From b5315f19f84bddf799318286693e274ed29f912b Mon Sep 17 00:00:00 2001 From: shainaraskas Date: Tue, 9 Dec 2025 13:54:54 -0500 Subject: [PATCH 1/2] move ccs to explore-analyze --- deploy-manage/deploy/deployment-comparison.md | 2 +- ...fferences-from-other-elasticsearch-offerings.md | 2 +- deploy-manage/deploy/self-managed.md | 2 +- .../deploy/self-managed/configure-elasticsearch.md | 2 +- .../clusters-nodes-shards/node-roles.md | 2 +- deploy-manage/index.md | 2 +- .../resilience-in-larger-clusters.md | 2 +- deploy-manage/remote-clusters.md | 2 +- .../_snippets/ccs-compatibility-table.md | 2 +- .../remote-clusters/ec-enable-ccs-for-eck.md | 2 +- .../remote-clusters/ec-remote-cluster-same-ess.md | 2 +- .../remote-clusters/ece-enable-ccs-for-eck.md | 2 +- .../remote-clusters/ece-remote-cluster-same-ece.md | 2 +- .../remote-clusters/remote-clusters-cert.md | 2 +- .../security/_snippets/complete-security.md | 2 +- .../set-up-cross-cluster-replication.md | 2 +- .../snapshot-and-restore/searchable-snapshots.md | 2 +- deploy-manage/upgrade/prepare-to-upgrade.md | 2 +- .../cross-cluster-search.md | 14 +++++++------- ...cluster-endpoint-before-cross-cluster-search.md | 2 +- explore-analyze/find-and-organize/data-views.md | 4 ++-- explore-analyze/query-filter/languages/eql.md | 2 +- explore-analyze/toc.yml | 3 +++ .../transforms/transform-limitations.md | 2 +- redirects.yml | 4 ++++ reference/glossary/index.md | 2 +- solutions/search/the-search-api.md | 2 +- solutions/search/vector/knn.md | 2 +- .../privileged-user-monitoring-requirements.md | 2 +- .../cross-cluster-search-detection-rules.md | 4 ++-- .../get-started/elastic-security-requirements.md | 2 +- solutions/toc.yml | 4 +--- 32 files changed, 45 insertions(+), 40 deletions(-) rename {solutions/search => explore-analyze}/cross-cluster-search.md (98%) rename {solutions/search => explore-analyze/cross-cluster-search}/using-resolve-cluster-endpoint-before-cross-cluster-search.md (98%) diff --git a/deploy-manage/deploy/deployment-comparison.md b/deploy-manage/deploy/deployment-comparison.md index 4917d782f3..efe3ec1c43 100644 --- a/deploy-manage/deploy/deployment-comparison.md +++ b/deploy-manage/deploy/deployment-comparison.md @@ -47,7 +47,7 @@ For more details about feature availability in {{serverless-short}}, refer to [] | Custom plugins and bundles | Available | Available | No | | [Self-managed connectors](elasticsearch://reference/search-connectors/self-managed-connectors.md) | Available | Limited | Limited | | [{{es}}-Hadoop integration](elasticsearch-hadoop://reference/index.md) | Available | Available | No | -| [Cross cluster search (CCS)](/solutions/search/cross-cluster-search.md) | Available | Available | [Planned](https://www.elastic.co/cloud/serverless/roadmap) (as cross project search) | +| [Cross cluster search (CCS)](/explore-analyze/cross-cluster-search.md) | Available | Available | [Planned](https://www.elastic.co/cloud/serverless/roadmap) (as cross project search) | | [Cross cluster replication](/deploy-manage/tools/cross-cluster-replication.md) | Available | Available | [Planned](https://www.elastic.co/cloud/serverless/roadmap) | ## Development and testing features diff --git a/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md b/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md index 5028ada282..2f5232e795 100644 --- a/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md +++ b/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md @@ -88,7 +88,7 @@ This table compares Elasticsearch capabilities between {{ech}} deployments and S | [**Clone index API**](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-clone) | ✅ | **Planned** | Anticipated in a future release | | [**Bulk indexing**](/deploy-manage/production-guidance/optimize-performance/indexing-speed.md#_use_bulk_requests) | ✅ | ✅ | The baseline write latency in {{serverless-short}} is 200ms [^1^](#footnote-1) | | [**Cross-cluster replication**](/deploy-manage/tools/cross-cluster-replication.md) | ✅ | **Planned** | Anticipated in a future release | -| [**Cross-cluster search**](/solutions/search/cross-cluster-search.md) | ✅ | **Planned** | Anticipated in a future release | +| [**Cross-cluster search**](/explore-analyze/cross-cluster-search.md) | ✅ | **Planned** | Anticipated in a future release | | **Data lifecycle management** | - [ILM](/manage-data/lifecycle/index-lifecycle-management.md)
- [Data stream lifecycle](/manage-data/lifecycle/data-stream.md) | [Data stream lifecycle](/manage-data/lifecycle/data-stream.md) only | - No data tiers in Serverless
- Optimized for common lifecycle management needs | | **Elastic connectors (for search)** | ❌ (Managed connectors discontinued with Enterprise Search in 9.0) | Self-managed only | - Managed connectors not available
- Use [**self-managed connectors**](elasticsearch://reference/search-connectors/self-managed-connectors.md) | | [**Elasticsearch for Apache Hadoop**](https://www.elastic.co/elasticsearch/hadoop) | ✅ | ❌ | Not available in Serverless | diff --git a/deploy-manage/deploy/self-managed.md b/deploy-manage/deploy/self-managed.md index 74d7b469c0..9558e3a1c6 100644 --- a/deploy-manage/deploy/self-managed.md +++ b/deploy-manage/deploy/self-managed.md @@ -93,7 +93,7 @@ Learn how to secure your Elastic environment to restrict access to only authoriz * [](/deploy-manage/manage-spaces.md): Learn how to organize content in {{kib}}, and restrict access to this content to specific users. * [](/deploy-manage/api-keys.md): Authenticate and authorize programmatic access to your deployments and {{es}} resources. * [](/deploy-manage/manage-connectors.md): Manage connection