0.00"
-formatnumber "0.0a"
-```
-
-**Code example**
-
-```text
-kibana
-| selectFilter
-| demodata
-| math "mean(percent_uptime)"
-| progress shape="gauge"
- label={formatnumber "0%"}
- font={font size=24 family="'Open Sans', Helvetica, Arial, sans-serif" color="#000000" align="center"}
-| render
-```
-
-The `formatnumber` subexpression receives the same `context` as the `progress` function, which is the output of the `math` function. It formats the value into a percentage.
-
-**Accepts:** `number`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `format` | `string` | A Numeral pattern format string. For example, `"0.0a"` or `"0%"`. |
-
-**Returns:** `string`
-
-
-## G [g_fns]
-
-
-### `getCell` [getCell_fn]
-
-Fetches a single cell from a `datatable`.
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Aliases: `c`, `column` | `string` | The name of the column to fetch the value from. If not provided, the value is retrieved from the first column. |
-| `row`
Alias: `r` | `number` | The row number, starting at 0.
Default: `0` |
-
-**Returns:** Depends on your input and arguments
-
-
-### `gt` [gt_fn]
-
-Returns whether the *context* is greater than the argument.
-
-**Accepts:** `number`, `string`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `value` | `number`, `string` | The value compared to the *context*. |
-
-**Returns:** `boolean`
-
-
-### `gte` [gte_fn]
-
-Returns whether the *context* is greater or equal to the argument.
-
-**Accepts:** `number`, `string`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `value` | `number`, `string` | The value compared to the *context*. |
-
-**Returns:** `boolean`
-
-
-## H [h_fns]
-
-
-### `head` [head_fn]
-
-Retrieves the first N rows from the `datatable`. See also [`tail`](#tail_fn).
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `count` | `number` | The number of rows to retrieve from the beginning of the `datatable`.
Default: `1` |
-
-**Returns:** `datatable`
-
-
-## I [i_fns]
-
-
-### `if` [if_fn]
-
-Performs conditional logic.
-
-**Accepts:** `any`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `condition` | `boolean` | A `true` or `false` indicating whether a condition is met, usually returned by a sub-expression. When unspecified, the original *context* is returned. |
-| `else` | `any` | The return value when the condition is `false`. When unspecified and the condition is not met, the original *context* is returned. |
-| `then` | `any` | The return value when the condition is `true`. When unspecified and the condition is met, the original *context* is returned. |
-
-**Returns:** Depends on your input and arguments
-
-
-### `image` [image_fn]
-
-Displays an image. Provide an image asset as a `base64` data URL, or pass in a sub-expression.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Aliases: `dataurl`, `url` | `string`, `null` | The HTTP(S) URL or `base64` data URL of an image.
Default: `null` |
-| `mode` | `string` | `"contain"` shows the entire image, scaled to fit. `"cover"` fills the container with the image, cropping from the sides or bottom as needed. `"stretch"` resizes the height and width of the image to 100% of the container.
Default: `"contain"` |
-
-**Returns:** `image`
-
-
-## J [j_fns]
-
-
-### `joinRows` [joinRows_fn]
-
-Concatenates values from rows in a `datatable` into a single string.
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `column` | `string` | The column or field from which to extract the values. |
-| `distinct` | `boolean` | Extract only unique values?
Default: `true` |
-| `quote` | `string` | The quote character to wrap around each extracted value.
Default: `"'"` |
-| `separator`
Aliases: `delimiter`, `sep` | `string` | The delimiter to insert between each extracted value.
Default: `","` |
-
-**Returns:** `string`
-
-
-## K [k_fns]
-
-
-### `kibana` [kibana_fn]
-
-Gets kibana global context
-
-**Accepts:** `kibana_context`, `null`
-
-**Returns:** `kibana_context`
-
-
-## L [l_fns]
-
-
-### `location` [location_fn]
-
-Find your current location using the Geolocation API of the browser. Performance can vary, but is fairly accurate. See [https://developer.mozilla.org/en-US/docs/Web/API/Navigator/geolocation](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/geolocation). Don’t use [`location`](#location_fn) if you plan to generate PDFs as this function requires user input.
-
-**Accepts:** `null`
-
-**Returns:** `datatable`
-
-
-### `lt` [lt_fn]
-
-Returns whether the *context* is less than the argument.
-
-**Accepts:** `number`, `string`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `value` | `number`, `string` | The value compared to the *context*. |
-
-**Returns:** `boolean`
-
-
-### `lte` [lte_fn]
-
-Returns whether the *context* is less than or equal to the argument.
-
-**Accepts:** `number`, `string`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `value` | `number`, `string` | The value compared to the *context*. |
-
-**Returns:** `boolean`
-
-
-## M [m_fns]
-
-
-### `mapCenter` [mapCenter_fn]
-
-Returns an object with the center coordinates and zoom level of the map.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `lat` * | `number` | Latitude for the center of the map |
-| `lon` * | `number` | Longitude for the center of the map |
-| `zoom` * | `number` | Zoom level of the map |
-
-**Returns:** `mapCenter`
-
-
-### `mapColumn` [mapColumn_fn]
-
-Adds a column calculated as the result of other columns. Changes are made only when you provide arguments.See also [`alterColumn`](#alterColumn_fn) and [`staticColumn`](#staticColumn_fn).
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Aliases: `column`, `name` | `string` | The name of the resulting column. Names are not required to be unique. |
-| `copyMetaFrom` | `string`, `null` | If set, the meta object from the specified column id is copied over to the specified target column. If the column doesn’t exist it silently fails.
Default: `null` |
-| `expression` *
Aliases: `exp`, `fn`, `function` | `boolean`, `number`, `string`, `null` | An expression that is executed on every row, provided with a single-row `datatable` context and returning the cell value. |
-| `id` | `string`, `null` | An optional id of the resulting column. When no id is provided, the id will be looked up from the existing column by the provided name argument. If no column with this name exists yet, a new column with this name and an identical id will be added to the table.
Default: `null` |
-
-**Returns:** `datatable`
-
-
-### `markdown` [markdown_fn]
-
-Adds an element that renders Markdown text.
-
-:::{tip}
-Use the [`markdown`](#markdown_fn) function for single numbers, metrics, and paragraphs of text.
-:::
-
-**Accepts:** `datatable`, `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* †
Aliases: `content`, `expression` | `string` | A string of text that contains Markdown. To concatenate, pass the `string` function multiple times.
Default: `""` |
-| `font` | `style` | The CSS font properties for the content. For example, "font-family" or "font-weight".
Default: `${font}` |
-| `openLinksInNewTab` | `boolean` | A true or false value for opening links in a new tab. The default value is `false`. Setting to `true` opens all links in a new tab.
Default: `false` |
-
-**Returns:** `render`
-
-
-### `math` [math_fn]
-
-Interprets a `TinyMath` math expression using a `number` or `datatable` as *context*. The `datatable` columns are available by their column name. If the *context* is a number it is available as `value`.
-
-**Accepts:** `number`, `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `expression` | `string` | An evaluated `TinyMath` expression. See [/reference/data-analysis/kibana/tinymath-functions.md](/reference/data-analysis/kibana/tinymath-functions.md). |
-| `onError` | `string` | In case the `TinyMath` evaluation fails or returns NaN, the return value is specified by onError. When `'throw'`, it will throw an exception, terminating expression execution (default). |
-
-**Returns:** Depends on your input and arguments
-
-
-### `mathColumn` [mathColumn_fn]
-
-Adds a column by evaluating `TinyMath` on each row. This function is optimized for math and performs better than using a math expression in [`mapColumn`](#mapColumn_fn).
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Aliases: `column`, `name` | `string` | The name of the resulting column. Names are not required to be unique. |
-| *Unnamed*
Alias: `expression` | `string` | An evaluated `TinyMath` expression. See [/reference/data-analysis/kibana/tinymath-functions.md](/reference/data-analysis/kibana/tinymath-functions.md). |
-| `castColumns` † | `string` | The column ids that are cast to numbers before the formula is applied. |
-| `copyMetaFrom` | `string`, `null` | If set, the meta object from the specified column id is copied over to the specified target column. If the column doesn’t exist it silently fails.
Default: `null` |
-| `id` * | `string` | id of the resulting column. Must be unique. |
-| `onError` | `string` | In case the `TinyMath` evaluation fails or returns NaN, the return value is specified by onError. When `'throw'`, it will throw an exception, terminating expression execution (default). |
-
-**Returns:** `datatable`
-
-
-### `metric` [metric_fn]
-
-Displays a number over a label.
-
-**Accepts:** `number`, `string`, `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Aliases: `description`, `label`, `text` | `string` | The text describing the metric.
Default: `""` |
-| `labelFont` | `style` | The CSS font properties for the label. For example, `font-family` or `font-weight`.
Default: `${font size=14 family="'Open Sans', Helvetica, Arial, sans-serif" color="#000000" align=center}` |
-| `metricFont` | `style` | The CSS font properties for the metric. For example, `font-family` or `font-weight`.
Default: `${font size=48 family="'Open Sans', Helvetica, Arial, sans-serif" color="#000000" align=center lHeight=48}` |
-| `metricFormat`
Alias: `format` | `string` | A Numeral pattern format string. For example, `"0.0a"` or `"0%"`. |
-
-**Returns:** `render`
-
-
-## N [n_fns]
-
-
-### `neq` [neq_fn]
-
-Returns whether the *context* is not equal to the argument.
-
-**Accepts:** `boolean`, `number`, `string`, `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `value` | `boolean`, `number`, `string`, `null` | The value compared to the *context*. |
-
-**Returns:** `boolean`
-
-
-## P [p_fns]
-
-
-### `palette` [palette_fn]
-
-Creates a color palette.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* †
Alias: `color` | `string` | The palette colors. Accepts an HTML color name, HEX, HSL, HSLA, RGB, or RGBA. |
-| `continuity` | `string` | Default: `"above"` |
-| `gradient` | `boolean` | Make a gradient palette where supported?
Default: `false` |
-| `range` | `string` | Default: `"percent"` |
-| `rangeMax` | `number` | |
-| `rangeMin` | `number` | |
-| `reverse` | `boolean` | Reverse the palette?
Default: `false` |
-| `stop` † | `number` | The palette color stops. When used, it must be associated with each color. |
-
-**Returns:** `palette`
-
-
-### `pie` [pie_fn]
-
-Configures a pie chart element.
-
-**Accepts:** `pointseries`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `font` | `style` | The CSS font properties for the labels. For example, `font-family` or `font-weight`.
Default: `${font}` |
-| `hole` | `number` | Draws a hole in the pie, between `0` and `100`, as a percentage of the pie radius.
Default: `0` |
-| `labelRadius` | `number` | The percentage of the container area to use as a radius for the label circle.
Default: `100` |
-| `labels` | `boolean` | Display the pie labels?
Default: `true` |
-| `legend` | `string`, `boolean` | The legend position. For example, `"nw"`, `"sw"`, `"ne"`, `"se"`, or `false`. When `false`, the legend is hidden.
Default: `false` |
-| `palette` | `palette` | A `palette` object for describing the colors to use in this pie chart.
Default: `${palette}` |
-| `radius` | `string`, `number` | The radius of the pie as a percentage, between `0` and `1`, of the available space. To automatically set the radius, use `"auto"`.
Default: `"auto"` |
-| `seriesStyle` † | `seriesStyle` | A style of a specific series |
-| `tilt` | `number` | The percentage of tilt where `1` is fully vertical, and `0` is completely flat.
Default: `1` |
-
-**Returns:** `render`
-
-
-### `plot` [plot_fn]
-
-Configures a chart element.
-
-**Accepts:** `pointseries`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `defaultStyle` | `seriesStyle` | The default style to use for every series.
Default: `${seriesStyle points=5}` |
-| `font` | `style` | The CSS font properties for the labels. For example, `font-family` or `font-weight`.
Default: `${font}` |
-| `legend` | `string`, `boolean` | The legend position. For example, `"nw"`, `"sw"`, `"ne"`, `"se"`, or `false`. When `false`, the legend is hidden.
Default: `"ne"` |
-| `palette` | `palette` | A `palette` object for describing the colors to use in this chart.
Default: `${palette}` |
-| `seriesStyle` † | `seriesStyle` | A style of a specific series |
-| `xaxis` | `boolean`, `axisConfig` | The axis configuration. When `false`, the axis is hidden.
Default: `true` |
-| `yaxis` | `boolean`, `axisConfig` | The axis configuration. When `false`, the axis is hidden.
Default: `true` |
-
-**Returns:** `render`
-
-
-### `ply` [ply_fn]
-
-Subdivides a `datatable` by the unique values of the specified columns, and passes the resulting tables into an expression, then merges the outputs of each expression.
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `by` † | `string` | The column to subdivide the `datatable`. |
-| `expression` †
Aliases: `exp`, `fn`, `function` | `datatable` | An expression to pass each resulting `datatable` into. Tips: Expressions must return a `datatable`. Use [`as`](#as_fn) to turn literals into `datatable`s. Multiple expressions must return the same number of rows.If you need to return a different row count, pipe into another instance of [`ply`](#ply_fn). If multiple expressions returns the columns with the same name, the last one wins. |
-
-**Returns:** `datatable`
-
-
-### `pointseries` [pointseries_fn]
-
-Turn a `datatable` into a point series model. Currently we differentiate measure from dimensions by looking for a `TinyMath` expression. See [/reference/data-analysis/kibana/tinymath-functions.md](/reference/data-analysis/kibana/tinymath-functions.md). If you enter a `TinyMath` expression in your argument, we treat that argument as a measure, otherwise it is a dimension. Dimensions are combined to create unique keys. Measures are then deduplicated by those keys using the specified `TinyMath` function
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `color` | `string` | An expression to use in determining the mark’s color. |
-| `size` | `string` | The size of the marks. Only applicable to supported elements. |
-| `text` | `string` | The text to show on the mark. Only applicable to supported elements. |
-| `x` | `string` | The values along the X-axis. |
-| `y` | `string` | The values along the Y-axis. |
-
-**Returns:** `pointseries`
-
-
-### `progress` [progress_fn]
-
-Configures a progress element.
-
-**Accepts:** `number`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `shape` | `string` | Select `"gauge"`, `"horizontalBar"`, `"horizontalPill"`, `"semicircle"`, `"unicorn"`, `"verticalBar"`, `"verticalPill"`, or `"wheel"`.
Default: `"gauge"` |
-| `barColor` | `string` | The color of the background bar.
Default: `"#f0f0f0"` |
-| `barWeight` | `number` | The thickness of the background bar.
Default: `20` |
-| `font` | `style` | The CSS font properties for the label. For example, `font-family` or `font-weight`.
Default: `${font size=24 family="'Open Sans', Helvetica, Arial, sans-serif" color="#000000" align=center}` |
-| `label` | `boolean`, `string` | To show or hide the label, use `true` or `false`. Alternatively, provide a string to display as a label.
Default: `true` |
-| `max` | `number` | The maximum value of the progress element.
Default: `1` |
-| `valueColor` | `string` | The color of the progress bar.
Default: `"#1785b0"` |
-| `valueWeight` | `number` | The thickness of the progress bar.
Default: `20` |
-
-**Returns:** `render`
-
-
-## R [r_fns]
-
-
-### `removeFilter` [removeFilter_fn]
-
-Removes filters from context
-
-**Accepts:** `kibana_context`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `group` | `string` | Removes only filters belonging to the provided group |
-| `from` | `string` | Removes only filters owned by the provided id |
-| `ungrouped`
Aliases: `nogroup`, `nogroups` | `boolean` | Should filters without group be removed
Default: `false` |
-
-**Returns:** `kibana_context`
-
-
-### `render` [render_fn]
-
-Renders the *context* as a specific element and sets element level options, such as background and border styling.
-
-**Accepts:** `render`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `as` | `string` | The element type to render. You probably want a specialized function instead, such as [`plot`](#plot_fn) or [`shape`](#shape_fn). |
-| `containerStyle` | `containerStyle` | The style for the container, including background, border, and opacity.
Default: `${containerStyle}` |
-| `css` | `string` | Any block of custom CSS to be scoped to the element.
Default: `".canvasRenderEl${}"` |
-
-**Returns:** `render`
-
-
-### `repeatImage` [repeatImage_fn]
-
-Configures a repeating image element.
-
-**Accepts:** `number`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `emptyImage` | `string`, `null` | Fills the difference between the *context* and `max` parameter for the element with this image. Provide an image asset as a `base64` data URL, or pass in a sub-expression.
Default: `null` |
-| `image` | `string`, `null` | The image to repeat. Provide an image asset as a `base64` data URL, or pass in a sub-expression.
Default: `null` |
-| `max` | `number`, `null` | The maximum number of times the image can repeat.
Default: `1000` |
-| `size` | `number` | The maximum height or width of the image, in pixels. When the image is taller than it is wide, this function limits the height.
Default: `100` |
-
-**Returns:** `render`
-
-
-### `replace` [replace_fn]
-
-Uses a regular expression to replace parts of a string.
