[6.5] Drafts index.asciidoc for ML Guide (#773) (#774)

Author: lcawl

docs/en/install-upgrade/upgrading-stack.asciidoc

@@ -87,7 +87,7 @@ restart all nodes to maintain communication across the cluster.
 .. Make sure real passwords are configured for the built-in `elasticsearch`,
 `kibana`, and `logstash_system` users. They cannot use the 5.n default
 password (`changeme`). For more information, see
-{stack-ov}/built-in-users.html[Built-in users].
+{ref}/built-in-users.html[Built-in users].
 
 . Stop any {xpack} machine learning jobs that are running before starting the
 upgrade process. See

docs/en/stack/index.asciidoc

@@ -17,7 +17,7 @@ include::{asciidoc-dir}/../../shared/attributes.asciidoc[]
 
 include::introduction.asciidoc[]
 
-include::ml/index.asciidoc[]
+include::ml/ml-index.asciidoc[]
 
 include::troubleshooting.asciidoc[]
 

docs/en/stack/license.asciidoc

@@ -31,7 +31,7 @@ you install in {kib} or by using the {ref}/update-license.html[update license AP
 
 TIP: If you are using a basic or trial license, {security-features} are disabled
 by default. In all other licenses, {security-features} are enabled by default;
-you must {stack-ov}/security-getting-started.html[secure the {stack}] or disable
+you must {ref}/secure-cluster.html[secure the {stack}] or disable
 the {security-features}. 
 
 --

docs/en/stack/ml/analyzing.asciidoc

@@ -23,7 +23,7 @@ actual data values, the bounds for the expected values, and the anomalies that
 occur outside these bounds.
 
 [role="screenshot"]
-image::ml/images/ml-gs-job-analysis.jpg["Example screenshot from the Machine Learning Single Metric Viewer in Kibana"]
+image::images/ml-gs-job-analysis.jpg["Example screenshot from the Machine Learning Single Metric Viewer in Kibana"]
 
 For a more detailed walk-through of {ml-features}, see
 <<ml-getting-started>>.

docs/en/stack/ml/buckets.asciidoc

@@ -29,7 +29,7 @@ high multi-bucket impact are depicted in the *Anomaly Explorer* and the
 *Single Metric Viewer* with a cross symbol instead of a dot. For example:
 
 [role="screenshot"]
-image::ml/images/multibucketanalysis.jpg["Examples of anomalies with multi-bucket impact in {kib}"]
+image::images/multibucketanalysis.jpg["Examples of anomalies with multi-bucket impact in {kib}"]
 
 In this example, you can see that some of the anomalies fall within the shaded
 blue area, which represents the bounds for the expected values. The bounds are

docs/en/stack/ml/forecasting.asciidoc

@@ -19,7 +19,7 @@ that you created at different times. You can create a forecast by using the
 
 
 [role="screenshot"]
-image::ml/images/ml-gs-job-forecast.jpg["Example screenshot from the Machine Learning Single Metric Viewer in Kibana"]
+image::images/ml-gs-job-forecast.jpg["Example screenshot from the Machine Learning Single Metric Viewer in Kibana"]
 
 The yellow line in the chart represents the predicted data values. The
 shaded yellow area represents the bounds for the predicted values, which also

docs/en/stack/ml/get-started-trial.asciidoc

@@ -0,0 +1,21 @@
+By default, when you install {stack} products, they apply basic licenses with no 
+expiration dates. To view your license in {kib}, go to **Management** and click 
+**License Management**.
+
+[role="screenshot"]
+image::images/management-license.png["The License Management page in {kib}"]
+
+For more information about Elastic license levels, see 
+https://www.elastic.co/subscriptions.
+
+You can start a 30-day trial to try out all of the platinum features, including 
+{security-features} and {ml-features}. Click **Start trial** on the 
+**License Management** page in {kib}.
+
+IMPORTANT: If your cluster has already activated a trial license for the current 
+major version, you cannot start a new trial. For example, if you have already 
+activated a trial for v6.0, you cannot start a new trial until v7.0.
+
+At the end of the trial period, the platinum features operate in a degraded
+mode. You can revert to a basic license, extend the trial, or purchase a
+subscription. 

docs/en/stack/ml/getting-started-forecast.asciidoc

@@ -14,7 +14,7 @@ in this tutorial. For example, select the `total-requests` job.
 +
 --
 [role="screenshot"]
-image::ml/images/ml-gs-forecast.jpg["Create a forecast from the Single Metric Viewer"]
+image::images/ml-gs-forecast.jpg["Create a forecast from the Single Metric Viewer"]
 --
 
 . Specify a duration for your forecast. This value indicates how far to
@@ -25,14 +25,14 @@ duration of 1 week: +
 +
 --
 [role="screenshot"]
-image::ml/images/ml-gs-duration.jpg["Specify a duration of 1w"]
+image::images/ml-gs-duration.jpg["Specify a duration of 1w"]
 --
 