information between Elastic and third-party systems. -* [](/deploy-manage/remote-clusters/remote-clusters-self-managed.md): Enable communication between {{es}} clusters to support [cross-cluster replication](/deploy-manage/tools/cross-cluster-replication.md) and [cross-cluster search](/solutions/search/cross-cluster-search.md). +* [](/deploy-manage/remote-clusters/remote-clusters-self-managed.md): Enable communication between {{es}} clusters to support [cross-cluster replication](/deploy-manage/tools/cross-cluster-replication.md) and [cross-cluster search](/explore-analyze/cross-cluster-search.md). ### Administer and maintain diff --git a/deploy-manage/deploy/self-managed/configure-elasticsearch.md b/deploy-manage/deploy/self-managed/configure-elasticsearch.md index bf8cb5c1cb..fb8faea498 100644 --- a/deploy-manage/deploy/self-managed/configure-elasticsearch.md +++ b/deploy-manage/deploy/self-managed/configure-elasticsearch.md @@ -92,6 +92,6 @@ Refer to the following documentation to learn how to perform key configuration t * [](/deploy-manage/users-roles/cluster-or-deployment-auth.md): Set up authentication and authorization for your cluster, and learn about the underlying security technologies that {{es}} uses to authenticate and authorize requests internally and across services. * [](/deploy-manage/api-keys.md): Authenticate and authorize programmatic access to your deployments and {{es}} resources. * [](/deploy-manage/manage-connectors.md): Manage connection information between Elastic and third-party systems. -* [](/deploy-manage/remote-clusters.md): Enable communication between {{es}} clusters to support [cross-cluster replication](/deploy-manage/tools/cross-cluster-replication.md) and [cross-cluster search](/solutions/search/cross-cluster-search.md). +* [](/deploy-manage/remote-clusters.md): Enable communication between {{es}} clusters to support [cross-cluster replication](/deploy-manage/tools/cross-cluster-replication.md) and [cross-cluster search](/explore-analyze/cross-cluster-search.md). * [](/deploy-manage/maintenance/add-and-remove-elasticsearch-nodes.md): Learn how to add or remove nodes to change the size and capacity of your cluster. * [](/deploy-manage/production-guidance.md): Review tips and guidance that you can use to design a production environment that matches your workloads, policies, and deployment needs. diff --git a/deploy-manage/distributed-architecture/clusters-nodes-shards/node-roles.md b/deploy-manage/distributed-architecture/clusters-nodes-shards/node-roles.md index c1025436de..debbc8e65d 100644 --- a/deploy-manage/distributed-architecture/clusters-nodes-shards/node-roles.md +++ b/deploy-manage/distributed-architecture/clusters-nodes-shards/node-roles.md @@ -279,7 +279,7 @@ node.roles: [ ] ### Remote-eligible node [remote-node] -A remote-eligible node acts as a cross-cluster client and connects to [remote clusters](../../remote-clusters.md). Once connected, you can search remote clusters using [{{ccs}}](../../../solutions/search/cross-cluster-search.md). You can also sync data between clusters using [{{ccr}}](../../tools/cross-cluster-replication.md). +A remote-eligible node acts as a cross-cluster client and connects to [remote clusters](../../remote-clusters.md). Once connected, you can search remote clusters using [{{ccs}}](../../../explore-analyze/cross-cluster-search.md). You can also sync data between clusters using [{{ccr}}](../../tools/cross-cluster-replication.md). ```yaml node.roles: [ remote_cluster_client ] diff --git a/deploy-manage/index.md b/deploy-manage/index.md index 30b5d635c7..b828316eca 100644 --- a/deploy-manage/index.md +++ b/deploy-manage/index.md @@ -59,7 +59,7 @@ Learn how to secure your Elastic environment to restrict access to only authoriz * [](/deploy-manage/manage-spaces.md): Learn how to organize content in {{kib}}, and restrict access to this content to specific users. * [](/deploy-manage/api-keys.md): Authenticate and authorize programmatic access to your deployments and {{es}} resources. * [](/deploy-manage/manage-connectors.md): Manage connection information between Elastic and third-party systems. -* [](/deploy-manage/remote-clusters.md): Enable communication between {{es}} clusters to support [cross-cluster replication](/deploy-manage/tools/cross-cluster-replication.md) and [cross-cluster search](/solutions/search/cross-cluster-search.md). +* [](/deploy-manage/remote-clusters.md): Enable communication between {{es}} clusters to support [cross-cluster replication](/deploy-manage/tools/cross-cluster-replication.md) and [cross-cluster search](/explore-analyze/cross-cluster-search.md). ## Administer and maintain diff --git a/deploy-manage/production-guidance/availability-and-resilience/resilience-in-larger-clusters.md b/deploy-manage/production-guidance/availability-and-resilience/resilience-in-larger-clusters.md index 73346e9f90..a9301445a0 100644 --- a/deploy-manage/production-guidance/availability-and-resilience/resilience-in-larger-clusters.md +++ b/deploy-manage/production-guidance/availability-and-resilience/resilience-in-larger-clusters.md @@ -30,7 +30,7 @@ If you’ve divided your cluster into zones, the network connections within each $$$high-availability-cluster-design-min-network-perf$$$ There is no specific minimum network performance required to run a healthy {{es}} cluster. In theory, a cluster will work correctly even if the round-trip latency between nodes is several hundred milliseconds. In practice, if your network is that slow then the cluster performance will be very poor. In addition, slow networks are often unreliable enough to cause network partitions that lead