-
-**Accepts:** `string`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Aliases: `pattern`, `regex` | `string` | The text or pattern of a JavaScript regular expression. For example, `"[aeiou]"`. You can use capturing groups here. |
-| `flags`
Alias: `modifiers` | `string` | Specify flags. See [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp).
Default: `"g"` |
-| `replacement` | `string` | The replacement for the matching parts of string. Capturing groups can be accessed by their index. For example, `"$1"`.
Default: `""` |
-
-**Returns:** `string`
-
-
-### `revealImage` [revealImage_fn]
-
-Configures an image reveal element.
-
-**Accepts:** `number`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `emptyImage` | `string`, `null` | An optional background image to reveal over. Provide an image asset as a ``base64`` data URL, or pass in a sub-expression.
Default: `null` |
-| `image` | `string`, `null` | The image to reveal. Provide an image asset as a `base64` data URL, or pass in a sub-expression.
Default: `null` |
-| `origin` | `string` | The position to start the image fill. For example, `"top"`, `"bottom"`, `"left"`, or right.
Default: `"bottom"` |
-
-**Returns:** `render`
-
-
-### `rounddate` [rounddate_fn]
-
-Uses a MomentJS formatting string to round milliseconds since epoch, and returns milliseconds since epoch.
-
-**Accepts:** `number`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `format` | `string` | The MomentJS format to use for bucketing. For example, `"YYYY-MM"` rounds to months. See [https://momentjs.com/docs/#/displaying/](https://momentjs.com/docs/#/displaying/). |
-
-**Returns:** `number`
-
-
-### `rowCount` [rowCount_fn]
-
-Returns the number of rows. Pairs with [`ply`](#ply_fn) to get the count of unique column values, or combinations of unique column values.
-
-**Accepts:** `datatable`
-
-**Returns:** `number`
-
-
-## S [s_fns]
-
-
-### `selectFilter` [selectFilter_fn]
-
-Selects filters from context
-
-**Accepts:** `kibana_context`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* †
Alias: `group` | `string` | Select only filters belonging to the provided group |
-| `from` | `string` | Select only filters owned by the provided id |
-| `ungrouped`
Aliases: `nogroup`, `nogroups` | `boolean` | Should filters without group be included
Default: `false` |
-
-**Returns:** `kibana_context`
-
-
-### `seriesStyle` [seriesStyle_fn]
-
-Creates an object used for describing the properties of a series on a chart. Use [`seriesStyle`](#seriesStyle_fn) inside of a charting function, like [`plot`](#plot_fn) or [`pie`](#pie_fn).
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `bars` | `number` | The width of bars. |
-| `color` | `string` | The line color. |
-| `fill` | `number`, `boolean` | Should we fill in the points?
Default: `false` |
-| `horizontalBars` | `boolean` | Sets the orientation of the bars in the chart to horizontal. |
-| `label` | `string` | The name of the series to style. |
-| `lines` | `number` | The width of the line. |
-| `points` | `number` | The size of points on line. |
-| `stack` | `number`, `null` | Specifies if the series should be stacked. The number is the stack ID. Series with the same stack ID are stacked together. |
-
-**Returns:** `seriesStyle`
-
-
-### `shape` [shape_fn]
-
-Creates a shape.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `shape` | `string` | Pick a shape.
Default: `"square"` |
-| `border`
Alias: `stroke` | `string` | An SVG color for the border outlining the shape. |
-| `borderWidth`
Alias: `strokeWidth` | `number` | The thickness of the border.
Default: `0` |
-| `fill` | `string` | An SVG color to fill the shape.
Default: `"black"` |
-| `maintainAspect` | `boolean` | Maintain the shape’s original aspect ratio?
Default: `false` |
-
-**Returns:** Depends on your input and arguments
-
-
-### `sort` [sort_fn]
-
-Sorts a `datatable` by the specified column.
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Aliases: `by`, `column` | `string` | The column to sort by. When unspecified, the `datatable` is sorted by the first column. |
-| `reverse` | `boolean` | Reverses the sorting order. When unspecified, the `datatable` is sorted in ascending order.
Default: `false` |
-
-**Returns:** `datatable`
-
-
-### `staticColumn` [staticColumn_fn]
-
-Adds a column with the same static value in every row. See also [`alterColumn`](#alterColumn_fn), [`mapColumn`](#mapColumn_fn), and [`mathColumn`](#mathColumn_fn)
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Aliases: `column`, `name` | `string` | The name of the new column. |
-| `value` | `string`, `number`, `boolean`, `null` | The value to insert in each row in the new column. TIP: use a sub-expression to rollup other columns into a static value.
Default: `null` |
-
-**Returns:** `datatable`
-
-
-### `string` [string_fn]
-
-Concatenates all of the arguments into a single string.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* †
Alias: `value` | `string`, `number`, `boolean` | The values to join together into one string. Include spaces where needed. |
-
-**Returns:** `string`
-
-
-### `switch` [switch_fn]
-
-Performs conditional logic with multiple conditions. See also [`case`](#case_fn), which builds a `case` to pass to the [`switch`](#switch_fn) function.
-
-**Accepts:** `any`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* * †
Alias: `case` | `case` | The conditions to check. |
-| `default`
Alias: `finally` | `any` | The value returned when no conditions are met. When unspecified and no conditions are met, the original *context* is returned. |
-
-**Returns:** Depends on your input and arguments
-
-
-## T [t_fns]
-
-
-### `table` [table_fn]
-
-Configures a table element.
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `font` | `style` | The CSS font properties for the contents of the table. For example, `font-family` or `font-weight`.
Default: `${font}` |
-| `paginate` | `boolean` | Show pagination controls? When `false`, only the first page is displayed.
Default: `true` |
-| `perPage` | `number` | The number of rows to display on each page.
Default: `10` |
-| `showHeader` | `boolean` | Show or hide the header row with titles for each column.
Default: `true` |
-
-**Returns:** `render`
-
-
-### `tail` [tail_fn]
-
-Retrieves the last N rows from the end of a `datatable`. See also [`head`](#head_fn).
-
-**Accepts:** `datatable`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Alias: `count` | `number` | The number of rows to retrieve from the end of the `datatable`.
Default: `1` |
-
-**Returns:** `datatable`
-
-
-### `timefilter` [timefilter_fn]
-
-Creates a time filter for querying a source.
-
-**Accepts:** `filter`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `column`
Aliases: `c`, `field` | `string` | The column or field that you want to filter.
Default: `"@timestamp"` |
-| `filterGroup` | `string` | The group name for the filter |
-| `from`
Aliases: `f`, `start` | `string` | The beginning of the range, in ISO8601 or Elasticsearch `datemath` format |
-| `to`
Aliases: `end`, `t` | `string` | The end of the range, in ISO8601 or Elasticsearch `datemath` format |
-
-**Returns:** `filter`
-
-
-### `timefilterControl` [timefilterControl_fn]
-
-Configures a time filter control element.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `column`
Aliases: `c`, `field` | `string` | The column or field that you want to filter.
Default: `"@timestamp"` |
-| `compact` | `boolean` | Shows the time filter as a button, which triggers a popover.
Default: `true` |
-| `filterGroup` | `string` | The group name for the filter. |
-
-**Returns:** `render`
-
-
-### `timelion` [timelion_fn]
-
-Uses Timelion to extract one or more time series from many sources.
-
-**Accepts:** `filter`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed*
Aliases: `q`, `query` | `string` | A Timelion query
Default: `".es(*)"` |
-| `from` | `string` | The Elasticsearch `datemath` string for the beginning of the time range.
Default: `"now-1y"` |
-| `interval` | `string` | The bucket interval for the time series.
Default: `"auto"` |
-| `timezone` | `string` | The timezone for the time range. See [https://momentjs.com/timezone/](https://momentjs.com/timezone/).
Default: `"UTC"` |
-| `to` | `string` | The Elasticsearch `datemath` string for the end of the time range.
Default: `"now"` |
-
-**Returns:** `datatable`
-
-
-### `timerange` [timerange_fn]
-
-An object that represents a span of time.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| `from` * | `string` | The start of the time range |
-| `to` * | `string` | The end of the time range |
-
-**Returns:** `timerange`
-
-
-### `to` [to_fn]
-
-Explicitly casts the type of the *context* from one type to the specified type.
-
-**Accepts:** `any`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* †
Alias: `type` | `string` | A known data type in the expression language. |
-
-**Returns:** Depends on your input and arguments
-
-
-## U [u_fns]
-
-
-### `uiSetting` [uiSetting_fn]
-
-Returns a UI settings parameter value.
-
-**Accepts:** `any`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `parameter` | `string` | The parameter name. |
-| `default` | `any` | A default value in case of the parameter is not set. |
-
-**Returns:** Depends on your input and arguments
-
-
-### `urlparam` [urlparam_fn]
-
-Retrieves a URL parameter to use in an expression. The [`urlparam`](#urlparam_fn) function always returns a `string`. For example, you can retrieve the value `"20"` from the parameter `myVar` from the URL `https://localhost:5601/app/canvas?myVar=20`.
-
-**Accepts:** `null`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Aliases: `param`, `var`, `variable` | `string` | The URL hash parameter to retrieve. |
-| `default` | `string` | The string returned when the URL parameter is unspecified.
Default: `""` |
-
-**Returns:** `string`
-
-
-## V [v_fns]
-
-
-### `var` [var_fn]
-
-Updates the Kibana global context.
-
-**Accepts:** `any`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* *
Alias: `name` | `string` | Specify the name of the variable. |
-
-**Returns:** Depends on your input and arguments
-
-
-### `var_set` [var_set_fn]
-
-Updates the Kibana global context.
-
-**Accepts:** `any`
-
-| Argument | Type | Description |
-| --- | --- | --- |
-| *Unnamed* * †
Alias: `name` | `string` | Specify the name of the variable. |
-| `value` †
Alias: `val` | `any` | Specify the value for the variable. When unspecified, the input context is used. |
-
-**Returns:** Depends on your input and arguments
-
-
diff --git a/reference/data-analysis/kibana/tinymath-functions.md b/reference/data-analysis/kibana/tinymath-functions.md
deleted file mode 100644
index d4853ad7c9..0000000000
--- a/reference/data-analysis/kibana/tinymath-functions.md
+++ /dev/null
@@ -1,695 +0,0 @@
----
-mapped_pages:
- - https://www.elastic.co/guide/en/kibana/current/canvas-tinymath-functions.html
-products:
- - id: kibana
-navigation_title: TinyMath functions
----
-
-# TinyMath functions for data analysis [canvas-tinymath-functions]
-
-TinyMath provides a set of functions that can be used with the Canvas expression language to perform complex math calculations. Read on for detailed information about the functions available in TinyMath, including what parameters each function accepts, the return value of that function, and examples of how each function behaves.
-
-Most of the functions accept arrays and apply JavaScript Math methods to each element of that array. For the functions that accept multiple arrays as parameters, the function generally does the calculation index by index.
-
-Any function can be wrapped by another function as long as the return type of the inner function matches the acceptable parameter type of the outer function.
-
-
-## abs( a ) [_abs_a]
-
-Calculates the absolute value of a number. For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-
-**Returns**: `number` | `Array.`. The absolute value of `a`. Returns an array with the absolute values of each element if `a` is an array.
-
-**Example**
-
-```js
-abs(-1) // returns 1
-abs(2) // returns 2
-abs([-1 , -2, 3, -4]) // returns [1, 2, 3, 4]
-```
-
-
-## add( …args ) [_add_args]
-
-Calculates the sum of one or more numbers/arrays passed into the function. If at least one array of numbers is passed into the function, the function will calculate the sum by index.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| …args | number | Array. | one or more numbers or arrays of numbers |
-
-**Returns**: `number` | `Array.`. The sum of all numbers in `args` if `args` contains only numbers. Returns an array of sums of the elements at each index, including all scalar numbers in `args` in the calculation at each index if `args` contains at least one array.
-
-**Throws**: `'Array length mismatch'` if `args` contains arrays of different lengths
-
-**Example**
-
-```js
-add(1, 2, 3) // returns 6
-add([10, 20, 30, 40], 10, 20, 30) // returns [70, 80, 90, 100]
-add([1, 2], 3, [4, 5], 6) // returns [(1 + 3 + 4 + 6), (2 + 3 + 5 + 6)] = [14, 16]
-```
-
-
-## cbrt( a ) [_cbrt_a]
-
-Calculates the cube root of a number. For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-
-**Returns**: `number` | `Array.`. The cube root of `a`. Returns an array with the cube roots of each element if `a` is an array.
-
-**Example**
-
-```js
-cbrt(-27) // returns -3
-cbrt(94) // returns 4.546835943776344
-cbrt([27, 64, 125]) // returns [3, 4, 5]
-```
-
-
-## ceil( a ) [_ceil_a]
-
-Calculates the ceiling of a number, i.e., rounds a number towards positive infinity. For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-
-**Returns**: `number` | `Array.`. The ceiling of `a`. Returns an array with the ceilings of each element if `a` is an array.
-
-**Example**
-
-```js
-ceil(1.2) // returns 2
-ceil(-1.8) // returns -1
-ceil([1.1, 2.2, 3.3]) // returns [2, 3, 4]
-```
-
-
-## clamp( …a, min, max ) [_clamp_a_min_max]
-
-Restricts value to a given range and returns closed available value. If only `min` is provided, values are restricted to only a lower bound.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| …a | number | Array. | one or more numbers or arrays of numbers |
-| min | number | Array. | (optional) The minimum value this function will return. |
-| max | number | Array. | (optional) The maximum value this function will return. |
-
-**Returns**: `number` | `Array.`. The closest value between `min` (inclusive) and `max` (inclusive). Returns an array with values greater than or equal to `min` and less than or equal to `max` (if provided) at each index.
-
-**Throws**:
-
-* `'Array length mismatch'` if a `min` and/or `max` are arrays of different lengths
-* `'Min must be less than max'` if `max` is less than `min`
-
-**Example**
-
-```js
-clamp(1, 2, 3) // returns 2
-clamp([10, 20, 30, 40], 15, 25) // returns [15, 20, 25, 25]
-clamp(10, [15, 2, 4, 20], 25) // returns [15, 10, 10, 20]
-clamp(35, 10, [20, 30, 40, 50]) // returns [20, 30, 35, 35]
-clamp([1, 9], 3, [4, 5]) // returns [clamp([1, 3, 4]), clamp([9, 3, 5])] = [3, 5]
-```
-
-
-## count( a ) [_count_a]
-
-Returns the length of an array. Alias for size.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | Array. | array of any values |
-
-**Returns**: `number`. The length of the array.
-
-**Throws**: `'Must pass an array'` if `a` is not an array.
-
-**Example**
-
-```js
-count([]) // returns 0
-count([-1, -2, -3, -4]) // returns 4
-count(100) // returns 1
-```
-
-
-## cube( a ) [_cube_a]
-
-Calculates the cube of a number. For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-
-**Returns**: `number` | `Array.`. The cube of `a`. Returns an array with the cubes of each element if `a` is an array.
-
-**Example**
-
-```js
-cube(-3) // returns -27
-cube([3, 4, 5]) // returns [27, 64, 125]
-```
-
-
-## divide( a, b ) [_divide_a_b]
-
-Divides two numbers. If at least one array of numbers is passed into the function, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | dividend, a number or an array of numbers |
-| b | number | Array. | divisor, a number or an array of numbers, b != 0 |
-
-**Returns**: `number` | `Array.`. Returns the quotient of `a` and `b` if both are numbers. Returns an array with the quotients applied index-wise to each element if `a` or `b` is an array.
-
-**Throws**:
-
-* `'Array length mismatch'` if `a` and `b` are arrays with different lengths
-* `'Cannot divide by 0'` if `b` equals 0 or contains 0
-
-**Example**
-
-```js
-divide(6, 3) // returns 2
-divide([10, 20, 30, 40], 10) // returns [1, 2, 3, 4]
-divide(10, [1, 2, 5, 10]) // returns [10, 5, 2, 1]
-divide([14, 42, 65, 108], [2, 7, 5, 12]) // returns [7, 6, 13, 9]
-```
-
-
-## exp( a ) [_exp_a]
-
-Calculates *e^x* where *e* is Euler’s number. For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-
-**Returns**: `number` | `Array.`. Returns an array with the values of `e^x` evaluated where `x` is each element of `a` if `a` is an array.
-
-**Example**
-
-```js
-exp(2) // returns e^2 = 7.3890560989306495
-exp([1, 2, 3]) // returns [e^1, e^2, e^3] = [2.718281828459045, 7.3890560989306495, 20.085536923187668]
-```
-
-
-## first( a ) [_first_a]
-
-Returns the first element of an array. If anything other than an array is passed in, the input is returned.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | Array. | array of any values |
-
-**Returns**: `*`. The first element of `a`. Returns `a` if `a` is not an array.
-
-**Example**
-
-```js
-first(2) // returns 2
-first([1, 2, 3]) // returns 1
-```
-
-
-## fix( a ) [_fix_a]
-
-Calculates the fix of a number, i.e., rounds a number towards 0. For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-
-**Returns**: `number` | `Array.`. The fix of `a`. Returns an array with the fixes for each element if `a` is an array.