 . View the forecast in the **Single Metric Viewer**: +
 +
 --
 [role="screenshot"]
-image::ml/images/ml-gs-forecast-results.jpg["View a forecast from the Single Metric Viewer"]
+image::images/ml-gs-forecast-results.jpg["View a forecast from the Single Metric Viewer"]
 
 The yellow line in the chart represents the predicted data values. The shaded
 yellow area represents the bounds for the predicted values, which also gives an
@@ -56,14 +56,14 @@ from the list. For example: +
 +
 --
 [role="screenshot"]
-image::ml/images/ml-gs-forecast-open.jpg["Open a forecast in the Single Metric Viewer"]
+image::images/ml-gs-forecast-open.jpg["Open a forecast in the Single Metric Viewer"]
 --
 
 .. View the forecast and actual data in the **Single Metric Viewer**: +
 +
 --
 [role="screenshot"]
-image::ml/images/ml-gs-forecast-actual.jpg["View a forecast over actual data in the Single Metric Viewer"]
+image::images/ml-gs-forecast-actual.jpg["View a forecast over actual data in the Single Metric Viewer"]
 
 The chart contains the actual data values, the bounds for the expected values,
 the anomalies, the forecast data values, and the bounds for the forecast. This

docs/en/stack/ml/getting-started-multi.asciidoc

@@ -44,7 +44,7 @@ go to `http://localhost:5601/`.
 +
 --
 [role="screenshot"]
-image::ml/images/ml-gs-multi-job.jpg["Create a new job from the server-metrics index"]
+image::images/ml-gs-multi-job.jpg["Create a new job from the server-metrics index"]
 --
 
 .. For the **Fields**, select `high mean(response)` and `sum(total)`. This
@@ -110,7 +110,7 @@ sum `total` values over time. For example:
 +
 --
 [role="screenshot"]
-image::ml/images/ml-gs-job2-split.jpg["Kibana charts for data split by service"]
+image::images/ml-gs-job2-split.jpg["Kibana charts for data split by service"]
 --
 
 . Provide a name for the job, for example `response_requests_by_app`. The job
@@ -140,7 +140,7 @@ event occurs outside of the model, that event is identified as an anomaly.
 You can use the **Anomaly Explorer** in {kib} to view the analysis results:
 
 [role="screenshot"]
-image::ml/images/ml-gs-job2-explorer.jpg["Job results in the Anomaly Explorer"]
+image::images/ml-gs-job2-explorer.jpg["Job results in the Anomaly Explorer"]
 
 You can explore the overall anomaly time line, which shows the maximum anomaly
 score for each section in the specified time period. You can change the time
@@ -165,7 +165,7 @@ the `host` field as an influencer, you can also optionally view the results in
 swim lanes for each host name:
 
 [role="screenshot"]
-image::ml/images/ml-gs-job2-explorer-host.jpg["Job results sorted by host"]
+image::images/ml-gs-job2-explorer-host.jpg["Job results sorted by host"]
 
 By default, the swim lanes are ordered by their maximum anomaly score values.
 You can click on the sections in the swim lane to see details about the
@@ -185,7 +185,7 @@ anomalies in that time period. For example, click on the red section in the swim
 lane for `server_2`:
 
 [role="screenshot"]
-image::ml/images/ml-gs-job2-explorer-anomaly.jpg["Job results for an anomaly"]
+image::images/ml-gs-job2-explorer-anomaly.jpg["Job results for an anomaly"]
 
 You can see exact times when anomalies occurred and which detectors or metrics
 caught the anomaly. Also note that because you split the data by the `service`
@@ -197,7 +197,7 @@ Below the charts, there is a table that provides more information, such as the
 typical and actual values and the influencers that contributed to the anomaly.
 
 [role="screenshot"]
-image::ml/images/ml-gs-job2-explorer-table.jpg["Job results table"]
+image::images/ml-gs-job2-explorer-table.jpg["Job results table"]
 
 Notice that there are anomalies for both detectors, that is to say for both the
 `high_mean(response)` and the `sum(total)` metrics in this time interval. The

docs/en/stack/ml/getting-started-next.asciidoc

@@ -52,5 +52,4 @@ multi-metric jobs and split the data or create more complex analysis functions
 as necessary. For examples of more complicated configuration options, see
 <<ml-configuring>>.
 
