Refine applies_to syntax

docs/reference/auditbeat/auditbeat-installation-configuration.md

@@ -23,16 +23,13 @@ This guide describes how to get started quickly with audit data collection. You
 
 You need {{es}} for storing and searching your data, and {{kib}} for visualizing and managing it.
 
-:::::::{tab-set}
-:group: deployment
+:::::::{applies-switch}
 
-::::::{tab-item} {{ech}}
-:sync: hosted
+::::::{applies-item} ess: ga
 To get started quickly, spin up an [{{ech}}](https://www.elastic.co/cloud?page=docs&placement=docs-body) deployment. {{ech}} is available on AWS, GCP, and Azure. [Try it out for free](https://cloud.elastic.co/registration?page=docs&placement=docs-body).
 ::::::
 
-::::::{tab-item} Self-managed
-:sync: self
+::::::{applies-item} self: ga
 To install and run {{es}} and {{kib}}, see [Installing the {{stack}}](docs-content://deploy-manage/deploy/self-managed/installing-elasticsearch.md).
 ::::::
 
@@ -101,7 +98,7 @@ If script execution is disabled on your system, you need to set the execution po
 :::
 
 :::{important}
-{applies_to}`stack: ga 9.1.0` {applies_to}`stack: ga 9.0.6`
+:applies_to: stack: ga 9.0.6+!
 
 The base folder has changed from `C:\ProgramData\` to `C:\Program Files\`
 because the latter has stricter permissions. The home path (base for
@@ -133,11 +130,9 @@ Connections to {{es}} and {{kib}} are required to set up Auditbeat.
 
 Set the connection information in `auditbeat.yml`. To locate this configuration file, see [Directory layout](/reference/auditbeat/directory-layout.md).
 
-:::::::{tab-set}
-:group: deployment
+:::::::{applies-switch}
 
-::::::{tab-item} {{ech}}
-:sync: hosted
+::::::{applies-item} ess: ga
 Specify the [cloud.id](/reference/auditbeat/configure-cloud-id.md) of your {{ech}} deployment, and set [cloud.auth](/reference/auditbeat/configure-cloud-id.md) to a user who is authorized to set up Auditbeat. For example:
 
 ```yaml
@@ -148,8 +143,7 @@ cloud.auth: "auditbeat_setup:YOUR_PASSWORD" <1>
 1. This examples shows a hard-coded password, but you should store sensitive values in the [secrets keystore](/reference/auditbeat/keystore.md).
 ::::::
 
-::::::{tab-item} Self-managed
-:sync: self
+::::::{applies-item} self: ga
 1. Set the host and port where Auditbeat can find the {{es}} installation, and set the username and password of a user who is authorized to set up Auditbeat. For example:
 
     ```yaml
@@ -270,9 +264,11 @@ Auditbeat comes with predefined assets for parsing, indexing, and visualizing yo
     `-e` is optional and sends output to standard error instead of the configured log output.
 
 
-The default location where Windows log files are stored varies:
-* {applies_to}`stack: ga 9.0.6` `C:\Program Files\Auditbeat-Data\logs`
-* {applies_to}`stack: ga 9.0` `C:\ProgramData\auditbeat\logs`
+By default Windows log files are stored in `C:\Program Files\Auditbeat-Data\logs`.
+
+:::{note}
+In versions before 9.0.6, the default location for Windows log files was `C:\ProgramData\auditbeat\logs`.
+:::
 
 This step loads the recommended [index template](docs-content://manage-data/data-store/templates.md) for writing to {{es}} and deploys the sample dashboards for visualizing the data in {{kib}}.
 
@@ -341,9 +337,11 @@ sudo ./auditbeat -e
 PS C:\Program Files\auditbeat> Start-Service auditbeat
 ```
 
-The default location where Windows log files are stored varies:
-* {applies_to}`stack: ga 9.0.6` `C:\Program Files\Auditbeat-Data\logs`
-* {applies_to}`stack: ga 9.0` `C:\ProgramData\auditbeat\logs`
+By default Windows log files are stored in `C:\Program Files\Auditbeat-Data\logs`.
+
+:::{note}
+In versions before 9.0.6, the default location for Windows log files was `C:\ProgramData\auditbeat\logs`.
+:::
 ::::::
 
 :::::::
@@ -361,16 +359,16 @@ To open the dashboards:
 
 1. Launch {{kib}}:
 
-    :::::::{tab-set}
+    :::::::{applies-switch}
     :group: deployment
 
-    ::::::{tab-item} {{ech}}
+    ::::::{applies-item} ess: ga
     :sync: hosted
     1. [Log in](https://cloud.elastic.co/) to your {{ecloud}} account.
     2. Navigate to the {{kib}} endpoint in your deployment.
     ::::::
 
-    ::::::{tab-item} Self-managed
+    ::::::{applies-item} self: ga
     :sync: self
     Point your browser to [http://localhost:5601](http://localhost:5601), replacing `localhost` with the name of the {{kib}} host.
     ::::::

docs/reference/auditbeat/auditbeat-installation-script.md

@@ -2,7 +2,7 @@
 mapped_pages:
   - https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-installation-script.html
 applies_to:
-  stack: ga 9.1.0, ga 9.0.6
+  stack: ga 9.0.6
 ---
 