-
-**Example**
-
-```js
-fix(1.2) // returns 1
-fix(-1.8) // returns -1
-fix([1.8, 2.9, -3.7, -4.6]) // returns [1, 2, -3, -4]
-```
-
-
-## floor( a ) [_floor_a]
-
-Calculates the floor of a number, i.e., rounds a number towards negative infinity. For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-
-**Returns**: `number` | `Array.`. The floor of `a`. Returns an array with the floor of each element if `a` is an array.
-
-**Example**
-
-```js
-floor(1.8) // returns 1
-floor(-1.2) // returns -2
-floor([1.7, 2.8, 3.9]) // returns [1, 2, 3]
-```
-
-
-## last( a ) [_last_a]
-
-Returns the last element of an array. If anything other than an array is passed in, the input is returned.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | Array. | array of any values |
-
-**Returns**: `*`. The last element of `a`. Returns `a` if `a` is not an array.
-
-**Example**
-
-```js
-last(2) // returns 2
-last([1, 2, 3]) // returns 3
-```
-
-
-## log( a, b ) [_log_a_b]
-
-Calculates the logarithm of a number. For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers, `a` must be greater than 0 |
-| b | Object | (optional) base for the logarithm. If not provided a value, the default base is e, and the natural log is calculated. |
-
-**Returns**: `number` | `Array.`. The logarithm of `a`. Returns an array with the the logarithms of each element if `a` is an array.
-
-**Throws**:
-
-* `'Base out of range'` if `b` ⇐ 0
-* `'Must be greater than 0'` if `a` > 0
-
-**Example**
-
-```js
-log(1) // returns 0
-log(64, 8) // returns 2
-log(42, 5) // returns 2.322344707681546
-log([2, 4, 8, 16, 32], 2) // returns [1, 2, 3, 4, 5]
-```
-
-
-## log10( a ) [_log10_a]
-
-Calculates the logarithm base 10 of a number. For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers, `a` must be greater than 0 |
-
-**Returns**: `number` | `Array.`. The logarithm of `a`. Returns an array with the the logarithms base 10 of each element if `a` is an array.
-
-**Throws**: `'Must be greater than 0'` if `a` < 0
-
-**Example**
-
-```js
-log(10) // returns 1
-log(100) // returns 2
-log(80) // returns 1.9030899869919433
-log([10, 100, 1000, 10000, 100000]) // returns [1, 2, 3, 4, 5]
-```
-
-
-## max( …args ) [_max_args]
-
-Finds the maximum value of one of more numbers/arrays of numbers passed into the function. If at least one array of numbers is passed into the function, the function will find the maximum by index.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| …args | number | Array. | one or more numbers or arrays of numbers |
-
-**Returns**: `number` | `Array.`. The maximum value of all numbers if `args` contains only numbers. Returns an array with the the maximum values at each index, including all scalar numbers in `args` in the calculation at each index if `args` contains at least one array.
-
-**Throws**: `'Array length mismatch'` if `args` contains arrays of different lengths
-
-**Example**
-
-```js
-max(1, 2, 3) // returns 3
-max([10, 20, 30, 40], 15) // returns [15, 20, 30, 40]
-max([1, 9], 4, [3, 5]) // returns [max([1, 4, 3]), max([9, 4, 5])] = [4, 9]
-```
-
-
-## mean( …args ) [_mean_args]
-
-Finds the mean value of one of more numbers/arrays of numbers passed into the function. If at least one array of numbers is passed into the function, the function will find the mean by index.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| …args | number | Array. | one or more numbers or arrays of numbers |
-
-**Returns**: `number` | `Array.`. The mean value of all numbers if `args` contains only numbers. Returns an array with the the mean values of each index, including all scalar numbers in `args` in the calculation at each index if `args` contains at least one array.
-
-**Example**
-
-```js
-mean(1, 2, 3) // returns 2
-mean([10, 20, 30, 40], 20) // returns [15, 20, 25, 30]
-mean([1, 9], 5, [3, 4]) // returns [mean([1, 5, 3]), mean([9, 5, 4])] = [3, 6]
-```
-
-
-## median( …args ) [_median_args]
-
-Finds the median value(s) of one of more numbers/arrays of numbers passed into the function. If at least one array of numbers is passed into the function, the function will find the median by index.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| …args | number | Array. | one or more numbers or arrays of numbers |
-
-**Returns**: `number` | `Array.`. The median value of all numbers if `args` contains only numbers. Returns an array with the the median values of each index, including all scalar numbers in `args` in the calculation at each index if `args` contains at least one array.
-
-**Example**
-
-```js
-median(1, 1, 2, 3) // returns 1.5
-median(1, 1, 2, 2, 3) // returns 2
-median([10, 20, 30, 40], 10, 20, 30) // returns [15, 20, 25, 25]
-median([1, 9], 2, 4, [3, 5]) // returns [median([1, 2, 4, 3]), median([9, 2, 4, 5])] = [2.5, 4.5]
-```
-
-
-## min( …args ) [_min_args]
-
-Finds the minimum value of one of more numbers/arrays of numbers passed into the function. If at least one array of numbers is passed into the function, the function will find the minimum by index.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| …args | number | Array. | one or more numbers or arrays of numbers |
-
-**Returns**: `number` | `Array.`. The minimum value of all numbers if `args` contains only numbers. Returns an array with the the minimum values of each index, including all scalar numbers in `args` in the calculation at each index if `a` is an array.
-
-**Throws**: `'Array length mismatch'` if `args` contains arrays of different lengths.
-
-**Example**
-
-```js
-min(1, 2, 3) // returns 1
-min([10, 20, 30, 40], 25) // returns [10, 20, 25, 25]
-min([1, 9], 4, [3, 5]) // returns [min([1, 4, 3]), min([9, 4, 5])] = [1, 4]
-```
-
-
-## mod( a, b ) [_mod_a_b]
-
-Remainder after dividing two numbers. If at least one array of numbers is passed into the function, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | dividend, a number or an array of numbers |
-| b | number | Array. | divisor, a number or an array of numbers, b != 0 |
-
-**Returns**: `number` | `Array.`. The remainder of `a` divided by `b` if both are numbers. Returns an array with the the remainders applied index-wise to each element if `a` or `b` is an array.
-
-**Throws**:
-
-* `'Array length mismatch'` if `a` and `b` are arrays with different lengths
-* `'Cannot divide by 0'` if `b` equals 0 or contains 0
-
-**Example**
-
-```js
-mod(10, 7) // returns 3
-mod([11, 22, 33, 44], 10) // returns [1, 2, 3, 4]
-mod(100, [3, 7, 11, 23]) // returns [1, 2, 1, 8]
-mod([14, 42, 65, 108], [5, 4, 14, 2]) // returns [5, 2, 9, 0]
-```
-
-
-## mode( …args ) [_mode_args]
-
-Finds the mode value(s) of one of more numbers/arrays of numbers passed into the function. If at least one array of numbers is passed into the function, the function will find the mode by index.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| …args | number | Array. | one or more numbers or arrays of numbers |
-
-**Returns**: `number` | `Array.>`. An array of mode value(s) of all numbers if `args` contains only numbers. Returns an array of arrays with mode value(s) of each index, including all scalar numbers in `args` in the calculation at each index if `args` contains at least one array.
-
-**Example**
-
-```js
-mode(1, 1, 2, 3) // returns [1]
-mode(1, 1, 2, 2, 3) // returns [1,2]
-mode([10, 20, 30, 40], 10, 20, 30) // returns [[10], [20], [30], [10, 20, 30, 40]]
-mode([1, 9], 1, 4, [3, 5]) // returns [mode([1, 1, 4, 3]), mode([9, 1, 4, 5])] = [[1], [4, 5, 9]]
-```
-
-
-## multiply( a, b ) [_multiply_a_b]
-
-Multiplies two numbers. If at least one array of numbers is passed into the function, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-| b | number | Array. | a number or an array of numbers |
-
-**Returns**: `number` | `Array.`. The product of `a` and `b` if both are numbers. Returns an array with the the products applied index-wise to each element if `a` or `b` is an array.
-
-**Throws**: `'Array length mismatch'` if `a` and `b` are arrays with different lengths
-
-**Example**
-
-```js
-multiply(6, 3) // returns 18
-multiply([10, 20, 30, 40], 10) // returns [100, 200, 300, 400]
-multiply(10, [1, 2, 5, 10]) // returns [10, 20, 50, 100]
-multiply([1, 2, 3, 4], [2, 7, 5, 12]) // returns [2, 14, 15, 48]
-```
-
-
-## pow( a, b ) [_pow_a_b]
-
-Calculates the cube root of a number. For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-| b | number | the power that `a` is raised to |
-
-**Returns**: `number` | `Array.`. `a` raised to the power of `b`. Returns an array with the each element raised to the power of `b` if `a` is an array.
-
-**Throws**: `'Missing exponent'` if `b` is not provided
-
-**Example**
-
-```js
-pow(2,3) // returns 8
-pow([1, 2, 3], 4) // returns [1, 16, 81]
-```
-
-
-## random( a, b ) [_random_a_b]
-
-Generates a random number within the given range where the lower bound is inclusive and the upper bound is exclusive. If no numbers are passed in, it will return a number between 0 and 1. If only one number is passed in, it will return a number between 0 and the number passed in.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | (optional) must be greater than 0 if `b` is not provided |
-| b | number | (optional) must be greater than `a` |
-
-**Returns**: `number`. A random number between 0 and 1 if no numbers are passed in. Returns a random number between 0 and `a` if only one number is passed in. Returns a random number between `a` and `b` if two numbers are passed in.
-
-**Throws**: `'Min must be greater than max'` if `a` < 0 when only `a` is passed in or if `a` > `b` when both `a` and `b` are passed in
-
-**Example**
-
-```js
-random() // returns a random number between 0 (inclusive) and 1 (exclusive)
-random(10) // returns a random number between 0 (inclusive) and 10 (exclusive)
-random(-10,10) // returns a random number between -10 (inclusive) and 10 (exclusive)
-```
-
-
-## range( …args ) [_range_args]
-
-Finds the range of one of more numbers/arrays of numbers passed into the function. If at least one array of numbers is passed into the function, the function will find the range by index.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| …args | number | Array. | one or more numbers or arrays of numbers |
-
-**Returns**: `number` | `Array.`. The range value of all numbers if `args` contains only numbers. Returns an array with the range values at each index, including all scalar numbers in `args` in the calculation at each index if `args` contains at least one array.
-
-**Example**
-
-```js
-range(1, 2, 3) // returns 2
-range([10, 20, 30, 40], 15) // returns [5, 5, 15, 25]
-range([1, 9], 4, [3, 5]) // returns [range([1, 4, 3]), range([9, 4, 5])] = [3, 5]
-```
-
-
-## range( …args ) [_range_args_2]
-
-Finds the range of one of more numbers/arrays of numbers into the function. If at least one array of numbers is passed into the function, the function will find the range by index.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| …args | number | Array. | one or more numbers or arrays of numbers |
-
-**Returns**: `number` | `Array.`. The range value of all numbers if `args` contains only numbers. Returns an array with the the range values at each index, including all scalar numbers in `args` in the calculation at each index if `args` contains at least one array.
-
-**Example**
-
-```js
-range(1, 2, 3) // returns 2
-range([10, 20, 30, 40], 15) // returns [5, 5, 15, 25]
-range([1, 9], 4, [3, 5]) // returns [range([1, 4, 3]), range([9, 4, 5])] = [3, 5]
-```
-
-
-## round( a, b ) [_round_a_b]
-
-Rounds a number towards the nearest integer by default, or decimal place (if passed in as `b`). For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-| b | number | (optional) number of decimal places, default value: 0 |
-
-**Returns**: `number` | `Array.`. The rounded value of `a`. Returns an array with the the rounded values of each element if `a` is an array.
-
-**Example**
-
-```js
-round(1.2) // returns 2
-round(-10.51) // returns -11
-round(-10.1, 2) // returns -10.1
-round(10.93745987, 4) // returns 10.9375
-round([2.9234, 5.1234, 3.5234, 4.49234324], 2) // returns [2.92, 5.12, 3.52, 4.49]
-```
-
-
-## size( a ) [_size_a]
-
-Returns the length of an array. Alias for count.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | Array. | array of any values |
-
-**Returns**: `number`. The length of the array.
-
-**Throws**: `'Must pass an array'` if `a` is not an array
-
-**Example**
-
-```js
-size([]) // returns 0
-size([-1, -2, -3, -4]) // returns 4
-size(100) // returns 1
-```
-
-
-## sqrt( a ) [_sqrt_a]
-
-Calculates the square root of a number. For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-
-**Returns**: `number` | `Array.`. The square root of `a`. Returns an array with the the square roots of each element if `a` is an array.
-
-**Throws**: `'Unable find the square root of a negative number'` if `a` < 0
-
-**Example**
-
-```js
-sqrt(9) // returns 3
-sqrt(30) //5.477225575051661
-sqrt([9, 16, 25]) // returns [3, 4, 5]
-```
-
-
-## square( a ) [_square_a]
-
-Calculates the square of a number. For arrays, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-
-**Returns**: `number` | `Array.`. The square of `a`. Returns an array with the the squares of each element if `a` is an array.
-
-**Example**
-
-```js
-square(-3) // returns 9
-square([3, 4, 5]) // returns [9, 16, 25]
-```
-
-
-## subtract( a, b ) [_subtract_a_b]
-
-Subtracts two numbers. If at least one array of numbers is passed into the function, the function will be applied index-wise to each element.
-
-| Param | Type | Description |
-| --- | --- | --- |
-| a | number | Array. | a number or an array of numbers |
-| b | number | Array. | a number or an array of numbers |
-
-**Returns**: `number` | `Array.`. The difference of `a` and `b` if both are numbers, or an array of differences applied index-wise to each element.
-
-**Throws**: `'Array length mismatch'` if `a` and `b` are arrays with different lengths
-
-**Example**
-
-```js
-subtract(6, 3) // returns 3
-subtract([10, 20, 30, 40], 10) // returns [0, 10, 20, 30]
-subtract(10, [1, 2, 5, 10]) // returns [9, 8, 5, 0]
-subtract([14, 42, 65, 108], [2, 7, 5, 12]) // returns [12, 35, 52, 96]
-```
-
-
-## sum( …args ) [_sum_args]
-
-Calculates the sum of one or more numbers/arrays passed into the function. If at least one array is passed, the function will sum up one or more numbers/arrays of numbers and distinct values of an array. Sum accepts arrays of different lengths.
-
-**Returns**: `number`. The sum of one or more numbers/arrays of numbers including distinct values in arrays
-
-**Example**
-
-```js
-sum(1, 2, 3) // returns 6
-sum([10, 20, 30, 40], 10, 20, 30) // returns 160
-sum([1, 2], 3, [4, 5], 6) // returns sum(1, 2, 3, 4, 5, 6) = 21
-sum([10, 20, 30, 40], 10, [1, 2, 3], 22) // returns sum(10, 20, 30, 40, 10, 1, 2, 3, 22) = 138
-```
-
-
-## unique( a ) [_unique_a]
-
-Counts the number of unique values in an array.
-
-**Returns**: `number`. The number of unique values in the array. Returns 1 if `a` is not an array.
-
-**Example**
-
-```js
-unique(100) // returns 1
-unique([]) // returns 0
-unique([1, 2, 3, 4]) // returns 4
-unique([1, 2, 3, 4, 2, 2, 2, 3, 4, 2, 4, 5, 2, 1, 4, 2]) // returns 5
-```
-
diff --git a/reference/data-analysis/observability/index.md b/reference/data-analysis/observability/index.md
deleted file mode 100644
index 1a76670c34..0000000000
--- a/reference/data-analysis/observability/index.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-mapped_pages:
- - https://www.elastic.co/guide/en/observability/current/metrics-reference.html
- - https://www.elastic.co/guide/en/serverless/current/observability-metrics-reference.html
-products:
- - id: observability
- - id: cloud-serverless
----
-
-# Metrics reference [metrics-reference]
-
-Learn about the key metrics displayed in the Infrastructure app and how they are calculated.
