[docs] Miscellaneous docs clean up (#17372) (#17383)

* remove unused substitutions
* move images
* validate build

(cherry picked from commit 284272b)

Co-authored-by: Colleen McGinnis <colleen.mcginnis@elastic.co>

Author: mergify[bot]

docs/docset.yml

@@ -601,7 +601,7 @@ A few log entries come from Buffalo, so the query produces the following respons
 
 If you are using Kibana to visualize your data, you can also explore the Filebeat data in Kibana:
 
-:::{image} ../images/kibana-filebeat-data.png
+:::{image} images/kibana-filebeat-data.png
 :alt: Discovering Filebeat data in Kibana
 :::
 

docs/reference/advanced-pipeline.md

@@ -64,7 +64,7 @@ Check out [Installing {{agent}}](docs-content://reference/ingestion-tools/fleet/
 
 1. Go to the {{kib}} home page, and click **Add integrations**.
 
-    :::{image} ../images/kibana-home.png
+    :::{image} images/kibana-home.png
     :alt: {{kib}} home page
     :class: screenshot
     :::
@@ -125,7 +125,7 @@ After you have confirmed enrollment and data is coming in,  click **View assets*
 
 For traditional Stack Monitoring UI, the dashboards marked **[Logs {{ls}}]** are used to visualize the logs produced by your {{ls}} instances, with those marked **[Metrics {{ls}}]** for the technical preview metrics dashboards. These are populated with data only if you selected the **Metrics (Technical Preview)** checkbox.
 
-:::{image} ../images/integration-assets-dashboards.png
+:::{image} images/integration-assets-dashboards.png
 :alt: Integration assets
 :class: screenshot
 :::
@@ -137,7 +137,7 @@ A number of dashboards are included to view {{ls}} as a whole, and dashboards th
 
 From the list of assets, open the **[Metrics {{ls}}] {{ls}} overview** dashboard to view overall performance. Then follow the navigation panel to further drill down into {{ls}} performance.
 
-:::{image} ../images/integration-dashboard-overview.png
+:::{image} images/integration-dashboard-overview.png
 :alt: The {{ls}} Overview dashboard in {{kib}} with various metrics from your monitored {ls}
 :class: screenshot
 :::

docs/reference/dashboard-monitoring-with-elastic-agent.md

@@ -24,7 +24,7 @@ Each event written to the dead letter queue includes the original event, metadat
 
 To process events in the dead letter queue, create a Logstash pipeline configuration that uses the [`dead_letter_queue` input plugin](/reference/plugins-inputs-dead_letter_queue.md) to read from the queue. See [Processing events in the dead letter queue](#processing-dlq-events) for more information.
 
-:::{image} ../images/dead_letter_queue.png
+:::{image} images/dead_letter_queue.png
 :alt: Diagram showing pipeline reading from the dead letter queue
 :::
 

docs/reference/dead-letter-queues.md

@@ -14,7 +14,7 @@ The goal of this document is to highlight the most common architecture patterns
 
 For first time users, if you simply want to tail a log file to grasp the power of the Elastic Stack, we recommend trying [Filebeat Modules](beats://reference/filebeat/filebeat-modules-overview.md). Filebeat Modules enable you to quickly collect, parse, and index popular log types and view pre-built Kibana dashboards within minutes. [Metricbeat Modules](beats://reference/metricbeat/metricbeat-modules.md) provide a similar experience, but with metrics data. In this context, Beats will ship data directly to Elasticsearch where [Ingest Nodes](docs-content://manage-data/ingest/transform-enrich/ingest-pipelines.md) will process and index your data.
 
-:::{image} ../images/deploy1.png
+:::{image} images/deploy1.png
 :alt: deploy1
 :::
 
@@ -42,7 +42,7 @@ Beats and Logstash make ingest awesome. Together, they provide a comprehensive s
 
 Beats run across thousands of edge host servers, collecting, tailing, and shipping logs to Logstash. Logstash serves as the centralized streaming engine for data unification and enrichment. The [Beats input plugin](/reference/plugins-inputs-beats.md) exposes a secure, acknowledgement-based endpoint for Beats to send data to Logstash.
 
-:::{image} ../images/deploy2.png
+:::{image} images/deploy2.png
 :alt: deploy2
 :::
 
@@ -97,7 +97,7 @@ If external monitoring is preferred, there are [monitoring APIs](monitoring-logs
 
 Users may have other mechanisms of collecting logging data, and it’s easy to integrate and centralize them into the Elastic Stack. Let’s walk through a few scenarios:
 
-:::{image} ../images/deploy3.png
+:::{image} images/deploy3.png
 :alt: deploy3
 :::
 
@@ -145,7 +145,7 @@ If you are leveraging message queuing technologies as part of your existing infr
 
 For users who want to integrate data from existing Kafka deployments or require the underlying usage of ephemeral storage, Kafka can serve as a data hub where Beats can persist to and Logstash nodes can consume from.
 