-If you encounter problems, we're here to help. See <<help>> and
-<<ml-troubleshooting>>.
+If you encounter problems, we're here to help. See <<ml-troubleshooting>>.

docs/en/stack/ml/getting-started-single.asciidoc

@@ -36,7 +36,7 @@ go to `http://localhost:5601/`.
 +
 --
 [role="screenshot"]
-image::ml/images/ml-gs-single-job.jpg["Create a new job from the server-metrics index"]
+image::images/ml-gs-single-job.jpg["Create a new job from the server-metrics index"]
 --
 
 .. For the **Aggregation**, select `Sum`. This value specifies the analysis
@@ -97,7 +97,7 @@ you've got the time range set up, click the **Go** button. +
 +
 --
 [role="screenshot"]
-image::ml/images/ml-gs-job1-time.jpg["Setting the time range for the {dfeed}"]
+image::images/ml-gs-job1-time.jpg["Setting the time range for the {dfeed}"]
 --
 +
 --
@@ -117,7 +117,7 @@ job and create a job group.
 +
 --
 [role="screenshot"]
-image::ml/images/ml-gs-job1.jpg["A graph of the total number of requests over time"]
+image::images/ml-gs-job1.jpg["A graph of the total number of requests over time"]
 --
 
 As the job is created, the graph is updated to give a visual representation of
@@ -141,7 +141,7 @@ API reference information, see {ref}/ml-apis.html[Machine Learning APIs].
 After you create a job, you can see its status in the **Job Management** tab: +
 
 [role="screenshot"]
-image::ml/images/ml-gs-job1-manage1.jpg["Status information for the total-requests job"]
+image::images/ml-gs-job1-manage1.jpg["Status information for the total-requests job"]
 
 The following information is provided for each job:
 
@@ -211,7 +211,7 @@ For example, if you did not use the full data when you created the job, you can
 now process the remaining data by restarting the {dfeed}:
 
 . In the **Machine Learning** / **Job Management** tab, click the following
-button to start the {dfeed}: image:ml/images/ml-start-feed.jpg["Start {dfeed}"]
+button to start the {dfeed}: image:images/ml-start-feed.jpg["Start {dfeed}"]
 
 
 . Choose a start time and end time. For example,
@@ -222,7 +222,7 @@ otherwise you might miss anomalies. +
 +
 --
 [role="screenshot"]
-image::ml/images/ml-gs-job1-datafeed.jpg["Restarting a {dfeed}"]
+image::images/ml-gs-job1-datafeed.jpg["Restarting a {dfeed}"]
 --
 
 The {dfeed} state changes to `started`, the job state changes to `opened`,
@@ -233,7 +233,7 @@ TIP: If your data is being loaded continuously, you can continue running the job
 in real time. For this, start your {dfeed} and select **No end time**.
 
 If you want to stop the {dfeed} at this point, you can click the following
-button: image:ml/images/ml-stop-feed.jpg["Stop {dfeed}"]
+button: image:images/ml-stop-feed.jpg["Stop {dfeed}"]
 
 Now that you have processed all the data, let's start exploring the job results.
 
@@ -267,7 +267,7 @@ Single Metric Viewer::
 By default when you view the results for a single metric job, the
 **Single Metric Viewer** opens:
 [role="screenshot"]
-image::ml/images/ml-gs-job1-analysis.jpg["Single Metric Viewer for total-requests job"]
+image::images/ml-gs-job1-analysis.jpg["Single Metric Viewer for total-requests job"]
 
 
 The blue line in the chart represents the actual data values. The shaded blue
@@ -299,7 +299,7 @@ anomaly data point. If you hover over the point, you can see more information
 about that data point. You can also see details in the **Anomalies** section
 of the viewer. For example:
 [role="screenshot"]
-image::ml/images/ml-gs-job1-anomalies.jpg["Single Metric Viewer Anomalies for total-requests job"]
+image::images/ml-gs-job1-anomalies.jpg["Single Metric Viewer Anomalies for total-requests job"]
 
 For each anomaly you can see key details such as the time, the actual and
 expected ("typical") values, and their probability.
@@ -319,13 +319,13 @@ show all anomalies.
 You can see the same information in a different format by using the
 **Anomaly Explorer**:
 [role="screenshot"]
-image::ml/images/ml-gs-job1-explorer.jpg["Anomaly Explorer for total-requests job"]
+image::images/ml-gs-job1-explorer.jpg["Anomaly Explorer for total-requests job"]
 
 
 Click one of the red sections in the swim lane to see details about the anomalies
 that occurred in that time interval. For example:
 [role="screenshot"]
-image::ml/images/ml-gs-job1-explorer-anomaly.jpg["Anomaly Explorer details for total-requests job"]
+image::images/ml-gs-job1-explorer-anomaly.jpg["Anomaly Explorer details for total-requests job"]
 
 After you have identified anomalies, often the next step is to try to determine
 the context of those situations. For example, are there other factors that are

docs/en/stack/ml/getting-started-wizards.asciidoc

@@ -38,7 +38,7 @@ go to `http://localhost:5601/`.
 You can then choose from a list of job wizards. For example:
 
 [role="screenshot"]
-image::ml/images/ml-create-job.jpg["Job creation wizards in {kib}"]
+image::images/ml-create-job.jpg["Job creation wizards in {kib}"]
 
 If you are not certain which wizard to use, there is also a **Data Visualizer**
 that can help you explore the fields in your data.
@@ -49,7 +49,7 @@ To learn more about the sample data:
 +
 --
 [role="screenshot"]
-image::ml/images/ml-data-visualizer.jpg["Data Visualizer in {kib}"]
+image::images/ml-data-visualizer.jpg["Data Visualizer in {kib}"]
 --
 
 . Select a time period that you're interested in exploring by using the time
@@ -64,7 +64,7 @@ that using a large sample size increases query run times and increases the load
 on the cluster.
 