-
-* [Host metrics](/reference/data-analysis/observability/observability-host-metrics.md)
-* [Container metrics](/reference/data-analysis/observability/observability-container-metrics.md)
-* [Kubernetes pod metrics](/reference/data-analysis/observability/observability-kubernetes-pod-metrics.md)
-* [AWS metrics](/reference/data-analysis/observability/observability-aws-metrics.md)
-
-
-
-
-
diff --git a/reference/data-analysis/toc.yml b/reference/data-analysis/toc.yml
deleted file mode 100644
index a43f6ed396..0000000000
--- a/reference/data-analysis/toc.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-toc:
- - file: index.md
- - file: machine-learning/supplied-anomaly-detection-configurations.md
- children:
- - file: machine-learning/ootb-ml-jobs-apache.md
- - file: machine-learning/ootb-ml-jobs-apm.md
- - file: machine-learning/ootb-ml-jobs-auditbeat.md
- - file: machine-learning/ootb-ml-jobs-logs-ui.md
- - file: machine-learning/ootb-ml-jobs-metricbeat.md
- - file: machine-learning/ootb-ml-jobs-metrics-ui.md
- - file: machine-learning/ootb-ml-jobs-nginx.md
- - file: machine-learning/ootb-ml-jobs-siem.md
- - file: machine-learning/ootb-ml-jobs-uptime.md
- - file: machine-learning/machine-learning-functions.md
- children:
- - file: machine-learning/ml-count-functions.md
- - file: machine-learning/ml-geo-functions.md
- - file: machine-learning/ml-info-functions.md
- - file: machine-learning/ml-metric-functions.md
- - file: machine-learning/ml-rare-functions.md
- - file: machine-learning/ml-sum-functions.md
- - file: machine-learning/ml-time-functions.md
- - file: observability/index.md
- children:
- - file: observability/observability-host-metrics.md
- - file: observability/observability-container-metrics.md
- - file: observability/observability-kubernetes-pod-metrics.md
- - file: observability/observability-aws-metrics.md
- - file: kibana/canvas-functions.md
- children:
- - file: kibana/tinymath-functions.md
\ No newline at end of file
diff --git a/reference/index.md b/reference/index.md
index 304ee150bd..ba69d565ef 100644
--- a/reference/index.md
+++ b/reference/index.md
@@ -87,7 +87,7 @@ Standardize your data with ECS. Access logging libraries, field references, and
Unlock insights with powerful data analysis tools. Utilize text analysis components, aggregations, and function references to derive meaningful conclusions from your data.
-**Learn more in [Data analysis](data-analysis/index.md)**
+**Learn more in [Data analysis](machine-learning/index.md)**
## Search UI library
diff --git a/reference/machine-learning/index.md b/reference/machine-learning/index.md
new file mode 100644
index 0000000000..6aae9d6c72
--- /dev/null
+++ b/reference/machine-learning/index.md
@@ -0,0 +1,8 @@
+# Machine learning
+
+This section contains reference information for machine learning features, including:
+
+* [Supplied {{anomaly-detect}} configurations](/reference/machine-learning/supplied-anomaly-detection-configurations.md)
+* [Function reference for anomaly detection jobs](/reference/machine-learning/machine-learning-functions.md)
+
+Visit the [Explore and analyze](/explore-analyze/index.md) section to learn how to use the Elasticsearch platform to explore and analyze your data effectively.
diff --git a/reference/data-analysis/machine-learning/machine-learning-functions.md b/reference/machine-learning/machine-learning-functions.md
similarity index 78%
rename from reference/data-analysis/machine-learning/machine-learning-functions.md
rename to reference/machine-learning/machine-learning-functions.md
index 05abe94282..e1e124211a 100644
--- a/reference/data-analysis/machine-learning/machine-learning-functions.md
+++ b/reference/machine-learning/machine-learning-functions.md
@@ -18,10 +18,10 @@ You can specify a `summary_count_field_name` with any function except `metric`.
If your data is sparse, there may be gaps in the data which means you might have empty buckets. You might want to treat these as anomalies or you might want these gaps to be ignored. Your decision depends on your use case and what is important to you. It also depends on which functions you use. The `sum` and `count` functions are strongly affected by empty buckets. For this reason, there are `non_null_sum` and `non_zero_count` functions, which are tolerant to sparse data. These functions effectively ignore empty buckets.
-* [Count functions](/reference/data-analysis/machine-learning/ml-count-functions.md)
-* [Geographic functions](/reference/data-analysis/machine-learning/ml-geo-functions.md)
-* [Information content functions](/reference/data-analysis/machine-learning/ml-info-functions.md)
-* [Metric functions](/reference/data-analysis/machine-learning/ml-metric-functions.md)
-* [Rare functions](/reference/data-analysis/machine-learning/ml-rare-functions.md)
-* [Sum functions](/reference/data-analysis/machine-learning/ml-sum-functions.md)
-* [Time functions](/reference/data-analysis/machine-learning/ml-time-functions.md)
+* [Count functions](/reference/machine-learning/ml-count-functions.md)
+* [Geographic functions](/reference/machine-learning/ml-geo-functions.md)
+* [Information content functions](/reference/machine-learning/ml-info-functions.md)
+* [Metric functions](/reference/machine-learning/ml-metric-functions.md)
+* [Rare functions](/reference/machine-learning/ml-rare-functions.md)
+* [Sum functions](/reference/machine-learning/ml-sum-functions.md)
+* [Time functions](/reference/machine-learning/ml-time-functions.md)
diff --git a/reference/data-analysis/machine-learning/ml-count-functions.md b/reference/machine-learning/ml-count-functions.md
similarity index 96%
rename from reference/data-analysis/machine-learning/ml-count-functions.md
rename to reference/machine-learning/ml-count-functions.md
index 5855e1824c..9d44aa62cd 100644
--- a/reference/data-analysis/machine-learning/ml-count-functions.md
+++ b/reference/machine-learning/ml-count-functions.md
@@ -17,9 +17,9 @@ Use high-sided functions if you want to monitor unusually high event rates. Use
The {{ml-features}} include the following count functions:
-* [`count`, `high_count`, `low_count`](ml-count-functions.md#ml-count)
-* [`non_zero_count`, `high_non_zero_count`, `low_non_zero_count`](ml-count-functions.md#ml-nonzero-count)
-* [`distinct_count`, `high_distinct_count`, `low_distinct_count`](ml-count-functions.md#ml-distinct-count)
+* [`count`, `high_count`, `low_count`](../../machine-learning/machine-learning/ml-count-functions.md#ml-count)
+* [`non_zero_count`, `high_non_zero_count`, `low_non_zero_count`](../../machine-learning/machine-learning/ml-count-functions.md#ml-nonzero-count)
+* [`distinct_count`, `high_distinct_count`, `low_distinct_count`](../../machine-learning/machine-learning/ml-count-functions.md#ml-distinct-count)
## Count, high_count, low_count [ml-count]
diff --git a/reference/data-analysis/machine-learning/ml-geo-functions.md b/reference/machine-learning/ml-geo-functions.md
similarity index 100%
rename from reference/data-analysis/machine-learning/ml-geo-functions.md
rename to reference/machine-learning/ml-geo-functions.md
diff --git a/reference/data-analysis/machine-learning/ml-info-functions.md b/reference/machine-learning/ml-info-functions.md
similarity index 100%
rename from reference/data-analysis/machine-learning/ml-info-functions.md
rename to reference/machine-learning/ml-info-functions.md
diff --git a/reference/data-analysis/machine-learning/ml-metric-functions.md b/reference/machine-learning/ml-metric-functions.md
similarity index 93%
rename from reference/data-analysis/machine-learning/ml-metric-functions.md
rename to reference/machine-learning/ml-metric-functions.md
index ab273e1e59..ac982075b1 100644
--- a/reference/data-analysis/machine-learning/ml-metric-functions.md
+++ b/reference/machine-learning/ml-metric-functions.md
@@ -11,12 +11,12 @@ The metric functions include functions such as mean, min and max. These values a
The {{ml-features}} include the following metric functions:
-* [`min`](ml-metric-functions.md#ml-metric-min)
-* [`max`](ml-metric-functions.md#ml-metric-max)
-* [`median`, `high_median`, `low_median`](ml-metric-functions.md#ml-metric-median)
-* [`mean`, `high_mean`, `low_mean`](ml-metric-functions.md#ml-metric-mean)
-* [`metric`](ml-metric-functions.md#ml-metric-metric)
-* [`varp`, `high_varp`, `low_varp`](ml-metric-functions.md#ml-metric-varp)
+* [`min`](../../machine-learning/machine-learning/ml-metric-functions.md#ml-metric-min)
+* [`max`](../../machine-learning/machine-learning/ml-metric-functions.md#ml-metric-max)
+* [`median`, `high_median`, `low_median`](../../machine-learning/machine-learning/ml-metric-functions.md#ml-metric-median)
+* [`mean`, `high_mean`, `low_mean`](../../machine-learning/machine-learning/ml-metric-functions.md#ml-metric-mean)
+* [`metric`](../../machine-learning/machine-learning/ml-metric-functions.md#ml-metric-metric)
+* [`varp`, `high_varp`, `low_varp`](../../machine-learning/machine-learning/ml-metric-functions.md#ml-metric-varp)
::::{note}
You cannot add rules with conditions to detectors that use the `metric` function.
diff --git a/reference/data-analysis/machine-learning/ml-rare-functions.md b/reference/machine-learning/ml-rare-functions.md
similarity index 96%
rename from reference/data-analysis/machine-learning/ml-rare-functions.md
rename to reference/machine-learning/ml-rare-functions.md
index a5e5565775..37b597fe5a 100644
--- a/reference/data-analysis/machine-learning/ml-rare-functions.md
+++ b/reference/machine-learning/ml-rare-functions.md
@@ -23,8 +23,8 @@ The `rare` analysis detects anomalies according to the number of distinct rare v
The {{ml-features}} include the following rare functions:
-* [`rare`](ml-rare-functions.md#ml-rare)
-* [`freq_rare`](ml-rare-functions.md#ml-freq-rare)
+* [`rare`](../../machine-learning/machine-learning/ml-rare-functions.md#ml-rare)
+* [`freq_rare`](../../machine-learning/machine-learning/ml-rare-functions.md#ml-freq-rare)
## Rare [ml-rare]
diff --git a/reference/data-analysis/machine-learning/ml-sum-functions.md b/reference/machine-learning/ml-sum-functions.md
similarity index 93%
rename from reference/data-analysis/machine-learning/ml-sum-functions.md
rename to reference/machine-learning/ml-sum-functions.md
index 8a0f7afaec..30801deab8 100644
--- a/reference/data-analysis/machine-learning/ml-sum-functions.md
+++ b/reference/machine-learning/ml-sum-functions.md
@@ -17,8 +17,8 @@ If your data is sparse, use `non_null_sum` functions. Buckets without values are
The {{ml-features}} include the following sum functions:
-* [`sum`, `high_sum`, `low_sum`](ml-sum-functions.md#ml-sum)
-* [`non_null_sum`, `high_non_null_sum`, `low_non_null_sum`](ml-sum-functions.md#ml-nonnull-sum)
+* [`sum`, `high_sum`, `low_sum`](../../machine-learning/machine-learning/ml-sum-functions.md#ml-sum)
+* [`non_null_sum`, `high_non_null_sum`, `low_non_null_sum`](../../machine-learning/machine-learning/ml-sum-functions.md#ml-nonnull-sum)
## Sum, high_sum, low_sum [ml-sum]
diff --git a/reference/data-analysis/machine-learning/ml-time-functions.md b/reference/machine-learning/ml-time-functions.md
similarity index 95%
rename from reference/data-analysis/machine-learning/ml-time-functions.md
rename to reference/machine-learning/ml-time-functions.md
index 283d3d6932..1cb76f75aa 100644
--- a/reference/data-analysis/machine-learning/ml-time-functions.md
+++ b/reference/machine-learning/ml-time-functions.md
@@ -11,8 +11,8 @@ The time functions detect events that happen at unusual times, either of the day
The {{ml-features}} include the following time functions:
-* [`time_of_day`](ml-time-functions.md#ml-time-of-day)
-* [`time_of_week`](ml-time-functions.md#ml-time-of-week)
+* [`time_of_day`](../../machine-learning/machine-learning/ml-time-functions.md#ml-time-of-day)
+* [`time_of_week`](../../machine-learning/machine-learning/ml-time-functions.md#ml-time-of-week)
::::{note}
diff --git a/reference/data-analysis/machine-learning/ootb-ml-jobs-apache.md b/reference/machine-learning/ootb-ml-jobs-apache.md
similarity index 97%
rename from reference/data-analysis/machine-learning/ootb-ml-jobs-apache.md
rename to reference/machine-learning/ootb-ml-jobs-apache.md
index 56bad172f8..b3c7e83e62 100644
--- a/reference/data-analysis/machine-learning/ootb-ml-jobs-apache.md
+++ b/reference/machine-learning/ootb-ml-jobs-apache.md
@@ -27,7 +27,7 @@ For more details, see the {{dfeed}} and job definitions in [GitHub](https://gith
## Apache access logs ({{filebeat}}) [apache-access-logs-filebeat]
-These legacy {{anomaly-jobs}} find unusual activity in HTTP access logs. For the latest versions, install the Apache integration in {{fleet}}; see [Apache access logs](ootb-ml-jobs-apache.md#apache-access-logs).
+These legacy {{anomaly-jobs}} find unusual activity in HTTP access logs. For the latest versions, install the Apache integration in {{fleet}}; see [Apache access logs](../../machine-learning/machine-learning/ootb-ml-jobs-apache.md#apache-access-logs).
For more details, see the {{dfeed}} and job definitions in [GitHub](https://github.com/elastic/kibana/tree/master/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/apache_ecs/ml).
diff --git a/reference/data-analysis/machine-learning/ootb-ml-jobs-apm.md b/reference/machine-learning/ootb-ml-jobs-apm.md
similarity index 100%
rename from reference/data-analysis/machine-learning/ootb-ml-jobs-apm.md
rename to reference/machine-learning/ootb-ml-jobs-apm.md
diff --git a/reference/data-analysis/machine-learning/ootb-ml-jobs-auditbeat.md b/reference/machine-learning/ootb-ml-jobs-auditbeat.md
similarity index 100%
rename from reference/data-analysis/machine-learning/ootb-ml-jobs-auditbeat.md
rename to reference/machine-learning/ootb-ml-jobs-auditbeat.md
diff --git a/reference/data-analysis/machine-learning/ootb-ml-jobs-logs-ui.md b/reference/machine-learning/ootb-ml-jobs-logs-ui.md
similarity index 100%
rename from reference/data-analysis/machine-learning/ootb-ml-jobs-logs-ui.md
rename to reference/machine-learning/ootb-ml-jobs-logs-ui.md
diff --git a/reference/data-analysis/machine-learning/ootb-ml-jobs-metricbeat.md b/reference/machine-learning/ootb-ml-jobs-metricbeat.md
similarity index 100%
rename from reference/data-analysis/machine-learning/ootb-ml-jobs-metricbeat.md
rename to reference/machine-learning/ootb-ml-jobs-metricbeat.md
diff --git a/reference/data-analysis/machine-learning/ootb-ml-jobs-metrics-ui.md b/reference/machine-learning/ootb-ml-jobs-metrics-ui.md
similarity index 100%
rename from reference/data-analysis/machine-learning/ootb-ml-jobs-metrics-ui.md
rename to reference/machine-learning/ootb-ml-jobs-metrics-ui.md
diff --git a/reference/data-analysis/machine-learning/ootb-ml-jobs-nginx.md b/reference/machine-learning/ootb-ml-jobs-nginx.md
similarity index 97%
rename from reference/data-analysis/machine-learning/ootb-ml-jobs-nginx.md
rename to reference/machine-learning/ootb-ml-jobs-nginx.md
index 5a24587be5..b1c408ef5c 100644
--- a/reference/data-analysis/machine-learning/ootb-ml-jobs-nginx.md
+++ b/reference/machine-learning/ootb-ml-jobs-nginx.md
@@ -27,7 +27,7 @@ These jobs are available in {{kib}} only if data exists that matches the query s
## Nginx access logs ({{filebeat}}) [nginx-access-logs-filebeat]
-These legacy {{anomaly-jobs}} find unusual activity in HTTP access logs. For the latest versions, install the Nginx integration in {{fleet}}; see [Nginx access logs](ootb-ml-jobs-nginx.md#nginx-access-logs).
+These legacy {{anomaly-jobs}} find unusual activity in HTTP access logs. For the latest versions, install the Nginx integration in {{fleet}}; see [Nginx access logs](../../machine-learning/machine-learning/ootb-ml-jobs-nginx.md#nginx-access-logs).
These jobs exist in {{kib}} only if data exists that matches the recognizer query specified in the [manifest file](https://github.com/elastic/kibana/blob/master/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/nginx_ecs/manifest.json).
diff --git a/reference/data-analysis/machine-learning/ootb-ml-jobs-siem.md b/reference/machine-learning/ootb-ml-jobs-siem.md
similarity index 100%
rename from reference/data-analysis/machine-learning/ootb-ml-jobs-siem.md
rename to reference/machine-learning/ootb-ml-jobs-siem.md
diff --git a/reference/data-analysis/machine-learning/ootb-ml-jobs-uptime.md b/reference/machine-learning/ootb-ml-jobs-uptime.md
similarity index 100%
rename from reference/data-analysis/machine-learning/ootb-ml-jobs-uptime.md
rename to reference/machine-learning/ootb-ml-jobs-uptime.md
diff --git a/reference/data-analysis/machine-learning/supplied-anomaly-detection-configurations.md b/reference/machine-learning/supplied-anomaly-detection-configurations.md
similarity index 64%
rename from reference/data-analysis/machine-learning/supplied-anomaly-detection-configurations.md
rename to reference/machine-learning/supplied-anomaly-detection-configurations.md
index b43561bef1..14295b4c1c 100644
--- a/reference/data-analysis/machine-learning/supplied-anomaly-detection-configurations.md
+++ b/reference/machine-learning/supplied-anomaly-detection-configurations.md
@@ -1,25 +1,25 @@
---
-navigation_title: Supplied configurations
+navigation_title: Kibana anomaly detection job wizards
mapped_pages:
- https://www.elastic.co/guide/en/machine-learning/current/ootb-ml-jobs.html
products:
- id: machine-learning
---
-# Supplied {{anomaly-detect}} configurations [ootb-ml-jobs]
+# {{kib}} {{anomaly-detect}} job wizards [ootb-ml-jobs]
{{anomaly-jobs-cap}} contain the configuration information and metadata necessary to perform an analytics task. {{kib}} can recognize certain types of data and provide specialized wizards for that context. This page lists the categories of the {{anomaly-jobs}} that are ready to use via {{kib}} in **Machine learning**. Refer to [Create {{anomaly-jobs}}](/explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs.md) to learn more about creating a job by using supplied configurations. Logs and Metrics supplied configurations are available and can be created via the related solution UI in {{kib}}.