-:::{image} ../images/deploy4.png
+:::{image} images/deploy4.png
 :alt: deploy4
 :::
 

docs/reference/deploying-scaling-logstash.md

@@ -9,7 +9,7 @@ First, let’s test your Logstash installation by running the most basic *Logsta
 
 A Logstash pipeline has two required elements, `input` and `output`, and one optional element, `filter`. The input plugins consume data from a source, the filter plugins modify the data as you specify, and the output plugins write the data to a destination.
 
-:::{image} ../images/basic_logstash_pipeline.png
+:::{image} images/basic_logstash_pipeline.png
 :alt: basic logstash pipeline
 :::
 

docs/reference/first-event.md

@@ -7,24 +7,24 @@ mapped_pages:
 
 # Logstash introduction [introduction]
 
-Logstash is an open source data collection engine with real-time pipelining capabilities. 
-Logstash can dynamically unify data from disparate sources and normalize the data into destinations of your choice. 
+Logstash is an open source data collection engine with real-time pipelining capabilities.
+Logstash can dynamically unify data from disparate sources and normalize the data into destinations of your choice.
 Cleanse and democratize all your data for diverse advanced downstream analytics and visualization use cases.
 
-While Logstash originally drove innovation in log collection, its capabilities extend well beyond that use case. 
-Any type of event can be enriched and transformed with a broad array of input, filter, and output plugins, with many native codecs further simplifying the ingestion process. 
+While Logstash originally drove innovation in log collection, its capabilities extend well beyond that use case.
+Any type of event can be enriched and transformed with a broad array of input, filter, and output plugins, with many native codecs further simplifying the ingestion process.
 Logstash accelerates your insights by harnessing a greater volume and variety of data.
 
 ::::{admonition} {{ls}} to {{serverless-full}}
-You’ll use the {{ls}} [{{es}} output plugin](/logstash/docs/reference/plugins-outputs-elasticsearch.md) to send data to {{serverless-full}}. 
+You’ll use the {{ls}} [{{es}} output plugin](/reference/plugins-outputs-elasticsearch.md) to send data to {{serverless-full}}.
 Note these differences between {{es-serverless}} and both {{ess}} and self-managed {{es}}:
 
-* Use **API keys** to access {{serverless-full}} from {{ls}}. Any user-based security settings in your in your [{{es}} output plugin](/logstash/docs/reference/plugins-outputs-elasticsearch.md) configuration are ignored and may cause errors.
-* {{serverless-full}} uses **data streams** and [{{dlm}} ({{dlm-init}})](docs-content://manage-data/lifecycle/data-stream.md) instead of {{ilm}} ({{ilm-init}}). Any {{ilm-init}} settings in your [{{es}} output plugin](/logstash/docs/reference/plugins-outputs-elasticsearch.md) configuration are ignored and may cause errors.
+* Use **API keys** to access {{serverless-full}} from {{ls}}. Any user-based security settings in your in your [{{es}} output plugin](/reference/plugins-outputs-elasticsearch.md) configuration are ignored and may cause errors.
+* {{serverless-full}} uses **data streams** and [{{dlm}} ({{dlm-init}})](docs-content://manage-data/lifecycle/data-stream.md) instead of {{ilm}} ({{ilm-init}}). Any {{ilm-init}} settings in your [{{es}} output plugin](/reference/plugins-outputs-elasticsearch.md) configuration are ignored and may cause errors.
 * **{{ls}} monitoring** is available through the [{{ls}} Integration](https://github.com/elastic/integrations/blob/main/packages/logstash/_dev/build/docs/README.md) in [Elastic Observability](docs-content://solutions/observability.md) on {{serverless-full}}.
 
-**Known issue for Logstash to Elasticsearch Serverless.** 
-The logstash-output-elasticsearch `hosts` setting defaults to port :9200. 
+**Known issue for Logstash to Elasticsearch Serverless.**
+The logstash-output-elasticsearch `hosts` setting defaults to port :9200.
 Set the value to port :443 instead.
 
 ::::

docs/images/basic_logstash_pipeline.png renamed to docs/reference/images/basic_logstash_pipeline.png

@@ -30,7 +30,7 @@ To manage Logstash pipelines in {{kib}}:
 
 1. Open {{kib}} in your browser and go to the Management tab. If you’ve set up configuration management correctly, you’ll see an area for managing Logstash.
 