to periods of unavailability. -If you want your data to be available in multiple data centers that are further apart or not well connected, deploy a separate cluster in each data center and use [{{ccs}}](../../../solutions/search/cross-cluster-search.md) or [{{ccr}}](../../tools/cross-cluster-replication.md) to link the clusters together. These features are designed to perform well even if the cluster-to-cluster connections are less reliable or performant than the network within each cluster. +If you want your data to be available in multiple data centers that are further apart or not well connected, deploy a separate cluster in each data center and use [{{ccs}}](../../../explore-analyze/cross-cluster-search.md) or [{{ccr}}](../../tools/cross-cluster-replication.md) to link the clusters together. These features are designed to perform well even if the cluster-to-cluster connections are less reliable or performant than the network within each cluster. After losing a whole zone’s worth of nodes, a properly-designed cluster may be functional but running with significantly reduced capacity. You may need to provision extra nodes to restore acceptable performance in your cluster when handling such a failure. diff --git a/deploy-manage/remote-clusters.md b/deploy-manage/remote-clusters.md index 6e6cf200ca..8e164e39cd 100644 --- a/deploy-manage/remote-clusters.md +++ b/deploy-manage/remote-clusters.md @@ -18,7 +18,7 @@ Remote clusters are especially useful in two cases: With [cross-cluster replication](/deploy-manage/tools/cross-cluster-replication.md), or CCR, you ingest data to an index on a remote cluster. This leader index is replicated to one or more read-only follower indices on your local cluster. Creating a multi-cluster architecture with cross-cluster replication enables you to configure disaster recovery, bring data closer to your users, or establish a centralized reporting cluster to process reports locally. - **Cross-cluster search** - [Cross-cluster search](/solutions/search/cross-cluster-search.md), or CCS, enables you to run a search request against one or more remote clusters. This capability provides each region with a global view of all clusters, allowing you to send a search request from a local cluster and return results from all connected remote clusters. For full {{ccs}} capabilities, the local and remote cluster must be on the same [subscription level](https://www.elastic.co/subscriptions). + [Cross-cluster search](/explore-analyze/cross-cluster-search.md), or CCS, enables you to run a search request against one or more remote clusters. This capability provides each region with a global view of all clusters, allowing you to send a search request from a local cluster and return results from all connected remote clusters. For full {{ccs}} capabilities, the local and remote cluster must be on the same [subscription level](https://www.elastic.co/subscriptions). :::{include} ./remote-clusters/_snippets/terminology.md ::: diff --git a/deploy-manage/remote-clusters/_snippets/ccs-compatibility-table.md b/deploy-manage/remote-clusters/_snippets/ccs-compatibility-table.md index c13fce584b..723cb5d44d 100644 --- a/deploy-manage/remote-clusters/_snippets/ccs-compatibility-table.md +++ b/deploy-manage/remote-clusters/_snippets/ccs-compatibility-table.md @@ -1,7 +1,7 @@ | | | |-----------------------|----------------------------------------------------------------------| diff --git a/deploy-manage/remote-clusters/ec-enable-ccs-for-eck.md b/deploy-manage/remote-clusters/ec-enable-ccs-for-eck.md index 55e2d4efbb..05e607068c 100644 --- a/deploy-manage/remote-clusters/ec-enable-ccs-for-eck.md +++ b/deploy-manage/remote-clusters/ec-enable-ccs-for-eck.md @@ -14,7 +14,7 @@ sub: # Connect {{ech}} deployments to {{eck}} clusters [ec-enable-ccs-for-eck] -These steps describe how to configure remote clusters between an {{es}} cluster in {{ech}} (ECH) and an {{es}} cluster running within [{{eck}} (ECK)](/deploy-manage/deploy/cloud-on-k8s.md). Once that’s done, you’ll be able to [run CCS queries from {{es}}](/solutions/search/cross-cluster-search.md) or [set up CCR](/deploy-manage/tools/cross-cluster-replication/set-up-cross-cluster-replication.md). +These steps describe how to configure remote clusters between an {{es}} cluster in {{ech}} (ECH) and an {{es}} cluster running within [{{eck}} (ECK)](/deploy-manage/deploy/cloud-on-k8s.md). Once that’s done, you’ll be able to [run CCS queries from {{es}}](/explore-analyze/cross-cluster-search.md) or [set up CCR](/deploy-manage/tools/cross-cluster-replication/set-up-cross-cluster-replication.md). :::{include} _snippets/terminology.md ::: diff --git a/deploy-manage/remote-clusters/ec-remote-cluster-same-ess.md b/deploy-manage/remote-clusters/ec-remote-cluster-same-ess.md index 0675f7318e..74bdae6fed 100644 --- a/deploy-manage/remote-clusters/ec-remote-cluster-same-ess.md +++ b/deploy-manage/remote-clusters/ec-remote-cluster-same-ess.md @@ -186,7 +186,7 @@ curl -H 'Content-Type: application/json' -X PUT -H "Authorization: ApiKey $EC_AP Note the following when using the {{ecloud}} RESTful API: 1. A cluster alias must contain only letters, numbers, dashes (-), or underscores (_). -2. To learn about skipping disconnected clusters, refer to the [{{es}} documentation](/solutions/search/cross-cluster-search.md#skip-unavailable-clusters). +2. To learn about skipping disconnected clusters, refer to the [{{es}} documentation](/explore-analyze/cross-cluster-search.md#skip-unavailable-clusters). 