-* [Apache](/reference/data-analysis/machine-learning/ootb-ml-jobs-apache.md)
-* [APM](/reference/data-analysis/machine-learning/ootb-ml-jobs-apm.md)
-* [{{auditbeat}}](/reference/data-analysis/machine-learning/ootb-ml-jobs-auditbeat.md)
-* [Logs](/reference/data-analysis/machine-learning/ootb-ml-jobs-logs-ui.md)
-* [{{metricbeat}}](/reference/data-analysis/machine-learning/ootb-ml-jobs-metricbeat.md)
-* [Metrics](/reference/data-analysis/machine-learning/ootb-ml-jobs-metrics-ui.md)
-* [Nginx](/reference/data-analysis/machine-learning/ootb-ml-jobs-nginx.md)
-* [Security](/reference/data-analysis/machine-learning/ootb-ml-jobs-siem.md)
-* [Uptime](/reference/data-analysis/machine-learning/ootb-ml-jobs-uptime.md)
+* [Apache](/reference/machine-learning/ootb-ml-jobs-apache.md)
+* [APM](/reference/machine-learning/ootb-ml-jobs-apm.md)
+* [{{auditbeat}}](/reference/machine-learning/ootb-ml-jobs-auditbeat.md)
+* [Logs](/reference/machine-learning/ootb-ml-jobs-logs-ui.md)
+* [{{metricbeat}}](/reference/machine-learning/ootb-ml-jobs-metricbeat.md)
+* [Metrics](/reference/machine-learning/ootb-ml-jobs-metrics-ui.md)
+* [Nginx](/reference/machine-learning/ootb-ml-jobs-nginx.md)
+* [Security](/reference/machine-learning/ootb-ml-jobs-siem.md)
+* [Uptime](/reference/machine-learning/ootb-ml-jobs-uptime.md)
::::{note}
The configurations are only available if data exists that matches the queries specified in the manifest files. These recognizer queries are linked in the descriptions of the individual configurations.
diff --git a/reference/machine-learning/toc.yml b/reference/machine-learning/toc.yml
new file mode 100644
index 0000000000..ad0cd4d23a
--- /dev/null
+++ b/reference/machine-learning/toc.yml
@@ -0,0 +1,22 @@
+toc:
+ - file: index.md
+ - file: supplied-anomaly-detection-configurations.md
+ children:
+ - file: ootb-ml-jobs-apache.md
+ - file: ootb-ml-jobs-apm.md
+ - file: ootb-ml-jobs-auditbeat.md
+ - file: ootb-ml-jobs-logs-ui.md
+ - file: ootb-ml-jobs-metricbeat.md
+ - file: ootb-ml-jobs-metrics-ui.md
+ - file: ootb-ml-jobs-nginx.md
+ - file: ootb-ml-jobs-siem.md
+ - file: ootb-ml-jobs-uptime.md
+ - file: machine-learning-functions.md
+ children:
+ - file: ml-count-functions.md
+ - file: ml-geo-functions.md
+ - file: ml-info-functions.md
+ - file: ml-metric-functions.md
+ - file: ml-rare-functions.md
+ - file: ml-sum-functions.md
+ - file: ml-time-functions.md
\ No newline at end of file
diff --git a/reference/observability/metrics-reference.md b/reference/observability/metrics-reference.md
new file mode 100644
index 0000000000..d90da0506a
--- /dev/null
+++ b/reference/observability/metrics-reference.md
@@ -0,0 +1,22 @@
+---
+mapped_pages:
+ - https://www.elastic.co/guide/en/observability/current/metrics-reference.html
+ - https://www.elastic.co/guide/en/serverless/current/observability-metrics-reference.html
+products:
+ - id: observability
+ - id: cloud-serverless
+---
+
+# Infrastructure metrics reference [metrics-reference]
+
+Learn about the key metrics displayed in the [Infrastructure app](/solutions/observability/apm/infrastructure.md) and how they are calculated.
+
+* [Host metrics](/reference/observability/observability-host-metrics.md)
+* [Container metrics](/reference/observability/observability-container-metrics.md)
+* [Kubernetes pod metrics](/reference/observability/observability-kubernetes-pod-metrics.md)
+* [AWS metrics](/reference/observability/observability-aws-metrics.md)
+
+
+
+
+
diff --git a/reference/data-analysis/observability/observability-aws-metrics.md b/reference/observability/observability-aws-metrics.md
similarity index 100%
rename from reference/data-analysis/observability/observability-aws-metrics.md
rename to reference/observability/observability-aws-metrics.md
diff --git a/reference/data-analysis/observability/observability-container-metrics.md b/reference/observability/observability-container-metrics.md
similarity index 100%
rename from reference/data-analysis/observability/observability-container-metrics.md
rename to reference/observability/observability-container-metrics.md
diff --git a/reference/data-analysis/observability/observability-host-metrics.md b/reference/observability/observability-host-metrics.md
similarity index 100%
rename from reference/data-analysis/observability/observability-host-metrics.md
rename to reference/observability/observability-host-metrics.md
diff --git a/reference/data-analysis/observability/observability-kubernetes-pod-metrics.md b/reference/observability/observability-kubernetes-pod-metrics.md
similarity index 100%
rename from reference/data-analysis/observability/observability-kubernetes-pod-metrics.md
rename to reference/observability/observability-kubernetes-pod-metrics.md
diff --git a/reference/observability/toc.yml b/reference/observability/toc.yml
index c728690f3c..c0a157ad81 100644
--- a/reference/observability/toc.yml
+++ b/reference/observability/toc.yml
@@ -1,3 +1,9 @@
toc:
- file: index.md
- - file: fields-and-object-schemas.md
\ No newline at end of file
+ - file: fields-and-object-schemas.md
+ - file: metrics-reference.md
+ children:
+ - file: observability-host-metrics.md
+ - file: observability-container-metrics.md
+ - file: observability-kubernetes-pod-metrics.md
+ - file: observability-aws-metrics.md
\ No newline at end of file
diff --git a/reference/toc.yml b/reference/toc.yml
index f628472577..ff9b38de23 100644
--- a/reference/toc.yml
+++ b/reference/toc.yml
@@ -9,6 +9,6 @@ toc:
- toc: apm
# The next one should be child of ☝️
- toc: apm-agents
- - toc: data-analysis
+ - toc: machine-learning
- toc: glossary
diff --git a/solutions/observability/infra-and-hosts.md b/solutions/observability/infra-and-hosts.md
index bb4f2f8559..fdf0ad0392 100644
--- a/solutions/observability/infra-and-hosts.md
+++ b/solutions/observability/infra-and-hosts.md
@@ -24,4 +24,4 @@ Explore the topics in this section to learn how to observe and monitor hosts and
| [Tutorial: Observe your Kubernetes deployments](/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md) | Observe all layers of your application, including the orchestration software itself. |
| [Tutorial: Observe your nginx instances](/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md) | Collect valuable metrics and logs from your nginx instances. |
| [Troubleshooting](/troubleshoot/observability/troubleshooting-infrastructure-monitoring.md) | Troubleshoot common issues on your own or ask for help. |
-| [Metrics reference](/reference/data-analysis/observability/index.md) | Learn about the key metrics displayed in the Infrastructure UI and how they are calculated. |
\ No newline at end of file
+| [Metrics reference](/reference/observability/metrics-reference.md) | Learn about the key metrics displayed in the Infrastructure UI and how they are calculated. |
\ No newline at end of file
diff --git a/solutions/observability/infra-and-hosts/analyze-compare-hosts.md b/solutions/observability/infra-and-hosts/analyze-compare-hosts.md
index 114d1c25a7..1658716995 100644
--- a/solutions/observability/infra-and-hosts/analyze-compare-hosts.md
+++ b/solutions/observability/infra-and-hosts/analyze-compare-hosts.md
@@ -31,7 +31,7 @@ To access the **Hosts** page in:
:screenshot:
:::
-To learn more about the metrics shown on this page, refer to the [Metrics reference](/reference/data-analysis/observability/index.md) documentation.
+To learn more about the metrics shown on this page, refer to the [Metrics reference](/reference/observability/metrics-reference.md) documentation.
::::{note}
**Don’t see any metrics?**
@@ -171,7 +171,7 @@ Without leaving the **Hosts** page, you can view enhanced metrics relating to ea
{applies_to}`{stack: "ga 9.2", serverless: "ga"}` The host details overlay adapts according to the [selected schema](#host-schema-selector). When viewing host data collected using OpenTelemetry, you see the following differences:
* Anomaly detection isn't available for OpenTelemetry hosts, so there is no **Anomalies** tab.
-* The Lens charts use the [OpenTelemetry field calculation formulas](/reference/data-analysis/observability/observability-host-metrics.md#open-telemetry-host-metrics).
+* The Lens charts use the [OpenTelemetry field calculation formulas](/reference/observability/observability-host-metrics.md#open-telemetry-host-metrics).
::::{tip}
To expand the overlay and view more detail, click **Open as page** in the upper-right corner.
diff --git a/solutions/observability/infra-and-hosts/analyze-infrastructure-host-metrics.md b/solutions/observability/infra-and-hosts/analyze-infrastructure-host-metrics.md
index 9633424357..b62427afde 100644
--- a/solutions/observability/infra-and-hosts/analyze-infrastructure-host-metrics.md
+++ b/solutions/observability/infra-and-hosts/analyze-infrastructure-host-metrics.md
@@ -23,7 +23,7 @@ For more information, refer to the following links:
* [Analyze and compare hosts](/solutions/observability/infra-and-hosts/analyze-compare-hosts.md): Use the **Hosts** page to get a metrics-driven view of your infrastructure backed by an easy-to-use interface called Lens.
* [Detect metric anomalies](/solutions/observability/infra-and-hosts/detect-metric-anomalies.md): Detect and inspect memory usage and network traffic anomalies for hosts and Kubernetes pods.
* [](/solutions/observability/infra-and-hosts/configure-settings.md): Learn how to configure infrastructure UI settings.
-* [Metrics reference](/reference/data-analysis/observability/index.md): Learn about key metrics used for infrastructure monitoring.
+* [Metrics reference](/reference/observability/metrics-reference.md): Learn about key metrics used for infrastructure monitoring.
* [Infrastructure app fields](/reference/observability/fields-and-object-schemas.md): Learn about the fields required to display data in the Infrastructure UI.
By default, the Infrastructure UI displays metrics from {{es}} indices that match the `metrics-*` and `metricbeat-*` index patterns. To learn how to change this behavior, refer to [Configure settings](/solutions/observability/infra-and-hosts/configure-settings.md).
\ No newline at end of file
diff --git a/solutions/observability/infra-and-hosts/explore-infrastructure-metrics-over-time.md b/solutions/observability/infra-and-hosts/explore-infrastructure-metrics-over-time.md
index 5ece3441d3..5acdfe8df4 100644
--- a/solutions/observability/infra-and-hosts/explore-infrastructure-metrics-over-time.md
+++ b/solutions/observability/infra-and-hosts/explore-infrastructure-metrics-over-time.md
@@ -20,7 +20,7 @@ To open **Metrics Explorer**, find **Infrastructure** in the main menu or use th
:screenshot:
:::
-To learn more about the metrics shown on this page, refer to the [Metrics reference](/reference/data-analysis/observability/index.md) documentation.
+To learn more about the metrics shown on this page, refer to the [Metrics reference](/reference/observability/metrics-reference.md) documentation.
::::{tip}
If there are no metrics to display, {{kib}} prompts you to add a metrics integration. Click **Add a metrics integration** to get started. If you want to add more data in the future, click **Add data** from any page in the {{infrastructure-app}}.
diff --git a/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md b/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md
index 041593c11c..ccae44eb5e 100644
--- a/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md
+++ b/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md
@@ -255,19 +255,19 @@ The nginx ML module provides the following anomaly detection jobs:
$$$horizontal$$$
Low request rates (`low_request_rate_nginx`)
-: Uses the [`low_count`](/reference/data-analysis/machine-learning/ml-count-functions.md#ml-count) function to detect abnormally low request rates. Abnormally low request rates might indicate that network issues or other issues are preventing requests from reaching the server.
+: Uses the [`low_count`](/reference/machine-learning/ml-count-functions.md#ml-count) function to detect abnormally low request rates. Abnormally low request rates might indicate that network issues or other issues are preventing requests from reaching the server.
Unusual source IPs - high request rates (`source_ip_request_rate_nginx`)
-: Uses the [`hight_count`](/reference/data-analysis/machine-learning/ml-count-functions.md#ml-count) function to detect abnormally high request rates from individual IP addresses. Many requests from a single IP or small group of IPs might indicate something malicious like a distributed denial of service (DDoS) attack where a large number of requests are sent to overwhelm the server and make it unavailable to users.
+: Uses the [`hight_count`](/reference/machine-learning/ml-count-functions.md#ml-count) function to detect abnormally high request rates from individual IP addresses. Many requests from a single IP or small group of IPs might indicate something malicious like a distributed denial of service (DDoS) attack where a large number of requests are sent to overwhelm the server and make it unavailable to users.
Unusual source IPs - high distinct count of URLs (`source_ip_url_count_nginx`)
-: Uses the [`high_distinct_count`](/reference/data-analysis/machine-learning/ml-count-functions.md#ml-distinct-count) function to detect individual IP addresses accessing abnormally high numbers of unique URLs. A single IP accessing many unique URLs might indicate something malicious like web scraping or an attempt to find sensitive data or vulnerabilities.
+: Uses the [`high_distinct_count`](/reference/machine-learning/ml-count-functions.md#ml-distinct-count) function to detect individual IP addresses accessing abnormally high numbers of unique URLs. A single IP accessing many unique URLs might indicate something malicious like web scraping or an attempt to find sensitive data or vulnerabilities.
Unusual status code rates (`status_code_rate_nginx`)
-: Uses the [`count`](/reference/data-analysis/machine-learning/ml-count-functions.md#ml-count) function to detect abnormal error status code rates. A high rate of status codes could indicate problems with broken links, bad URLs, or unauthorized access attempts. A high rate of status codes could also point to server issues like limited resources or bugs in your code.
+: Uses the [`count`](/reference/machine-learning/ml-count-functions.md#ml-count) function to detect abnormal error status code rates. A high rate of status codes could indicate problems with broken links, bad URLs, or unauthorized access attempts. A high rate of status codes could also point to server issues like limited resources or bugs in your code.
Unusual visitor rates (`visitor_rate_nginx`)
-: Uses the [`non_zero_count`](/reference/data-analysis/machine-learning/ml-count-functions.md#ml-nonzero-count) function to detect abnormal visitor rates. High visitor rates could indicate something malicious like a DDoS attack. Low visitor rates could indicate issues with access to the server.
+: Uses the [`non_zero_count`](/reference/machine-learning/ml-count-functions.md#ml-nonzero-count) function to detect abnormal visitor rates. High visitor rates could indicate something malicious like a DDoS attack. Low visitor rates could indicate issues with access to the server.
::::{note}
These anomaly detection jobs are available when you have data that matches the query specified in the ML module manifest. Users not following this tutorial can refer to [nginx integration ML modules](https://docs.elastic.co/en/integrations/nginx#ml-modules) for more about the ML module manifest.
diff --git a/solutions/observability/infra-and-hosts/understanding-no-results-found-message.md b/solutions/observability/infra-and-hosts/understanding-no-results-found-message.md
index f7c09613c8..c7fcfa6ac2 100644
--- a/solutions/observability/infra-and-hosts/understanding-no-results-found-message.md
+++ b/solutions/observability/infra-and-hosts/understanding-no-results-found-message.md
@@ -11,7 +11,7 @@ products:
# Understanding "no results found" message [observability-handle-no-results-found-message]
-To correctly render visualizations in the Observability UI, all metrics used by the UI must be present in the collected data. For a description of these metrics, refer to [Metrics reference](/reference/data-analysis/observability/index.md).
+To correctly render visualizations in the Observability UI, all metrics used by the UI must be present in the collected data. For a description of these metrics, refer to [Metrics reference](/reference/observability/metrics-reference.md).