-    :::{image} ../images/centralized_config.png
+    :::{image} images/centralized_config.png
     :alt: centralized config
     :::
 

docs/images/centralized_config.png renamed to docs/reference/images/centralized_config.png

@@ -7,13 +7,13 @@ mapped_pages:
 
 Use the {{stack}} {{monitor-features}} to view metrics and gain insight into how your {{ls}} deployment is running. In the overview dashboard, you can see all events received and sent by Logstash, plus info about memory usage and uptime:
 
-:::{image} ../images/overviewstats.png
+:::{image} images/overviewstats.png
 :alt: Logstash monitoring overview dashboard in Kibana
 :::
 
 Then you can drill down to see stats about a specific node:
 
-:::{image} ../images/nodestats.png
+:::{image} images/nodestats.png
 :alt: Logstash monitoring node stats dashboard in Kibana
 :::
 

docs/images/dead_letter_queue.png renamed to docs/reference/images/dead_letter_queue.png

@@ -9,7 +9,7 @@ The pipeline viewer UI offers additional visibility into the behavior and perfor
 
 The pipeline viewer highlights CPU% and event latency in cases where the values are anomalous. This information helps you quickly identify processing that is disproportionately slow.
 
-:::{image} ../images/pipeline-tree.png
+:::{image} images/pipeline-tree.png
 :alt: Pipeline Viewer
 :class: screenshot
 :::
@@ -35,7 +35,7 @@ Each pipeline is identified by a pipeline ID (`main` by default). For each pipel
 
 Many elements in the tree are clickable. For example, you can click the plugin name to expand the detail view.
 
-:::{image} ../images/pipeline-input-detail.png
+:::{image} images/pipeline-input-detail.png
 :alt: Pipeline Input Detail
 :class: screenshot
 :::

docs/images/deploy1.png renamed to docs/reference/images/deploy1.png

@@ -169,7 +169,7 @@ To monitor Logstash nodes:
 5. Restart your Logstash nodes.
 6. To verify your monitoring configuration, point your web browser at your {{kib}} host, and select **Stack Monitoring** from the side navigation. If this is an initial setup, select **set up with self monitoring** and click **Turn on monitoring**. Metrics reported from your Logstash nodes should be visible in the Logstash section. When security is enabled, to view the monitoring dashboards you must log in to {{kib}} as a user who has the `kibana_user` and `monitoring_user` roles.
 
-    :::{image} ../images/monitoring-ui.png
+    :::{image} images/monitoring-ui.png
     :alt: Monitoring
     :::
 

docs/images/deploy2.png renamed to docs/reference/images/deploy2.png

@@ -72,7 +72,7 @@ Check out [Installing {{agent}}](docs-content://reference/ingestion-tools/fleet/
 
 1. Go to the {{kib}} home page, and click **Add integrations**.
 
-    :::{image} ../images/kibana-home.png
+    :::{image} images/kibana-home.png
     :alt: {{kib}} home page
     :class: screenshot
     :::
@@ -133,7 +133,7 @@ After you have confirmed enrollment and data is coming in,  click **View assets*
 
 For traditional Stack Monitoring UI, the dashboards marked **[Logs {{ls}}]** are used to visualize the logs produced by your {{ls}} instances, with those marked **[Metrics {{ls}}]** for the technical preview metrics dashboards. These are populated with data only if you selected the **Metrics (Technical Preview)** checkbox.
 
-:::{image} ../images/integration-assets-dashboards.png
+:::{image} images/integration-assets-dashboards.png
 :alt: Integration assets
 :class: screenshot
 :::

docs/images/deploy3.png renamed to docs/reference/images/deploy3.png

@@ -60,7 +60,7 @@ For more info, check out the [Elastic Observability](docs-content://solutions/ob
 
 From the list of assets, open the **[Metrics {{ls}}] {{ls}} overview** dashboard to view overall performance. Then follow the navigation panel to further drill down into {{ls}} performance.
 
-:::{image} ../images/integration-dashboard-overview.png
+:::{image} images/integration-dashboard-overview.png
 :alt: The {{ls}} Overview dashboard in {{kib}} with various metrics from your monitored {ls}
 :class: screenshot
 :::

docs/images/deploy4.png renamed to docs/reference/images/deploy4.png

@@ -61,11 +61,11 @@ If you plan to modify the default pipeline settings, take into account the follo
 
 When tuning Logstash you may have to adjust the heap size. You can use the [VisualVM](https://visualvm.github.io/) tool to profile the heap. The **Monitor** pane in particular is useful for checking whether your heap allocation is sufficient for the current workload. The screenshots below show sample **Monitor** panes. The first pane examines a Logstash instance configured with too many inflight events. The second pane examines a Logstash instance configured with an appropriate amount of inflight events. Note that the specific batch sizes used here are most likely not applicable to your specific workload, as the memory demands of Logstash vary in large part based on the type of messages you are sending.
 
-:::{image} ../images/pipeline_overload.png
+:::{image} images/pipeline_overload.png
 :alt: pipeline overload
 :::
 
-:::{image} ../images/pipeline_correct_load.png
+:::{image} images/pipeline_correct_load.png
 :alt: pipeline correct load
 :::