3. When remote clusters are already configured for a deployment, the `PUT` request replaces the existing configuration with the new configuration passed. Passing an empty array of resources will remove all remote clusters. The following API request retrieves the remote clusters configuration: diff --git a/deploy-manage/remote-clusters/ece-enable-ccs-for-eck.md b/deploy-manage/remote-clusters/ece-enable-ccs-for-eck.md index c94416be73..7c1df16795 100644 --- a/deploy-manage/remote-clusters/ece-enable-ccs-for-eck.md +++ b/deploy-manage/remote-clusters/ece-enable-ccs-for-eck.md @@ -14,7 +14,7 @@ sub: # Connect {{ece}} deployments to {{eck}} clusters [ece-enable-ccs-for-eck] -These steps describe how to configure remote clusters between an {{es}} cluster in {{ece}} (ECE) and an {{es}} cluster running within [{{eck}} (ECK)](/deploy-manage/deploy/cloud-on-k8s.md). Once that's done, you'll be able to [run CCS queries from {{es}}](/solutions/search/cross-cluster-search.md) or [set up CCR](/deploy-manage/tools/cross-cluster-replication/set-up-cross-cluster-replication.md). +These steps describe how to configure remote clusters between an {{es}} cluster in {{ece}} (ECE) and an {{es}} cluster running within [{{eck}} (ECK)](/deploy-manage/deploy/cloud-on-k8s.md). Once that's done, you'll be able to [run CCS queries from {{es}}](/explore-analyze/cross-cluster-search.md) or [set up CCR](/deploy-manage/tools/cross-cluster-replication/set-up-cross-cluster-replication.md). :::{include} _snippets/terminology.md ::: diff --git a/deploy-manage/remote-clusters/ece-remote-cluster-same-ece.md b/deploy-manage/remote-clusters/ece-remote-cluster-same-ece.md index 8ca39a5f2f..7d0e9c4295 100644 --- a/deploy-manage/remote-clusters/ece-remote-cluster-same-ece.md +++ b/deploy-manage/remote-clusters/ece-remote-cluster-same-ece.md @@ -197,7 +197,7 @@ curl -k -H 'Content-Type: application/json' -X PUT -H "Authorization: ApiKey $EC Note the following when using the {{ece}} RESTful API: 1. A cluster alias must contain only letters, numbers, dashes (-), or underscores (_). -2. To learn about skipping disconnected clusters, refer to the [{{es}} documentation](/solutions/search/cross-cluster-search.md#skip-unavailable-clusters). +2. To learn about skipping disconnected clusters, refer to the [{{es}} documentation](/explore-analyze/cross-cluster-search.md#skip-unavailable-clusters). 3. When remote clusters are already configured for a deployment, the `PUT` request replaces the existing configuration with the new configuration passed. Passing an empty array of resources will remove all remote clusters. The following API request retrieves the remote clusters configuration: diff --git a/deploy-manage/remote-clusters/remote-clusters-cert.md b/deploy-manage/remote-clusters/remote-clusters-cert.md index e3618f7dfe..fef335f3a2 100644 --- a/deploy-manage/remote-clusters/remote-clusters-cert.md +++ b/deploy-manage/remote-clusters/remote-clusters-cert.md @@ -410,7 +410,7 @@ You only need to create this user on the **local** cluster. :::: -Users with the `remote-search` role can then [search across clusters](../../solutions/search/cross-cluster-search.md). +Users with the `remote-search` role can then [search across clusters](../../explore-analyze/cross-cluster-search.md). ### Configure privileges for {{ccs}} and {{kib}} [clusters-privileges-ccs-kibana-cert] diff --git a/deploy-manage/security/_snippets/complete-security.md b/deploy-manage/security/_snippets/complete-security.md index cbbcac8446..441b304719 100644 --- a/deploy-manage/security/_snippets/complete-security.md +++ b/deploy-manage/security/_snippets/complete-security.md @@ -3,6 +3,6 @@ As part of your overall security strategy, you can also do the following: * Prevent unauthorized access with [password protection and role-based access control](/deploy-manage/users-roles.md). * Control access to dashboards and other saved objects in your UI using [Spaces](/deploy-manage/manage-spaces.md). -* Connect a local cluster to a [remote cluster](/deploy-manage/remote-clusters.md) to enable [cross-cluster replication](/deploy-manage/tools/cross-cluster-replication.md) and [cross-cluster search](/solutions/search/cross-cluster-search.md). +* Connect a local cluster to a [remote cluster](/deploy-manage/remote-clusters.md) to enable [cross-cluster replication](/deploy-manage/tools/cross-cluster-replication.md) and [cross-cluster search](/explore-analyze/cross-cluster-search.md). * Manage [API keys](/deploy-manage/api-keys.md) used for programmatic access to Elastic. :::: \ No newline at end of file diff --git a/deploy-manage/tools/cross-cluster-replication/set-up-cross-cluster-replication.md b/deploy-manage/tools/cross-cluster-replication/set-up-cross-cluster-replication.md index 6405a83c93..dde22f8290 100644 --- a/deploy-manage/tools/cross-cluster-replication/set-up-cross-cluster-replication.md +++ b/deploy-manage/tools/cross-cluster-replication/set-up-cross-cluster-replication.md @@ -31,7 +31,7 @@ In this guide, you’ll learn how to: You can manually create follower indices to replicate specific indices on a remote cluster, or configure auto-follow patterns to replicate rolling time series indices. ::::{tip} -If you want to replicate data across clusters in the cloud, you can [configure remote clusters on {{ecloud}}](/deploy-manage/remote-clusters/ec-enable-ccs.md). Then, you can [search across clusters](../../../solutions/search/cross-cluster-search.md) and set up {{ccr}}. +If you want to replicate data across clusters in the cloud, you can [configure remote clusters on {{ecloud}}](/deploy-manage/remote-clusters/ec-enable-ccs.md). Then, you can [search across clusters](../../../explore-analyze/cross-cluster-search.md) and set up {{ccr}}. :::: diff --git