There are several reasons why metrics might be missing from the collected data:
diff --git a/solutions/observability/infra-and-hosts/view-infrastructure-metrics-by-resource-type.md b/solutions/observability/infra-and-hosts/view-infrastructure-metrics-by-resource-type.md
index 82f745ab1f..bfce569ea2 100644
--- a/solutions/observability/infra-and-hosts/view-infrastructure-metrics-by-resource-type.md
+++ b/solutions/observability/infra-and-hosts/view-infrastructure-metrics-by-resource-type.md
@@ -23,7 +23,7 @@ To open the **Infrastructure inventory** page in:
:screenshot:
:::
-To learn more about the metrics shown on this page, refer to the [Metrics reference](/reference/data-analysis/observability/index.md).
+To learn more about the metrics shown on this page, refer to the [Metrics reference](/reference/observability/metrics-reference.md).
::::{note}
**Don’t see any metrics?**
diff --git a/solutions/security/advanced-entity-analytics/anomaly-detection.md b/solutions/security/advanced-entity-analytics/anomaly-detection.md
index a39794600e..924bde4806 100644
--- a/solutions/security/advanced-entity-analytics/anomaly-detection.md
+++ b/solutions/security/advanced-entity-analytics/anomaly-detection.md
@@ -75,7 +75,7 @@ Or
* You install one or more of the [Advanced Analytics integrations](/solutions/security/advanced-entity-analytics/behavioral-detection-use-cases.md#ml-integrations).
-[](/reference/data-analysis/machine-learning/ootb-ml-jobs-siem.md) describes all available {{ml}} jobs and lists their requirements. For information on tuning anomaly results to reduce the number of false positives, see [Optimizing anomaly results](/solutions/security/advanced-entity-analytics/optimizing-anomaly-results.md).
+[](/reference/machine-learning/ootb-ml-jobs-siem.md) describes all available {{ml}} jobs and lists their requirements. For information on tuning anomaly results to reduce the number of false positives, see [Optimizing anomaly results](/solutions/security/advanced-entity-analytics/optimizing-anomaly-results.md).
::::{note}
Machine learning jobs look back and analyze two weeks of historical data prior to the time they are enabled. After jobs are enabled, they continuously analyze incoming data. When jobs are stopped and restarted within the two-week time frame, previously analyzed data is not processed again.
diff --git a/solutions/security/advanced-entity-analytics/behavioral-detection-use-cases.md b/solutions/security/advanced-entity-analytics/behavioral-detection-use-cases.md
index 6db629068d..13cbe6c9b4 100644
--- a/solutions/security/advanced-entity-analytics/behavioral-detection-use-cases.md
+++ b/solutions/security/advanced-entity-analytics/behavioral-detection-use-cases.md
@@ -39,5 +39,5 @@ Here’s a list of integrations for various behavioral detection use cases:
* [Living off the Land Attack Detection](https://docs.elastic.co/en/integrations/problemchild)
* [Network Beaconing Identification](https://docs.elastic.co/en/integrations/beaconing)
-To learn more about {{ml}} jobs enabled by these integrations, refer to [](/reference/data-analysis/machine-learning/ootb-ml-jobs-siem.md).
+To learn more about {{ml}} jobs enabled by these integrations, refer to [](/reference/machine-learning/ootb-ml-jobs-siem.md).
diff --git a/solutions/security/advanced-entity-analytics/overview.md b/solutions/security/advanced-entity-analytics/overview.md
index 1e794d4ebf..681b21d690 100644
--- a/solutions/security/advanced-entity-analytics/overview.md
+++ b/solutions/security/advanced-entity-analytics/overview.md
@@ -155,7 +155,7 @@ Interact with the table to filter data and view more details:
Anomaly detection jobs identify suspicious or irregular behavior patterns. The **Anomalies** table displays the total number of anomalies identified by these prebuilt {{ml}} jobs (named in the **Anomaly name** column).
:::{admonition} Requirements
-To display anomaly results, you must [install and run](/explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs.md) one or more [prebuilt anomaly detection jobs](/reference/data-analysis/machine-learning/ootb-ml-jobs-siem.md). You cannot add custom anomaly detection jobs to the **Entity analytics** page.
+To display anomaly results, you must [install and run](/explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs.md) one or more [prebuilt anomaly detection jobs](/reference/machine-learning/ootb-ml-jobs-siem.md). You cannot add custom anomaly detection jobs to the **Entity analytics** page.
:::
diff --git a/solutions/security/dashboards/entity-analytics-dashboard.md b/solutions/security/dashboards/entity-analytics-dashboard.md
index c2aea79785..1f78f890a5 100644
--- a/solutions/security/dashboards/entity-analytics-dashboard.md
+++ b/solutions/security/dashboards/entity-analytics-dashboard.md
@@ -155,7 +155,7 @@ Interact with the table to filter data and view more details:
Anomaly detection jobs identify suspicious or irregular behavior patterns. The Anomalies table displays the total number of anomalies identified by these prebuilt {{ml}} jobs (named in the **Anomaly name** column).
::::{admonition} Requirements
-To display anomaly results, you must [install and run](/explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs.md) one or more [prebuilt anomaly detection jobs](/reference/data-analysis/machine-learning/ootb-ml-jobs-siem.md). You cannot add custom anomaly detection jobs to the Entity Analytics dashboard.
+To display anomaly results, you must [install and run](/explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs.md) one or more [prebuilt anomaly detection jobs](/reference/machine-learning/ootb-ml-jobs-siem.md). You cannot add custom anomaly detection jobs to the Entity Analytics dashboard.
::::
diff --git a/troubleshoot/observability/troubleshooting-infrastructure-monitoring/understanding-no-results-found-message.md b/troubleshoot/observability/troubleshooting-infrastructure-monitoring/understanding-no-results-found-message.md
index 5fd2e53511..a9d4f2a082 100644
--- a/troubleshoot/observability/troubleshooting-infrastructure-monitoring/understanding-no-results-found-message.md
+++ b/troubleshoot/observability/troubleshooting-infrastructure-monitoring/understanding-no-results-found-message.md
@@ -13,7 +13,7 @@ products:
# Understand "no results found" message [handle-no-results-found-message]
-To correctly render visualizations in the {{observability}} UI, all metrics used by the UI must be present in the collected data. For a description of these metrics, refer to [Metrics reference](/reference/data-analysis/observability/index.md).
+To correctly render visualizations in the {{observability}} UI, all metrics used by the UI must be present in the collected data. For a description of these metrics, refer to [Metrics reference](/reference/observability/metrics-reference.md).
There are several reasons why metrics might be missing from the collected data:
From 7b4fc38530e8af731b29f8b4cf4e57705caa20d6 Mon Sep 17 00:00:00 2001
From: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
Date: Thu, 16 Oct 2025 18:39:45 +0200
Subject: [PATCH 2/6] fix links and paths
---
.../ml-configuring-aggregation.md | 4 +--
.../ml-configuring-categories.md | 2 +-
.../anomaly-detection/ml-functions.md | 12 ++++----
.../anomaly-detection/ml-getting-started.md | 2 +-
.../anomaly-detection/ml-limitations.md | 28 +++++++++----------
.../anomaly-detection/ootb-ml-jobs.md | 16 +++++------
reference/data-analysis/index.md | 4 +--
.../machine-learning/ml-count-functions.md | 6 ++--
.../machine-learning/ml-metric-functions.md | 12 ++++----
.../machine-learning/ml-rare-functions.md | 4 +--
.../machine-learning/ml-sum-functions.md | 4 +--
.../machine-learning/ml-time-functions.md | 4 +--
.../machine-learning/ootb-ml-jobs-apache.md | 2 +-
.../machine-learning/ootb-ml-jobs-nginx.md | 2 +-
14 files changed, 51 insertions(+), 51 deletions(-)
diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-configuring-aggregation.md b/explore-analyze/machine-learning/anomaly-detection/ml-configuring-aggregation.md
index 446c6b3cc5..a66a5475c1 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ml-configuring-aggregation.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ml-configuring-aggregation.md
@@ -40,8 +40,8 @@ There are a number of requirements for using aggregations in {{dfeeds}}.
## Recommendations [aggs-recommendations-dfeeds]
-* When your detectors use [metric](/reference/data-analysis/machine-learning/ml-metric-functions.md) or [sum](/reference/data-analysis/machine-learning/ml-sum-functions.md) analytical functions, it’s recommended to set the `date_histogram` or `composite` aggregation interval to a tenth of the bucket span. This creates finer, more granular time buckets, which are ideal for this type of analysis.
-* When your detectors use [count](/reference/data-analysis/machine-learning/ml-count-functions.md) or [rare](/reference/machine-learning/ml-rare-functions.md) functions, set the interval to the same value as the bucket span.
+* When your detectors use [metric](/reference/machine-learning/ml-metric-functions.md) or [sum](/reference/machine-learning/ml-sum-functions.md) analytical functions, it’s recommended to set the `date_histogram` or `composite` aggregation interval to a tenth of the bucket span. This creates finer, more granular time buckets, which are ideal for this type of analysis.
+* When your detectors use [count](/reference/machine-learning/ml-count-functions.md) or [rare](/reference/machine-learning/ml-rare-functions.md) functions, set the interval to the same value as the bucket span.
* If you have multiple influencers or partition fields or if your field cardinality is more than 1000, use [composite aggregations](elasticsearch://reference/aggregations/search-aggregations-bucket-composite-aggregation.md).
To determine the cardinality of your data, you can run searches such as:
diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-configuring-categories.md b/explore-analyze/machine-learning/anomaly-detection/ml-configuring-categories.md
index 3cc5a3a9ec..9b8023f1e2 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ml-configuring-categories.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ml-configuring-categories.md
@@ -10,7 +10,7 @@ products:
# Detecting anomalous categories of data [ml-configuring-categories]
-Categorization is a {{ml}} process that tokenizes a text field, clusters similar data together, and classifies it into categories. It works best on machine-written messages and application output that typically consist of repeated elements. [Categorization jobs](ml-anomaly-detection-job-types.md#categorization-jobs) enable you to find anomalous behavior in your categorized data. Categorization is not natural language processing (NLP). When you create a categorization {{anomaly-job}}, the {{ml}} model learns what volume and pattern is normal for each category over time. You can then detect anomalies and surface rare events or unusual types of messages by using [count](/reference/data-analysis/machine-learning/ml-count-functions.md) or [rare](/reference/machine-learning/ml-rare-functions.md) functions. Categorization works well on finite set of possible messages, for example:
+Categorization is a {{ml}} process that tokenizes a text field, clusters similar data together, and classifies it into categories. It works best on machine-written messages and application output that typically consist of repeated elements. [Categorization jobs](ml-anomaly-detection-job-types.md#categorization-jobs) enable you to find anomalous behavior in your categorized data. Categorization is not natural language processing (NLP). When you create a categorization {{anomaly-job}}, the {{ml}} model learns what volume and pattern is normal for each category over time. You can then detect anomalies and surface rare events or unusual types of messages by using [count](/reference/machine-learning/ml-count-functions.md) or [rare](/reference/machine-learning/ml-rare-functions.md) functions. Categorization works well on finite set of possible messages, for example:
```js
{"@timestamp":1549596476000,
diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-functions.md b/explore-analyze/machine-learning/anomaly-detection/ml-functions.md
index 797fa2bc6a..fef8cb4925 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ml-functions.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ml-functions.md
@@ -21,10 +21,10 @@ You can specify a `summary_count_field_name` with any function except `metric`.
If your data is sparse, there may be gaps in the data which means you might have empty buckets. You might want to treat these as anomalies or you might want these gaps to be ignored. Your decision depends on your use case and what is important to you. It also depends on which functions you use. The `sum` and `count` functions are strongly affected by empty buckets. For this reason, there are `non_null_sum` and `non_zero_count` functions, which are tolerant to sparse data. These functions effectively ignore empty buckets.
-* [Count functions](/reference/data-analysis/machine-learning/ml-count-functions.md)
-* [Geographic functions](/reference/data-analysis/machine-learning/ml-geo-functions.md)
-* [Information content functions](/reference/data-analysis/machine-learning/ml-info-functions.md)
-* [Metric functions](/reference/data-analysis/machine-learning/ml-metric-functions.md)
+* [Count functions](/reference/machine-learning/ml-count-functions.md)
+* [Geographic functions](/reference/machine-learning/ml-geo-functions.md)
+* [Information content functions](/reference/machine-learning/ml-info-functions.md)
+* [Metric functions](/reference/machine-learning/ml-metric-functions.md)
* [Rare functions](/reference/machine-learning/ml-rare-functions.md)
-* [Sum functions](/reference/data-analysis/machine-learning/ml-sum-functions.md)
-* [Time functions](/reference/data-analysis/machine-learning/ml-time-functions.md)
+* [Sum functions](/reference/machine-learning/ml-sum-functions.md)
+* [Time functions](/reference/machine-learning/ml-time-functions.md)
diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-getting-started.md b/explore-analyze/machine-learning/anomaly-detection/ml-getting-started.md
index d0d51b9a7f..e3ca80bc40 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ml-getting-started.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ml-getting-started.md
@@ -315,6 +315,6 @@ If you’re now thinking about where {{anomaly-detect}} can be most impactful fo
In general, it is a good idea to start with single metric {{anomaly-jobs}} for your key performance indicators. After you examine these simple analysis results, you will have a better idea of what the influencers might be. You can create multi-metric jobs and split the data or create more complex analysis functions as necessary. For examples of more complicated configuration options, see [Examples](/explore-analyze/machine-learning/anomaly-detection/anomaly-how-tos.md).
-If you want to find more sample jobs, see [Supplied configurations](ootb-ml-jobs.md). In particular, there are sample jobs for [Apache](/reference/data-analysis/machine-learning/ootb-ml-jobs-apache.md) and [Nginx](/reference/machine-learning/ootb-ml-jobs-nginx.md) that are quite similar to the examples in this tutorial.
+If you want to find more sample jobs, see [Supplied configurations](ootb-ml-jobs.md). In particular, there are sample jobs for [Apache](/reference/machine-learning/ootb-ml-jobs-apache.md) and [Nginx](/reference/machine-learning/ootb-ml-jobs-nginx.md) that are quite similar to the examples in this tutorial.
If you encounter problems, we’re here to help. If you are an existing Elastic customer with a support contract, create a ticket in the [Elastic Support portal](http://support.elastic.co). Or post in the [Elastic forum](https://discuss.elastic.co/).
diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-limitations.md b/explore-analyze/machine-learning/anomaly-detection/ml-limitations.md
index df9fe1120a..4c06d451e6 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ml-limitations.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ml-limitations.md
@@ -140,22 +140,22 @@ The charts can also look odd in circumstances where there is very little data to
| Detector functions | Function description | Supported |
| --- | --- | --- |
-| count, high_count, low_count, non_zero_count, low_non_zero_count | [Count functions](/reference/data-analysis/machine-learning/ml-count-functions.md) | yes |
-| count, high_count, low_count, non_zero_count, low_non_zero_count with summary_count_field_name that is not doc_count (model plot not enabled) | [Count functions](/reference/data-analysis/machine-learning/ml-count-functions.md) | yes |
-| non_zero_count with summary_count_field that is not doc_count using cardinality aggregation in datafeed config (model plot not enabled) | [Count functions](/reference/data-analysis/machine-learning/ml-count-functions.md) | yes |
-| distinct_count, high_distinct_count, low_distinct_count | [Count functions](/reference/data-analysis/machine-learning/ml-count-functions.md) | yes |
-| mean, high_mean, low_mean | [Mean, high_mean, low_mean](/reference/data-analysis/machine-learning/ml-metric-functions.md#ml-metric-mean) | yes |
-| min | [Min](/reference/data-analysis/machine-learning/ml-metric-functions.md#ml-metric-min) | yes |
-| max | [Max](/reference/data-analysis/machine-learning/ml-metric-functions.md#ml-metric-max) | yes |
-| metric | [Metric](/reference/data-analysis/machine-learning/ml-metric-functions.md#ml-metric-metric) | yes |
-| median, high_median, low_median | [Median, high_median, low_median](/reference/data-analysis/machine-learning/ml-metric-functions.md#ml-metric-median) | yes |
-| sum, high_sum ,low_sum, non_null_sum, high_non_null_sum, low_non_null_sum | [Sum functions](/reference/data-analysis/machine-learning/ml-sum-functions.md) | yes |
-| varp, high_varp, low_varp | [Varp, high_varp, low_varp](/reference/data-analysis/machine-learning/ml-metric-functions.md#ml-metric-varp) | yes (only if model plot is enabled) |
-| lat_long | [Lat_long](/reference/data-analysis/machine-learning/ml-geo-functions.md#ml-lat-long) | no (but map is displayed in the Anomaly Explorer) |
-| info_content, high_info_content, low_info_content | [Info_content, High_info_content, Low_info_content](/reference/data-analysis/machine-learning/ml-info-functions.md#ml-info-content) | yes (only if model plot is enabled) |
+| count, high_count, low_count, non_zero_count, low_non_zero_count | [Count functions](/reference/machine-learning/ml-count-functions.md) | yes |
+| count, high_count, low_count, non_zero_count, low_non_zero_count with summary_count_field_name that is not doc_count (model plot not enabled) | [Count functions](/reference/machine-learning/ml-count-functions.md) | yes |
+| non_zero_count with summary_count_field that is not doc_count using cardinality aggregation in datafeed config (model plot not enabled) | [Count functions](/reference/machine-learning/ml-count-functions.md) | yes |
+| distinct_count, high_distinct_count, low_distinct_count | [Count functions](/reference/machine-learning/ml-count-functions.md) | yes |
+| mean, high_mean, low_mean | [Mean, high_mean, low_mean](/reference/machine-learning/ml-metric-functions.md#ml-metric-mean) | yes |
+| min | [Min](/reference/machine-learning/ml-metric-functions.md#ml-metric-min) | yes |
+| max | [Max](/reference/machine-learning/ml-metric-functions.md#ml-metric-max) | yes |
+| metric | [Metric](/reference/machine-learning/ml-metric-functions.md#ml-metric-metric) | yes |
+| median, high_median, low_median | [Median, high_median, low_median](/reference/machine-learning/ml-metric-functions.md#ml-metric-median) | yes |
+| sum, high_sum ,low_sum, non_null_sum, high_non_null_sum, low_non_null_sum | [Sum functions](/reference/machine-learning/ml-sum-functions.md) | yes |
+| varp, high_varp, low_varp | [Varp, high_varp, low_varp](/reference/machine-learning/ml-metric-functions.md#ml-metric-varp) | yes (only if model plot is enabled) |
+| lat_long | [Lat_long](/reference/machine-learning/ml-geo-functions.md#ml-lat-long) | no (but map is displayed in the Anomaly Explorer) |
+| info_content, high_info_content, low_info_content | [Info_content, High_info_content, Low_info_content](/reference/machine-learning/ml-info-functions.md#ml-info-content) | yes (only if model plot is enabled) |
| rare | [Rare](/reference/machine-learning/ml-rare-functions.md#ml-rare) | yes |
| freq_rare | [Freq_rare](/reference/machine-learning/ml-rare-functions.md#ml-freq-rare) | no |
-| time_of_day, time_of_week | [Time functions](/reference/data-analysis/machine-learning/ml-time-functions.md) | no |
+| time_of_day, time_of_week | [Time functions](/reference/machine-learning/ml-time-functions.md) | no |
### Jobs created in {{kib}} must use {{dfeeds}} [_jobs_created_in_kib_must_use_dfeeds]
diff --git a/explore-analyze/machine-learning/anomaly-detection/ootb-ml-jobs.md b/explore-analyze/machine-learning/anomaly-detection/ootb-ml-jobs.md
index 60313a4ae8..2f9308a15c 100644
--- a/explore-analyze/machine-learning/anomaly-detection/ootb-ml-jobs.md
+++ b/explore-analyze/machine-learning/anomaly-detection/ootb-ml-jobs.md
@@ -13,15 +13,15 @@ products:
{{anomaly-jobs-cap}} contain the configuration information and metadata necessary to perform an analytics task. {{kib}} can recognize certain types of data and provide specialized wizards for that context. This page lists the categories of the {{anomaly-jobs}} that are ready to use via {{kib}} in **Machine learning**. Refer to [Create {{anomaly-jobs}}](/explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs.md#ml-ad-create-job) to learn more about creating a job by using supplied configurations. Logs and Metrics supplied configurations are available and can be created via the related solution UI in {{kib}}.
-* [Apache](/reference/data-analysis/machine-learning/ootb-ml-jobs-apache.md)
-* [APM](/reference/data-analysis/machine-learning/ootb-ml-jobs-apm.md)
-* [{{auditbeat}}](/reference/data-analysis/machine-learning/ootb-ml-jobs-auditbeat.md)
-* [Logs](/reference/data-analysis/machine-learning/ootb-ml-jobs-logs-ui.md)
+* [Apache](/reference/machine-learning/ootb-ml-jobs-apache.md)
+* [APM](/reference/machine-learning/ootb-ml-jobs-apm.md)
+* [{{auditbeat}}](/reference/machine-learning/ootb-ml-jobs-auditbeat.md)
+* [Logs](/reference/machine-learning/ootb-ml-jobs-logs-ui.md)
* [{{metricbeat}}](/reference/machine-learning/ootb-ml-jobs-metricbeat.md)
-* [Metrics](/reference/data-analysis/machine-learning/ootb-ml-jobs-metrics-ui.md)
-* [Nginx](/reference/data-analysis/machine-learning/ootb-ml-jobs-nginx.md)
-* [Security](/reference/data-analysis/machine-learning/ootb-ml-jobs-siem.md)
-* [Uptime](/reference/data-analysis/machine-learning/ootb-ml-jobs-uptime.md)
+* [Metrics](/reference/machine-learning/ootb-ml-jobs-metrics-ui.md)
+* [Nginx](/reference/machine-learning/ootb-ml-jobs-nginx.md)
+* [Security](/reference/machine-learning/ootb-ml-jobs-siem.md)
+* [Uptime](/reference/machine-learning/ootb-ml-jobs-uptime.md)
::::{note}
The configurations are only available if data exists that matches the queries specified in the manifest files. These recognizer queries are linked in the descriptions of the individual configurations.
diff --git a/reference/data-analysis/index.md b/reference/data-analysis/index.md
index de6e9e0f49..2fe3ffec13 100644
--- a/reference/data-analysis/index.md
+++ b/reference/data-analysis/index.md
@@ -2,8 +2,8 @@
This section contains reference information for data analysis features, including:
-* [Supplied {{anomaly-detect}} configurations](/reference/data-analysis/machine-learning/supplied-anomaly-detection-configurations.md)
-* [Function reference for anomaly detection jobs](/reference/data-analysis/machine-learning/machine-learning-functions.md)
+* [Supplied {{anomaly-detect}} configurations](/reference/machine-learning/supplied-anomaly-detection-configurations.md)
+* [Function reference for anomaly detection jobs](/reference/machine-learning/machine-learning-functions.md)
* [Metrics reference for the Infrastructure app](/reference/data-analysis/observability/index.md)
* [Text analysis components](elasticsearch://reference/text-analysis/index.md)
* [Aggregations](elasticsearch://reference/aggregations/index.md)
diff --git a/reference/machine-learning/ml-count-functions.md b/reference/machine-learning/ml-count-functions.md
index 9d44aa62cd..c68be1a5e1 100644
--- a/reference/machine-learning/ml-count-functions.md
+++ b/reference/machine-learning/ml-count-functions.md
@@ -17,9 +17,9 @@ Use high-sided functions if you want to monitor unusually high event rates. Use
The {{ml-features}} include the following count functions:
-* [`count`, `high_count`, `low_count`](../../machine-learning/machine-learning/ml-count-functions.md#ml-count)
-* [`non_zero_count`, `high_non_zero_count`, `low_non_zero_count`](../../machine-learning/machine-learning/ml-count-functions.md#ml-nonzero-count)
-* [`distinct_count`, `high_distinct_count`, `low_distinct_count`](../../machine-learning/machine-learning/ml-count-functions.md#ml-distinct-count)
+* [`count`, `high_count`, `low_count`](../../machine-learning/ml-count-functions.md#ml-count)
+* [`non_zero_count`, `high_non_zero_count`, `low_non_zero_count`](../../machine-learning/ml-count-functions.md#ml-nonzero-count)
+* [`distinct_count`, `high_distinct_count`, `low_distinct_count`](../../machine-learning/ml-count-functions.md#ml-distinct-count)
## Count, high_count, low_count [ml-count]
diff --git a/reference/machine-learning/ml-metric-functions.md b/reference/machine-learning/ml-metric-functions.md
index ac982075b1..2c78b12648 100644
--- a/reference/machine-learning/ml-metric-functions.md
+++ b/reference/machine-learning/ml-metric-functions.md
@@ -11,12 +11,12 @@ The metric functions include functions such as mean, min and max. These values a
The {{ml-features}} include the following metric functions:
-* [`min`](../../machine-learning/machine-learning/ml-metric-functions.md#ml-metric-min)
-* [`max`](../../machine-learning/machine-learning/ml-metric-functions.md#ml-metric-max)
-* [`median`, `high_median`, `low_median`](../../machine-learning/machine-learning/ml-metric-functions.md#ml-metric-median)
-* [`mean`, `high_mean`, `low_mean`](../../machine-learning/machine-learning/ml-metric-functions.md#ml-metric-mean)
-* [`metric`](../../machine-learning/machine-learning/ml-metric-functions.md#ml-metric-metric)
-* [`varp`, `high_varp`, `low_varp`](../../machine-learning/machine-learning/ml-metric-functions.md#ml-metric-varp)
+* [`min`](../../machine-learning/ml-metric-functions.md#ml-metric-min)
+* [`max`](../../machine-learning/ml-metric-functions.md#ml-metric-max)
+* [`median`, `high_median`, `low_median`](../../machine-learning/ml-metric-functions.md#ml-metric-median)
+* [`mean`, `high_mean`, `low_mean`](../../machine-learning/ml-metric-functions.md#ml-metric-mean)
+* [`metric`](../../machine-learning/ml-metric-functions.md#ml-metric-metric)
+* [`varp`, `high_varp`, `low_varp`](../../machine-learning/ml-metric-functions.md#ml-metric-varp)
::::{note}
You cannot add rules with conditions to detectors that use the `metric` function.
diff --git a/reference/machine-learning/ml-rare-functions.md b/reference/machine-learning/ml-rare-functions.md
index 37b597fe5a..b89d8a2a62 100644
--- a/reference/machine-learning/ml-rare-functions.md
+++ b/reference/machine-learning/ml-rare-functions.md
@@ -23,8 +23,8 @@ The `rare` analysis detects anomalies according to the number of distinct rare v
The {{ml-features}} include the following rare functions:
-* [`rare`](../../machine-learning/machine-learning/ml-rare-functions.md#ml-rare)
-* [`freq_rare`](../../machine-learning/machine-learning/ml-rare-functions.md#ml-freq-rare)
+* [`rare`](../../machine-learning/ml-rare-functions.md#ml-rare)
+* [`freq_rare`](../../machine-learning/ml-rare-functions.md#ml-freq-rare)
## Rare [ml-rare]
diff --git a/reference/machine-learning/ml-sum-functions.md b/reference/machine-learning/ml-sum-functions.md
index 30801deab8..57e82d24c9 100644
--- a/reference/machine-learning/ml-sum-functions.md
+++ b/reference/machine-learning/ml-sum-functions.md
@@ -17,8 +17,8 @@ If your data is sparse, use `non_null_sum` functions. Buckets without values are
The {{ml-features}} include the following sum functions:
-* [`sum`, `high_sum`, `low_sum`](../../machine-learning/machine-learning/ml-sum-functions.md#ml-sum)
-* [`non_null_sum`, `high_non_null_sum`, `low_non_null_sum`](../../machine-learning/machine-learning/ml-sum-functions.md#ml-nonnull-sum)
+* [`sum`, `high_sum`, `low_sum`](../../machine-learning/ml-sum-functions.md#ml-sum)
+* [`non_null_sum`, `high_non_null_sum`, `low_non_null_sum`](../../machine-learning/ml-sum-functions.md#ml-nonnull-sum)
## Sum, high_sum, low_sum [ml-sum]
diff --git a/reference/machine-learning/ml-time-functions.md b/reference/machine-learning/ml-time-functions.md
index 1cb76f75aa..7121f22432 100644
--- a/reference/machine-learning/ml-time-functions.md
+++ b/reference/machine-learning/ml-time-functions.md
@@ -11,8 +11,8 @@ The time functions detect events that happen at unusual times, either of the day
The {{ml-features}} include the following time functions:
-* [`time_of_day`](../../machine-learning/machine-learning/ml-time-functions.md#ml-time-of-day)
-* [`time_of_week`](../../machine-learning/machine-learning/ml-time-functions.md#ml-time-of-week)
+* [`time_of_day`](../../machine-learning/ml-time-functions.md#ml-time-of-day)
+* [`time_of_week`](../../machine-learning/ml-time-functions.md#ml-time-of-week)
::::{note}
diff --git a/reference/machine-learning/ootb-ml-jobs-apache.md b/reference/machine-learning/ootb-ml-jobs-apache.md
index b3c7e83e62..4c91611f0f 100644
--- a/reference/machine-learning/ootb-ml-jobs-apache.md
+++ b/reference/machine-learning/ootb-ml-jobs-apache.md
@@ -27,7 +27,7 @@ For more details, see the {{dfeed}} and job definitions in [GitHub](https://gith
## Apache access logs ({{filebeat}}) [apache-access-logs-filebeat]
-These legacy {{anomaly-jobs}} find unusual activity in HTTP access logs. For the latest versions, install the Apache integration in {{fleet}}; see [Apache access logs](../../machine-learning/machine-learning/ootb-ml-jobs-apache.md#apache-access-logs).
+These legacy {{anomaly-jobs}} find unusual activity in HTTP access logs. For the latest versions, install the Apache integration in {{fleet}}; see [Apache access logs](../../machine-learning/ootb-ml-jobs-apache.md#apache-access-logs).
For more details, see the {{dfeed}} and job definitions in [GitHub](https://github.com/elastic/kibana/tree/master/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/apache_ecs/ml).
diff --git a/reference/machine-learning/ootb-ml-jobs-nginx.md b/reference/machine-learning/ootb-ml-jobs-nginx.md
index b1c408ef5c..ac7a09af6d 100644
--- a/reference/machine-learning/ootb-ml-jobs-nginx.md
+++ b/reference/machine-learning/ootb-ml-jobs-nginx.md
@@ -27,7 +27,7 @@ These jobs are available in {{kib}} only if data exists that matches the query s
## Nginx access logs ({{filebeat}}) [nginx-access-logs-filebeat]
-These legacy {{anomaly-jobs}} find unusual activity in HTTP access logs. For the latest versions, install the Nginx integration in {{fleet}}; see [Nginx access logs](../../machine-learning/machine-learning/ootb-ml-jobs-nginx.md#nginx-access-logs).
+These legacy {{anomaly-jobs}} find unusual activity in HTTP access logs. For the latest versions, install the Nginx integration in {{fleet}}; see [Nginx access logs](../../machine-learning/ootb-ml-jobs-nginx.md#nginx-access-logs).
These jobs exist in {{kib}} only if data exists that matches the recognizer query specified in the [manifest file](https://github.com/elastic/kibana/blob/master/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/nginx_ecs/manifest.json).