 [role="screenshot"]
-image::ml/images/ml-data-metrics.jpg["Data Visualizer output for metrics in {kib}"]
+image::images/ml-data-metrics.jpg["Data Visualizer output for metrics in {kib}"]
 
 The fields in the indices are listed in two sections.  The first section contains
 the numeric ("metric") fields. The second section contains non-metric fields
@@ -78,21 +78,21 @@ the values in the data are clustered. Alternatively, you can view the top values
 for metric fields. For example:
 
 [role="screenshot"]
-image::ml/images/ml-data-topmetrics.jpg["Data Visualizer output for top values in {kib}"]
+image::images/ml-data-topmetrics.jpg["Data Visualizer output for top values in {kib}"]
 
 For date fields, the **Data Visualizer** provides the earliest and latest field
 values and the number and percentage of documents that contain the field
 during the selected time period. For example:
 
 [role="screenshot"]
-image::ml/images/ml-data-dates.jpg["Data Visualizer output for date fields in {kib}"]
+image::images/ml-data-dates.jpg["Data Visualizer output for date fields in {kib}"]
 
 For keyword fields, the **Data Visualizer** provides the number of distinct
 values, a list of the top values, and the number and percentage of documents
 that contain the field during the selected time period. For example:
 
 [role="screenshot"]
-image::ml/images/ml-data-keywords.jpg["Data Visualizer output for date fields in {kib}"]
+image::images/ml-data-keywords.jpg["Data Visualizer output for date fields in {kib}"]
 
 In this tutorial, you will create single and multi-metric jobs that use the
 `total`, `response`, `service`, and `host` fields. Though there is an option to

docs/en/stack/ml/getting-started.asciidoc

@@ -55,14 +55,15 @@ easier to control which users have authority to view and manage the jobs,
 By default, you can perform all of the steps in this tutorial by using the
 built-in `elastic` super user. However, the password must be set before the user
 can do anything. For information about how to set that password, see
-<<security-getting-started>>.
+{ref}/security-getting-started.html[Getting started with security].
 
 If you are performing these steps in a production environment, take extra care
 because `elastic` has the `superuser` role and you could inadvertently make
 significant changes to the system. You can alternatively assign the
 `machine_learning_admin` and `kibana_user` roles to a user ID of your choice.
 
-For more information, see <<built-in-roles>> and <<privileges-list-cluster>>.
+For more information, see {ref}/built-in-roles.html[Built-in roles] and
+{ref}/security-privileges.html[Security privileges].
 
 --
 

docs/en/stack/ml/images/management-license.png

@@ -1,33 +1,17 @@
-[role="xpack"]
-[[xpack-ml]]
-= Machine learning in the Elastic Stack
+= Machine Learning in the Elastic Stack
 
-[partintro]
---
-Machine learning is tightly integrated with the {stack}. Data is pulled
-from {es} for analysis and anomaly results are displayed in {kib} dashboards.
+:doctype:           book
+:forum:             https://discuss.elastic.co/c/x-pack
+:blog-ref:          https://www.elastic.co/blog/
+:wikipedia:         https://en.wikipedia.org/wiki
+:es-repo-dir:       {docdir}/../../../../../elasticsearch/docs/reference
 
-* <<ml-overview>>
-* <<ml-getting-started>>
-* <<ml-configuring>>
-* <<stopping-ml>>
-* <<ml-troubleshooting, Troubleshooting Machine Learning>>
-* <<ml-api-quickref>>
-* <<ml-functions>>
+include::{asciidoc-dir}/../../shared/versions/stack/{source_branch}.asciidoc[]
+include::{asciidoc-dir}/../../shared/attributes.asciidoc[]
 
+include::ml-index.asciidoc[]
 
---
-
-include::overview.asciidoc[]
-
-include::getting-started.asciidoc[]
-
-include::{es-repo-dir}/ml/configuring.asciidoc[]
-
-include::{es-repo-dir}/ml/stopping-ml.asciidoc[]
-
-include::api-quickref.asciidoc[]
-
-include::{es-repo-dir}/ml/functions.asciidoc[]
+include::troubleshooting.asciidoc[]
 
+include::limitations.asciidoc[]