a/deploy-manage/tools/snapshot-and-restore/searchable-snapshots.md b/deploy-manage/tools/snapshot-and-restore/searchable-snapshots.md index 06fa056c3f..38a34829bf 100644 --- a/deploy-manage/tools/snapshot-and-restore/searchable-snapshots.md +++ b/deploy-manage/tools/snapshot-and-restore/searchable-snapshots.md @@ -167,7 +167,7 @@ Without replicas, rarely-accessed {{search-snap}} indices require far fewer reso When a shard of a regular index is moved between nodes, its contents are copied from another node in your cluster. In many environments, the costs of moving data between nodes are significant, especially if running in a Cloud environment with nodes in different zones. In contrast, when mounting a {{search-snap}} index or moving one of its shards, the data is always copied from the snapshot repository. This is typically much cheaper. ::::{warning} -Most cloud providers charge significant fees for data transferred between regions and for data transferred out of their platforms. You should only mount snapshots into a cluster that is in the same region as the snapshot repository. If you wish to search data across multiple regions, configure multiple clusters and use [{{ccs}}](../../../solutions/search/cross-cluster-search.md) or [{{ccr}}](../cross-cluster-replication.md) instead of {{search-snaps}}. +Most cloud providers charge significant fees for data transferred between regions and for data transferred out of their platforms. You should only mount snapshots into a cluster that is in the same region as the snapshot repository. If you wish to search data across multiple regions, configure multiple clusters and use [{{ccs}}](../../../explore-analyze/cross-cluster-search.md) or [{{ccr}}](../cross-cluster-replication.md) instead of {{search-snaps}}. :::: diff --git a/deploy-manage/upgrade/prepare-to-upgrade.md b/deploy-manage/upgrade/prepare-to-upgrade.md index 66f36834c1..1c2851ed49 100644 --- a/deploy-manage/upgrade/prepare-to-upgrade.md +++ b/deploy-manage/upgrade/prepare-to-upgrade.md @@ -59,7 +59,7 @@ The monitoring cluster should be running the same version, or a newer one, than :::: ::::{step} Upgrade remote clusters first -If you use {{ccs}}, versions 9.0.0 and later can search only remote clusters running the previous minor version, the same version, or a newer minor version in the same major version. For more information, refer to [{{ccs-cap}}](../../solutions/search/cross-cluster-search.md). +If you use {{ccs}}, versions 9.0.0 and later can search only remote clusters running the previous minor version, the same version, or a newer minor version in the same major version. For more information, refer to [{{ccs-cap}}](../../explore-analyze/cross-cluster-search.md). If you use {{ccr}}, a cluster that contains follower indices must run the same or newer (compatible) version as the remote cluster. For more information and to view the version compatibility matrix, refer to [{{ccr-cap}}](/deploy-manage/tools/cross-cluster-replication.md). diff --git a/solutions/search/cross-cluster-search.md b/explore-analyze/cross-cluster-search.md similarity index 98% rename from solutions/search/cross-cluster-search.md rename to explore-analyze/cross-cluster-search.md index 23da247c35..0655c9691a 100644 --- a/solutions/search/cross-cluster-search.md +++ b/explore-analyze/cross-cluster-search.md @@ -20,7 +20,7 @@ The following APIs support {{ccs}}: * [Search](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search) * [Async search](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-async-search-submit) * [Multi search](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-msearch) -* [Search template](search-templates.md) +* [Search template](/solutions/search/search-templates.md) * [Multi search template](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-msearch-template) * [Field capabilities](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-field-caps) * [Painless execute API](elasticsearch://reference/scripting-languages/painless/painless-api-examples.md) @@ -33,12 +33,12 @@ The following APIs support {{ccs}}: ## Prerequisites [_prerequisites] -* {{ccs-cap}} requires remote clusters. To set up remote clusters, see [*Remote clusters*](../../deploy-manage/remote-clusters.md). +* {{ccs-cap}} requires remote clusters. To set up remote clusters, see [*Remote clusters*](/deploy-manage/remote-clusters.md). To ensure your remote cluster configuration supports {{ccs}}, see [Supported {{ccs}} configurations](#ccs-supported-configurations). * To use cross-cluster search with ES|QL, both the local and remote clusters must have the appropriate [subscription level](https://www.elastic.co/subscriptions). -* The local coordinating node must have the [`remote_cluster_client`](../../deploy-manage/distributed-architecture/clusters-nodes-shards/node-roles.md#remote-node) node role. +* The local coordinating node must have the [`remote_cluster_client`](/deploy-manage/distributed-architecture/clusters-nodes-shards/node-roles.md#remote-node) node role. * If you use [sniff mode](/deploy-manage/remote-clusters/remote-clusters-self-managed.md#sniff-mode), the local coordinating node must be able to connect to seed and gateway nodes on the remote cluster. @@ -46,7 +46,7 @@ The following APIs support {{ccs}}: * If you use [proxy mode](/deploy-manage/remote-clusters/remote-clusters-self-managed.md#proxy-mode), the local coordinating node must be able to connect to the configured `proxy_address`. The proxy at this address must be able to route connections to gateway and coordinating nodes on the remote cluster. -* {{ccs-cap}} requires different security privileges on the local cluster and