From c593e53a541bac81870408956ae66fa574ca77eb Mon Sep 17 00:00:00 2001
From: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
Date: Thu, 16 Oct 2025 18:47:53 +0200
Subject: [PATCH 3/6] fix
---
reference/data-analysis/index.md | 11 --------
reference/data-analysis/toc.yml | 28 -------------------
.../machine-learning/ml-count-functions.md | 6 ++--
.../machine-learning/ml-metric-functions.md | 12 ++++----
.../machine-learning/ml-rare-functions.md | 4 +--
.../machine-learning/ml-sum-functions.md | 4 +--
.../machine-learning/ml-time-functions.md | 4 +--
.../machine-learning/ootb-ml-jobs-apache.md | 2 +-
.../machine-learning/ootb-ml-jobs-nginx.md | 2 +-
9 files changed, 17 insertions(+), 56 deletions(-)
delete mode 100644 reference/data-analysis/index.md
delete mode 100644 reference/data-analysis/toc.yml
diff --git a/reference/data-analysis/index.md b/reference/data-analysis/index.md
deleted file mode 100644
index 2fe3ffec13..0000000000
--- a/reference/data-analysis/index.md
+++ /dev/null
@@ -1,11 +0,0 @@
-# Data analysis
-
-This section contains reference information for data analysis features, including:
-
-* [Supplied {{anomaly-detect}} configurations](/reference/machine-learning/supplied-anomaly-detection-configurations.md)
-* [Function reference for anomaly detection jobs](/reference/machine-learning/machine-learning-functions.md)
-* [Metrics reference for the Infrastructure app](/reference/data-analysis/observability/index.md)
-* [Text analysis components](elasticsearch://reference/text-analysis/index.md)
-* [Aggregations](elasticsearch://reference/aggregations/index.md)
-
-Visit the [Explore and analyze](/explore-analyze/index.md) section to learn how to use the Elasticsearch platform to explore and analyze your data effectively.
diff --git a/reference/data-analysis/toc.yml b/reference/data-analysis/toc.yml
deleted file mode 100644
index 39315e9236..0000000000
--- a/reference/data-analysis/toc.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-toc:
- - file: index.md
- - file: machine-learning/supplied-anomaly-detection-configurations.md
- children:
- - file: machine-learning/ootb-ml-jobs-apache.md
- - file: machine-learning/ootb-ml-jobs-apm.md
- - file: machine-learning/ootb-ml-jobs-auditbeat.md
- - file: machine-learning/ootb-ml-jobs-logs-ui.md
- - file: machine-learning/ootb-ml-jobs-metricbeat.md
- - file: machine-learning/ootb-ml-jobs-metrics-ui.md
- - file: machine-learning/ootb-ml-jobs-nginx.md
- - file: machine-learning/ootb-ml-jobs-siem.md
- - file: machine-learning/ootb-ml-jobs-uptime.md
- - file: machine-learning/machine-learning-functions.md
- children:
- - file: machine-learning/ml-count-functions.md
- - file: machine-learning/ml-geo-functions.md
- - file: machine-learning/ml-info-functions.md
- - file: machine-learning/ml-metric-functions.md
- - file: machine-learning/ml-rare-functions.md
- - file: machine-learning/ml-sum-functions.md
- - file: machine-learning/ml-time-functions.md
- - file: observability/index.md
- children:
- - file: observability/observability-host-metrics.md
- - file: observability/observability-container-metrics.md
- - file: observability/observability-kubernetes-pod-metrics.md
- - file: observability/observability-aws-metrics.md
\ No newline at end of file
diff --git a/reference/machine-learning/ml-count-functions.md b/reference/machine-learning/ml-count-functions.md
index c68be1a5e1..5d0605c33a 100644
--- a/reference/machine-learning/ml-count-functions.md
+++ b/reference/machine-learning/ml-count-functions.md
@@ -17,9 +17,9 @@ Use high-sided functions if you want to monitor unusually high event rates. Use
The {{ml-features}} include the following count functions:
-* [`count`, `high_count`, `low_count`](../../machine-learning/ml-count-functions.md#ml-count)
-* [`non_zero_count`, `high_non_zero_count`, `low_non_zero_count`](../../machine-learning/ml-count-functions.md#ml-nonzero-count)
-* [`distinct_count`, `high_distinct_count`, `low_distinct_count`](../../machine-learning/ml-count-functions.md#ml-distinct-count)
+* [`count`, `high_count`, `low_count`](/reference/machine-learning/ml-count-functions.md#ml-count)
+* [`non_zero_count`, `high_non_zero_count`, `low_non_zero_count`](/reference/machine-learning/ml-count-functions.md#ml-nonzero-count)
+* [`distinct_count`, `high_distinct_count`, `low_distinct_count`](/reference/machine-learning/ml-count-functions.md#ml-distinct-count)
## Count, high_count, low_count [ml-count]
diff --git a/reference/machine-learning/ml-metric-functions.md b/reference/machine-learning/ml-metric-functions.md
index 2c78b12648..28336f7161 100644
--- a/reference/machine-learning/ml-metric-functions.md
+++ b/reference/machine-learning/ml-metric-functions.md
@@ -11,12 +11,12 @@ The metric functions include functions such as mean, min and max. These values a
The {{ml-features}} include the following metric functions:
-* [`min`](../../machine-learning/ml-metric-functions.md#ml-metric-min)
-* [`max`](../../machine-learning/ml-metric-functions.md#ml-metric-max)
-* [`median`, `high_median`, `low_median`](../../machine-learning/ml-metric-functions.md#ml-metric-median)
-* [`mean`, `high_mean`, `low_mean`](../../machine-learning/ml-metric-functions.md#ml-metric-mean)
-* [`metric`](../../machine-learning/ml-metric-functions.md#ml-metric-metric)
-* [`varp`, `high_varp`, `low_varp`](../../machine-learning/ml-metric-functions.md#ml-metric-varp)
+* [`min`](/reference/machine-learning/ml-metric-functions.md#ml-metric-min)
+* [`max`](/reference/machine-learning/ml-metric-functions.md#ml-metric-max)
+* [`median`, `high_median`, `low_median`](/reference/machine-learning/ml-metric-functions.md#ml-metric-median)
+* [`mean`, `high_mean`, `low_mean`](/reference/machine-learning/ml-metric-functions.md#ml-metric-mean)
+* [`metric`](/reference/machine-learning/ml-metric-functions.md#ml-metric-metric)
+* [`varp`, `high_varp`, `low_varp`](/reference/machine-learning/ml-metric-functions.md#ml-metric-varp)
::::{note}
You cannot add rules with conditions to detectors that use the `metric` function.
diff --git a/reference/machine-learning/ml-rare-functions.md b/reference/machine-learning/ml-rare-functions.md
index b89d8a2a62..30af26ad8c 100644
--- a/reference/machine-learning/ml-rare-functions.md
+++ b/reference/machine-learning/ml-rare-functions.md
@@ -23,8 +23,8 @@ The `rare` analysis detects anomalies according to the number of distinct rare v
The {{ml-features}} include the following rare functions:
-* [`rare`](../../machine-learning/ml-rare-functions.md#ml-rare)
-* [`freq_rare`](../../machine-learning/ml-rare-functions.md#ml-freq-rare)
+* [`rare`](/reference/machine-learning/ml-rare-functions.md#ml-rare)
+* [`freq_rare`](/reference/machine-learning/ml-rare-functions.md#ml-freq-rare)
## Rare [ml-rare]
diff --git a/reference/machine-learning/ml-sum-functions.md b/reference/machine-learning/ml-sum-functions.md
index 57e82d24c9..81b58ca597 100644
--- a/reference/machine-learning/ml-sum-functions.md
+++ b/reference/machine-learning/ml-sum-functions.md
@@ -17,8 +17,8 @@ If your data is sparse, use `non_null_sum` functions. Buckets without values are
The {{ml-features}} include the following sum functions:
-* [`sum`, `high_sum`, `low_sum`](../../machine-learning/ml-sum-functions.md#ml-sum)
-* [`non_null_sum`, `high_non_null_sum`, `low_non_null_sum`](../../machine-learning/ml-sum-functions.md#ml-nonnull-sum)
+* [`sum`, `high_sum`, `low_sum`](/reference/machine-learning/ml-sum-functions.md#ml-sum)
+* [`non_null_sum`, `high_non_null_sum`, `low_non_null_sum`](/reference/machine-learning/ml-sum-functions.md#ml-nonnull-sum)
## Sum, high_sum, low_sum [ml-sum]
diff --git a/reference/machine-learning/ml-time-functions.md b/reference/machine-learning/ml-time-functions.md
index 7121f22432..41c094a7f3 100644
--- a/reference/machine-learning/ml-time-functions.md
+++ b/reference/machine-learning/ml-time-functions.md
@@ -11,8 +11,8 @@ The time functions detect events that happen at unusual times, either of the day
The {{ml-features}} include the following time functions:
-* [`time_of_day`](../../machine-learning/ml-time-functions.md#ml-time-of-day)
-* [`time_of_week`](../../machine-learning/ml-time-functions.md#ml-time-of-week)
+* [`time_of_day`](/reference/machine-learning/ml-time-functions.md#ml-time-of-day)
+* [`time_of_week`](/reference/machine-learning/ml-time-functions.md#ml-time-of-week)
::::{note}
diff --git a/reference/machine-learning/ootb-ml-jobs-apache.md b/reference/machine-learning/ootb-ml-jobs-apache.md
index 4c91611f0f..ae1d0b74ca 100644
--- a/reference/machine-learning/ootb-ml-jobs-apache.md
+++ b/reference/machine-learning/ootb-ml-jobs-apache.md
@@ -27,7 +27,7 @@ For more details, see the {{dfeed}} and job definitions in [GitHub](https://gith
## Apache access logs ({{filebeat}}) [apache-access-logs-filebeat]
-These legacy {{anomaly-jobs}} find unusual activity in HTTP access logs. For the latest versions, install the Apache integration in {{fleet}}; see [Apache access logs](../../machine-learning/ootb-ml-jobs-apache.md#apache-access-logs).
+These legacy {{anomaly-jobs}} find unusual activity in HTTP access logs. For the latest versions, install the Apache integration in {{fleet}}; see [Apache access logs](/reference/machine-learning/ootb-ml-jobs-apache.md#apache-access-logs).
For more details, see the {{dfeed}} and job definitions in [GitHub](https://github.com/elastic/kibana/tree/master/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/apache_ecs/ml).
diff --git a/reference/machine-learning/ootb-ml-jobs-nginx.md b/reference/machine-learning/ootb-ml-jobs-nginx.md
index ac7a09af6d..84209b6522 100644
--- a/reference/machine-learning/ootb-ml-jobs-nginx.md
+++ b/reference/machine-learning/ootb-ml-jobs-nginx.md
@@ -27,7 +27,7 @@ These jobs are available in {{kib}} only if data exists that matches the query s
## Nginx access logs ({{filebeat}}) [nginx-access-logs-filebeat]
-These legacy {{anomaly-jobs}} find unusual activity in HTTP access logs. For the latest versions, install the Nginx integration in {{fleet}}; see [Nginx access logs](../../machine-learning/ootb-ml-jobs-nginx.md#nginx-access-logs).
+These legacy {{anomaly-jobs}} find unusual activity in HTTP access logs. For the latest versions, install the Nginx integration in {{fleet}}; see [Nginx access logs](/reference/machine-learning/ootb-ml-jobs-nginx.md#nginx-access-logs).
These jobs exist in {{kib}} only if data exists that matches the recognizer query specified in the [manifest file](https://github.com/elastic/kibana/blob/master/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/nginx_ecs/manifest.json).
From 9248cd84708f44c2bd8e890d8925f7d9244a94d2 Mon Sep 17 00:00:00 2001
From: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
Date: Thu, 16 Oct 2025 19:14:44 +0200
Subject: [PATCH 4/6] Improve links on ML landing page
---
reference/machine-learning/index.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/reference/machine-learning/index.md b/reference/machine-learning/index.md
index 6aae9d6c72..1b94ee18ae 100644
--- a/reference/machine-learning/index.md
+++ b/reference/machine-learning/index.md
@@ -1,8 +1,8 @@
# Machine learning
-This section contains reference information for machine learning features, including:
+This section contains reference information for the following machine learning features:
-* [Supplied {{anomaly-detect}} configurations](/reference/machine-learning/supplied-anomaly-detection-configurations.md)
+* [{{kib}} {{anomaly-detect}} job wizards [ootb-ml-jobs]](/reference/machine-learning/supplied-anomaly-detection-configurations.md)
* [Function reference for anomaly detection jobs](/reference/machine-learning/machine-learning-functions.md)
-Visit the [Explore and analyze](/explore-analyze/index.md) section to learn how to use the Elasticsearch platform to explore and analyze your data effectively.
+Visit the [Explore and analyze](/explore-analyze/machine-learning.md) section to learn how to use machine learning features.
From 0a66113821e15a73a1b9d3c95e7a2a9d5c53abaf Mon Sep 17 00:00:00 2001
From: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
Date: Thu, 16 Oct 2025 19:15:36 +0200
Subject: [PATCH 5/6] fix typo
---
reference/machine-learning/index.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/reference/machine-learning/index.md b/reference/machine-learning/index.md
index 1b94ee18ae..bcfe6f9188 100644
--- a/reference/machine-learning/index.md
+++ b/reference/machine-learning/index.md
@@ -2,7 +2,7 @@
This section contains reference information for the following machine learning features:
-* [{{kib}} {{anomaly-detect}} job wizards [ootb-ml-jobs]](/reference/machine-learning/supplied-anomaly-detection-configurations.md)
+* [{{kib}} {{anomaly-detect}} job wizards](/reference/machine-learning/supplied-anomaly-detection-configurations.md)
* [Function reference for anomaly detection jobs](/reference/machine-learning/machine-learning-functions.md)
Visit the [Explore and analyze](/explore-analyze/machine-learning.md) section to learn how to use machine learning features.
From fbb63134678417d8ab66d4f82fe335710360089d Mon Sep 17 00:00:00 2001
From: Liam Thompson
Date: Mon, 20 Oct 2025 11:14:07 +0200
Subject: [PATCH 6/6] Refactor index page, including reshuffles missed in
previous PR
Updated section headings and descriptions for clarity and consistency. Reorganized content related to Elasticsearch, Kibana, and machine learning.
---
reference/index.md | 53 ++++++++++++++++++++--------------------------
1 file changed, 23 insertions(+), 30 deletions(-)
diff --git a/reference/index.md b/reference/index.md
index ba69d565ef..e81dcdb087 100644
--- a/reference/index.md
+++ b/reference/index.md
@@ -23,41 +23,41 @@ Explore the reference documentation for [Elastic APIs]({{apis}}).
| APM | • [APM Server](/solutions/observability/apm/apm-server/api.md)
• [Observability intake Serverless]({{intake-apis}})
|
| {{ecloud}} | • [{{ech}}]({{cloud-apis}})
• [{{ecloud}} Serverless]({{cloud-serverless-apis}})
• [{{ece}}]({{ece-apis}})
• [{{eck}}](cloud-on-k8s://reference/api-docs.md)
• [{{ecloud}} billing]({{cloud-billing-apis}})
|
-## Security
+## Elasticsearch and index management
-Access detailed reference documentation on field and object schemas as well as the different commands used to manage and troubleshoot Elastic Endpoint.
+Customize your Elastic Stack setup with our configuration reference guides. Explore JVM settings, client documentation, Elasticsearch privileges, and index lifecycle actions to find the detailed information you need to configure your environment to your specific needs.
-**Learn more in [Security](security/index.md)**
+**Learn more in [Elasticsearch and index management](elasticsearch://reference/elasticsearch/index.md)**
-## Observability
+## Kibana
-Access detailed reference documentation on field and object schemas as well as the Elastic Entity Model.
+Visualize and analyze your data with Kibana. Configure advanced settings, explore plugins, and utilize command line tools to enhance your data insights.
-**Learn more in [Observability](observability/index.md)**
+**Learn more in [Kibana](kibana://reference/index.md)**
-## Elasticsearch and index management
+## Cloud
-Customize your Elastic Stack setup with our configuration reference guides. Explore JVM settings, client documentation, Elasticsearch privileges, and index lifecycle actions to find the detailed information you need to configure your environment to your specific needs.
+Leverage the power of the cloud with Elastic Cloud solutions. Explore Elastic Cloud on Kubernetes, Elastic Cloud Enterprise, and Elastic Cloud Hosted to scale your operations.
-**Learn more in [Elasticsearch and index management](elasticsearch://reference/elasticsearch/index.md)**
+**Learn more in [Cloud](cloud://reference/index.md)**
-## Elastic Distributions of OpenTelemetry (EDOT)
+## Elastic Security
-Elastic Distributions of OpenTelemetry (EDOT) is an open-source ecosystem of OpenTelemetry distributions tailored to Elastic. They include a customized OpenTelemetry Collector and several OpenTelemetry Language SDKs.
+Access detailed reference documentation on field and object schemas as well as the different commands used to manage and troubleshoot Elastic Endpoint.
-**Learn more in [Elastic Distributions of OpenTelemetry](opentelemetry://reference/index.md)**
+**Learn more in [Security](security/index.md)**
-## Ingestion tools
+## Elastic Observability
-Streamline data ingestion with tools like Fleet and Elastic Agent, APM, and Beats. Explore processor references and Logstash plugins to efficiently manage your data flow.
+Access detailed reference documentation on field and object schemas as well as the Elastic Entity Model.
-**Learn more in [Ingestion tools](ingestion-tools/index.md)**
+**Learn more in [Observability](observability/index.md)**
-## Kibana
+## Ingestion tools
-Visualize and analyze your data with Kibana. Configure advanced settings, explore plugins, and utilize command line tools to enhance your data insights.
+Streamline data ingestion with tools like Fleet and Elastic Agent, APM, Beats, and Elastic Distributions of OpenTelemetry. Explore processor references and Logstash plugins to efficiently manage your data flow.
-**Learn more in [Kibana](kibana://reference/index.md)**
+**Learn more in [Ingestion tools](ingestion-tools/index.md)**
## Elasticsearch plugins
@@ -71,9 +71,9 @@ Master data querying with our comprehensive guides on QueryDSL, ES|QL, SQL, EQL,
**Learn more in [Query languages](elasticsearch://reference/query-languages/index.md)**
-## Scripting languages
+## Painless scripting language
-Access syntax references, function libraries, and best practices for Painless scripting.
+Access syntax reference, function libraries, and best practices for Painless scripting.
**Learn more in [Painless scripting](elasticsearch://reference/scripting-languages/painless/painless.md)**
@@ -83,11 +83,11 @@ Standardize your data with ECS. Access logging libraries, field references, and
**Learn more in [ECS](ecs://reference/index.md)**
-## Data analysis
+## Machine learning
-Unlock insights with powerful data analysis tools. Utilize text analysis components, aggregations, and function references to derive meaningful conclusions from your data.
+Explore reference content for Elastic machine learning features.
-**Learn more in [Data analysis](machine-learning/index.md)**
+**Learn more in [Machine learning](machine-learning/index.md)**
## Search UI library
@@ -95,11 +95,4 @@ Explore reference content on the Search UI library and how you can develop fast,
**Learn more in [Search UI](search-ui://reference/index.md)**
-## Cloud
-
-Leverage the power of the cloud with Elastic Cloud solutions. Explore Elastic Cloud on Kubernetes, Elastic Cloud Enterprise, and Elastic Cloud Hosted to scale your operations.
-
-**Learn more in [Cloud](cloud://reference/index.md)**
-
-