remote cluster. See [Configure privileges for {{ccs}}](../../deploy-manage/remote-clusters/remote-clusters-cert.md#remote-clusters-privileges-ccs) and [*Remote clusters*](../../deploy-manage/remote-clusters.md). +* {{ccs-cap}} requires different security privileges on the local cluster and remote cluster. See [Configure privileges for {{ccs}}](/deploy-manage/remote-clusters/remote-clusters-cert.md#remote-clusters-privileges-ccs) and [*Remote clusters*](/deploy-manage/remote-clusters.md). ## {{ccs-cap}} examples [ccs-example] @@ -1026,7 +1026,7 @@ The [vector tile search API](https://www.elastic.co/docs/api/doc/elasticsearch/o ::::{note} -The [Approximate kNN search](vector/knn.md#approximate-knn) doesn’t support minimizing network roundtrips, and sets the parameter `ccs_minimize_roundtrips` to `false`. +The [Approximate kNN search](/solutions/search/vector/knn.md#approximate-knn) doesn’t support minimizing network roundtrips, and sets the parameter `ccs_minimize_roundtrips` to `false`. :::: @@ -1115,7 +1115,7 @@ Version 8.19 is the final minor release in the 8.x series. Unlike past releases, $$$ccs-version-compatibility$$$ -:::{include} ../../deploy-manage/remote-clusters/_snippets/ccs-compatibility-table.md +:::{include} /deploy-manage/remote-clusters/_snippets/ccs-compatibility-table.md ::: ::::{important} @@ -1144,4 +1144,4 @@ Running multiple versions of {{es}} in the same cluster beyond the duration of a :::: -For more information about upgrades, see [Upgrading {{es}}](../../deploy-manage/upgrade/deployment-or-cluster.md). +For more information about upgrades, see [Upgrading {{es}}](/deploy-manage/upgrade/deployment-or-cluster.md). diff --git a/solutions/search/using-resolve-cluster-endpoint-before-cross-cluster-search.md b/explore-analyze/cross-cluster-search/using-resolve-cluster-endpoint-before-cross-cluster-search.md similarity index 98% rename from solutions/search/using-resolve-cluster-endpoint-before-cross-cluster-search.md rename to explore-analyze/cross-cluster-search/using-resolve-cluster-endpoint-before-cross-cluster-search.md index 9c1c8eee92..0962e2bf56 100644 --- a/solutions/search/using-resolve-cluster-endpoint-before-cross-cluster-search.md +++ b/explore-analyze/cross-cluster-search/using-resolve-cluster-endpoint-before-cross-cluster-search.md @@ -14,7 +14,7 @@ You can use the [`_resolve/cluster`](https://www.elastic.co/docs/api/doc/elastic You may want to exclude a cluster or index from a search when: -1. A remote cluster is unavailable and configured with `skip_unavailable`=`false`. Executing a {{ccs}} under those conditions will cause [the entire search to fail](/solutions/search/cross-cluster-search.md#cross-cluster-search-failures). +1. A remote cluster is unavailable and configured with `skip_unavailable`=`false`. Executing a {{ccs}} under those conditions will cause [the entire search to fail](/explore-analyze/cross-cluster-search.md#cross-cluster-search-failures). 2. A cluster has no matching indices, aliases or data streams for the index expression, or your user does not have permissions to search them. For example, if your index expression is `logs*,remote1:logs*` and the `remote1` cluster has no matching indices, that cluster will return no results if included in a {{ccs}}. 3. The index expression, combined with any query parameters you specify, might trigger exceptions. In these cases, the "error" field in the `_resolve/cluster` response will be present. This is also where security/permission errors will be shown. 4. A remote cluster is running an older version that does not support features needed for your search. diff --git a/explore-analyze/find-and-organize/data-views.md b/explore-analyze/find-and-organize/data-views.md index ad0ce607e9..77c0fbd2b6 100644 --- a/explore-analyze/find-and-organize/data-views.md +++ b/explore-analyze/find-and-organize/data-views.md @@ -111,7 +111,7 @@ serverless: unavailable stack: ga ``` -If your {{es}} clusters are configured for [{{ccs}}](../../solutions/search/cross-cluster-search.md), you can create a {{data-source}} to search across the clusters of your choosing. Specify data streams, indices, and aliases in a remote cluster using the following syntax: +If your {{es}} clusters are configured for [{{ccs}}](../../explore-analyze/cross-cluster-search.md), you can create a {{data-source}} to search across the clusters of your choosing. Specify data streams, indices, and aliases in a remote cluster using the following syntax: ```ts : @@ -149,7 +149,7 @@ cluster_*:logstash-*,-cluster_one:* Once you configure a {{data-source}} to use the {{ccs}} syntax, all searches and aggregations using that {{data-source}} in {{kib}} take advantage of {{ccs}}. -For more information, refer to [Excluding clusters or indicies from cross-cluster search](../../solutions/search/cross-cluster-search.md#exclude-problematic-clusters). +For more information, refer to [Excluding clusters or indicies from cross-cluster search](../../explore-analyze/cross-cluster-search.md#exclude-problematic-clusters). ## Delete a {{data-source}} [delete-data-view] diff --git a/explore-analyze/query-filter/languages/eql.md b/explore-analyze/query-filter/languages/eql.md index 012acd4d42..d23a4ed4a4 100644 --- a/explore-analyze/query-filter/languages/eql.md +++ b/explore-analyze/query-filter/languages/eql.md @@ -1248,7 +1248,7 @@ This functionality is in technical preview and may be changed or removed in a fu :::: -The EQL search API supports [cross-cluster search](../../../solutions/search/cross-cluster-search.md). However, the local and [remote clusters](../../../deploy-manage/remote-clusters.md) must use the same {{es}} version if they have versions prior to 7.17.7 (included) or prior to 8.5.1 (included). +The EQL search API supports [cross-cluster search](../../../explore-analyze/cross-cluster-search.md). However, the local and [remote clusters](../../../deploy-manage/remote-clusters.md) must use the same {{es}} version if they have versions prior to 7.17.7 (included) or prior to 8.5.1 (included). The following [cluster update settings](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings) request adds two remote clusters: `cluster_one` and `cluster_two`. diff --git a/explore-analyze/toc.yml b/explore-analyze/toc.yml index 1ad6b1c26e..d59cfc3620 100644 --- a/explore-analyze/toc.yml +++ b/explore-analyze/toc.yml @@ -165,6 +165,9 @@ toc: - file: scripting/painless-lab.md - file: scripting/modules-scripting-expression.md - file: scripting/modules-scripting-engine.md + - file: cross-cluster-search.md + children: + - file: cross-cluster-search/using-resolve-cluster-endpoint-before-cross-cluster-search.md - file: ai-features.md children: - file: ai-features/ai-assistant.md diff --git a/explore-analyze/transforms/transform-limitations.md b/explore-analyze/transforms/transform-limitations.md index f9f396cc6d..eac5693f38 100644 --- a/explore-analyze/transforms/transform-limitations.md +++ b/explore-analyze/transforms/transform-limitations.md @@ -25,7 +25,7 @@ If you use the `latest` type of transform and the source index has field names t ### Transforms support {{ccs}} if the remote cluster is configured properly [transforms-ccs-limitation] -If you use [{{ccs}}](../../solutions/search/cross-cluster-search.md), the remote cluster must support the search and aggregations you use in your transforms. Transforms validate their configuration; if you use {{ccs}} and the validation fails, make sure that the remote cluster supports the query and aggregations you use. +If you use [{{ccs}}](../../explore-analyze/cross-cluster-search.md), the remote cluster must support the search and aggregations you use in your transforms. Transforms validate their configuration; if you use {{ccs}} and the validation fails, make sure that the remote cluster supports the query and aggregations you use. ### Using scripts in transforms [transform-painless-limitation] diff --git a/redirects.yml b/redirects.yml index fcd9111192..08bb7c9745 100644 --- a/redirects.yml +++ b/redirects.yml @@ -617,3 +617,7 @@ redirects: 'solutions/security/cloud/integrations/rapid7.md': 'solutions/security/integrations/rapid7.md' 'solutions/security/cloud/integrations/tenablevm.md': 'solutions/security/integrations/tenablevm.md' 'solutions/security/cloud/integrations/wiz.md': 'solutions/security/integrations/wiz.md' + + # Move CCS feature docs to explore-analyze + 'solutions/search/cross-cluster-search.md': 'explore-analyze/cross-cluster-search.md' + 'solutions/search/cross-cluster-search/using-resolve-cluster-endpoint-before-cross-cluster-search.md': 'explore-analyze/cross-cluster-search/using-resolve-cluster-endpoint-before-cross-cluster-search.md' diff --git a/reference/glossary/index.md b/reference/glossary/index.md index f141705211..438e54ac3e 100644 --- a/reference/glossary/index.md +++ b/reference/glossary/index.md @@ -160,7 +160,7 @@ $$$glossary-ccr$$$ {{ccr}} (CCR) : Replicates [data streams](/reference/glossary/index.md#glossary-data-stream) and [indices](/reference/glossary/index.md#glossary-index) from [remote clusters](/reference/glossary/index.md#glossary-remote-cluster) in a [local cluster](/reference/glossary/index.md#glossary-local-cluster). See [{{ccr-cap}}](/deploy-manage/tools/cross-cluster-replication.md). $$$glossary-ccs$$$ {{ccs}} (CCS) -: Searches [data streams](/reference/glossary/index.md#glossary-data-stream) and [indices](/reference/glossary/index.md#glossary-index) on [remote clusters](/reference/glossary/index.md#glossary-remote-cluster) from a [local cluster](/reference/glossary/index.md#glossary-local-cluster). See [Search across clusters](/solutions/search/cross-cluster-search.md). +: Searches [data streams](/reference/glossary/index.md#glossary-data-stream) and [indices](/reference/glossary/index.md#glossary-index) on [remote clusters](/reference/glossary/index.md#glossary-remote-cluster) from a [local cluster](/reference/glossary/index.md#glossary-local-cluster). See [Search across clusters](/explore-analyze/cross-cluster-search.md). $$$CRD$$$CRD : [Custom resource definition](https://kubernetes.io/docs/reference/glossary/?fundamental=true#term-CustomResourceDefinition). {{eck}} extends the Kubernetes API with CRDs to allow users to deploy and manage Elasticsearch, Kibana, APM Server, Enterprise Search, Beats, Elastic Agent, Elastic Maps Server, and Logstash resources just as they would do with built-in Kubernetes resources. diff --git a/solutions/search/the-search-api.md b/solutions/search/the-search-api.md index 8e6af4be87..801235297f 100644 --- a/solutions/search/the-search-api.md +++ b/solutions/search/the-search-api.md @@ -112,7 +112,7 @@ You can use the following options to customize your searches. **Run an async search**
{{es}} searches are designed to run on large volumes of data quickly, often returning results in milliseconds. For this reason, searches are *synchronous* by default. The search request waits for complete results before returning a response. -However, complete results can take longer for searches across large data sets or [multiple clusters](cross-cluster-search.md). +However, complete results can take longer for searches across large data sets or [multiple clusters](/explore-analyze/cross-cluster-search.md). To avoid long waits, you can run an *asynchronous*, or *async*, search instead. An [async search](async-search-api.md) lets you retrieve partial results for a long-running search now and get complete results later. diff --git a/solutions/search/vector/knn.md b/solutions/search/vector/knn.md index 2025dbf0b2..c819d84cf5 100644 --- a/solutions/search/vector/knn.md +++ b/solutions/search/vector/knn.md @@ -1175,7 +1175,7 @@ The `inner_hits` block returns the most relevant paragraphs within each top-leve ### Limitations for approximate kNN search [approximate-knn-limitations] -* When using kNN search in [{{ccs}}](../../../solutions/search/cross-cluster-search.md), the [`ccs_minimize_roundtrips`](../../../solutions/search/cross-cluster-search.md#ccs-min-roundtrips) option is not supported. +* When using kNN search in [{{ccs}}](../../../explore-analyze/cross-cluster-search.md), the [`ccs_minimize_roundtrips`](../../../explore-analyze/cross-cluster-search.md#ccs-min-roundtrips) option is not supported. * {{es}} uses the [HNSW algorithm](https://arxiv.org/abs/1603.09320) for efficient kNN. Like most approximate methods, HNSW trades perfect accuracy for speed, so results aren’t always the true *k* closest neighbors. ::::{note} diff --git a/solutions/security/advanced-entity-analytics/privileged-user-monitoring-requirements.md b/solutions/security/advanced-entity-analytics/privileged-user-monitoring-requirements.md index 6ec5aace8b..71d4506108 100644 --- a/solutions/security/advanced-entity-analytics/privileged-user-monitoring-requirements.md +++ b/solutions/security/advanced-entity-analytics/privileged-user-monitoring-requirements.md @@ -41,7 +41,7 @@ serverless: ## Known limitations -* Currently, none of the privileged user monitoring visualizations support [cross-cluster search](/solutions/search/cross-cluster-search.md) as part of the data that they query from. +* Currently, none of the privileged user monitoring visualizations support [cross-cluster search](/explore-analyze/cross-cluster-search.md) as part of the data that they query from. * You can define up to 10,000 privileged users per data source. diff --git a/solutions/security/detect-and-alert/cross-cluster-search-detection-rules.md b/solutions/security/detect-and-alert/cross-cluster-search-detection-rules.md index c0c4979653..176a16985c 100644 --- a/solutions/security/detect-and-alert/cross-cluster-search-detection-rules.md +++ b/solutions/security/detect-and-alert/cross-cluster-search-detection-rules.md @@ -9,10 +9,10 @@ products: # Cross-cluster search and detection rules [rules-cross-cluster-search] -[Cross-cluster search](../../search/cross-cluster-search.md) is an {{es}} feature that allows one cluster (the *local* cluster) to query data in a separate cluster (the *remote* cluster). {{elastic-sec}}'s detection rules can perform a cross-cluster search to query data in remote clusters. +[Cross-cluster search](/explore-analyze/cross-cluster-search.md) is an {{es}} feature that allows one cluster (the *local* cluster) to query data in a separate cluster (the *remote* cluster). {{elastic-sec}}'s detection rules can perform a cross-cluster search to query data in remote clusters. ::::{admonition} Requirements -* To learn about the requirements for using cross-cluster search in the {{stack}}, refer to [Cross-cluster search](../../search/cross-cluster-search.md). +* To learn about the requirements for using cross-cluster search in the {{stack}}, refer to [Cross-cluster search](/explore-analyze/cross-cluster-search.md). * Using cross-cluster search for {{esql}} rules in the {{stack}} requires an [Enterprise subscription](https://www.elastic.co/pricing). :::: diff --git a/solutions/security/get-started/elastic-security-requirements.md b/solutions/security/get-started/elastic-security-requirements.md index dc2d2fd99c..009908658a 100644 --- a/solutions/security/get-started/elastic-security-requirements.md +++ b/solutions/security/get-started/elastic-security-requirements.md @@ -90,6 +90,6 @@ stack: For information on how to perform cross-cluster searches on {{elastic-sec}} indices, see: -* [Search across cluster](/solutions/search/cross-cluster-search.md) (for self-managed {{stack}} deployments) +* [Search across cluster](/explore-analyze/cross-cluster-search.md) (for self-managed {{stack}} deployments) * [Enable cross-cluster search](/deploy-manage/remote-clusters/ec-enable-ccs.md) (for hosted deployments) diff --git a/solutions/toc.yml b/solutions/toc.yml index 9d770b5255..0773410eeb 100644 --- a/solutions/toc.yml +++ b/solutions/toc.yml @@ -96,9 +96,7 @@ toc: - file: search/search-applications/search-application-api.md - file: search/search-applications/search-application-security.md - file: search/search-applications/search-application-client.md - - file: search/cross-cluster-search.md - children: - - file: search/using-resolve-cluster-endpoint-before-cross-cluster-search.md + - file: search/apis-and-tools.md - file: search/ai-assistant.md - file: search/query-rules-ui.md From 8918c9246c3e784a6b253f474a66f94892abd4e9 Mon Sep 17 00:00:00 2001 From: shainaraskas Date: Wed, 10 Dec 2025 13:56:20 -0500 Subject: [PATCH 2/2] fix codeowners --- .github/CODEOWNERS | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 882eedd49b..1b2e2a8df9 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -20,6 +20,7 @@ /explore-analyze/query-filter/ @elastic/developer-docs @elastic/experience-docs /explore-analyze/report-and-share/ @elastic/experience-docs /explore-analyze/scripting/ @elastic/admin-docs +/explore-analyze/cross-cluster-search/ @elastic/developer-docs /explore-analyze/transforms/ @elastic/developer-docs /explore-analyze/visualize/ @elastic/experience-docs