 # Installation script

docs/reference/auditbeat/auditbeat-starting.md

@@ -58,9 +58,11 @@ sudo ./auditbeat -e
 PS C:\Program Files\auditbeat> Start-Service auditbeat
 ```
 
-The default location where Windows log files are stored varies:
-* {applies_to}`stack: ga 9.0.6` `C:\Program Files\Auditbeat-Data\logs`
-* {applies_to}`stack: ga 9.0` `C:\ProgramData\auditbeat\logs`
+By default Windows log files are stored in `C:\Program Files\Auditbeat-Data\logs`.
+
+:::{note}
+In versions before 9.0.6, the default location for Windows log files was `C:\ProgramData\auditbeat\logs`.
+:::
 ::::::
 
 :::::::

docs/reference/auditbeat/processor-translate-guid.md

@@ -36,14 +36,14 @@ The `translate_ldap_attribute` processor has the following configuration setting
 | `field` | yes |  | Source field containing a GUID. |
 | `target_field` | no |  | Target field for the mapped attribute value. If not set it will be replaced in place. |
 | `ldap_domain` | no |  | {applies_to}`stack: ga 9.2.4` DNS domain name (for example, `example.com`) used for DNS SRV discovery and to construct FQDNs from `LOGONSERVER`. When omitted Beats inspects OS metadata to infer the domain (Windows: `USERDNSDOMAIN`, `GetComputerNameEx`, TCP/IP + Kerberos registry keys, hostname; Linux/macOS: `/etc/resolv.conf`, `/etc/krb5.conf`, hostname). |
-| `ldap_address` | {applies_to}`stack: ga 9.2.4` no<br>{applies_to}`stack: ga 9.0.0` yes |  | LDAP server address (for example, `ldap://ds.example.com:389`). When omitted Beats auto-discovers controllers by querying `_ldaps._tcp.<domain>` first, `_ldap._tcp.<domain>` second, and finally the Windows `LOGONSERVER` variable if available. Candidates are tried in order until one succeeds. |
-| `ldap_base_dn` | {applies_to}`stack: ga 9.2.4` no<br>{applies_to}`stack: ga 9.0.0` yes |  | LDAP base DN (for example, `dc=example,dc=com`). When omitted Beats queries the server's rootDSE for `defaultNamingContext`/`namingContexts`. If the controller does not expose those attributes, client initialization fails and you must configure the value manually. |
+| `ldap_address` | {applies_to}`stack: ga 9.2.4+!` no<br><br>{applies_to}`stack: ga 9.0.0!-9.2.3!` yes |  | LDAP server address (for example, `ldap://ds.example.com:389`). When omitted Beats auto-discovers controllers by querying `_ldaps._tcp.<domain>` first, `_ldap._tcp.<domain>` second, and finally the Windows `LOGONSERVER` variable if available. Candidates are tried in order until one succeeds. |
+| `ldap_base_dn` | {applies_to}`stack: ga 9.2.4+!` no<br><br>{applies_to}`stack: ga 9.0.0!-9.2.3!` yes |  | LDAP base DN (for example, `dc=example,dc=com`). When omitted Beats queries the server's rootDSE for `defaultNamingContext`/`namingContexts`. If the controller does not expose those attributes, client initialization fails and you must configure the value manually. |
 | `ldap_bind_user` | no |  | LDAP DN/UPN for simple bind. When provided with `ldap_bind_password` Beats performs a standard bind. When set without a password Beats issues an unauthenticated bind using this identity (useful for servers that expect a bind DN even for anonymous operations). |
 | `ldap_bind_password` | no |  | LDAP password for simple bind. When both the username and password are omitted Beats attempts automatic authentication: on Windows it first tries SSPI with the Beat's service or user identity using the SPN `ldap/<hostname derived from ldap_address>` and falls back to an unauthenticated bind if that fails. Non-Windows platforms immediately use an unauthenticated bind. |
 | `ldap_search_attribute` | yes | `objectGUID` | LDAP attribute to search by. |
 | `ldap_mapped_attribute` | yes | `cn` | LDAP attribute to map to. |
 | `ldap_search_time_limit` | no | 30 | LDAP search time limit in seconds. |
-| `ldap_ssl` | no | {applies_to}`stack: ga 9.2.4` no default<br>{applies_to}`stack: ga 9.0.0` `30` | LDAP TLS/SSL connection settings. Refer to [SSL](/reference/auditbeat/configuration-ssl.md). |
+| `ldap_ssl` | no | {applies_to}`stack: ga 9.2.4+!` no default<br><br>{applies_to}`stack: ga 9.0.0!-9.2.3!` `30` | LDAP TLS/SSL connection settings. Refer to [SSL](/reference/auditbeat/configuration-ssl.md). |
 | `ad_guid_translation` | no | `auto` | {applies_to}`stack: ga 9.2.4` Controls GUID binary conversion for Active Directory attributes. `auto` (default) converts when the LDAP search attribute equals `objectGUID` (case-insensitive). Use `always` to force conversion or `never` to disable it. |
 | `ignore_missing` | no | false | Ignore errors when the source field is missing. |
 | `ignore_failure` | no | false | Ignore all errors produced by the processor. |

docs/reference/filebeat/filebeat-input-azure-blob-storage.md

@@ -127,15 +127,15 @@ $$$supported-attributes$$$
 5. [storage_url](#attrib-storage-url)
 6. [containers](#attrib-containers)
 7. [name](#attrib-container-name)
-8. [batch_size](#attrib-batch_size-abs) {applies_to}`stack: ga 9.1.0`
+8. [batch_size](#attrib-batch_size-abs) {applies_to}`stack: ga 9.1.0+`
 9. [max_workers](#attrib-max_workers)
 10. [poll](#attrib-poll)
 11. [poll_interval](#attrib-poll_interval)
 12. [file_selectors](#attrib-file_selectors)
 13. [expand_event_list_from_field](#attrib-expand_event_list_from_field)
 14. [timestamp_epoch](#attrib-timestamp_epoch)
-15. [path_prefix](#attrib-path_prefix) {applies_to}`stack: ga 9.1.4`
-16. [custom_properties](#attrib-custom-properties) {applies_to}`stack: ga 9.1.0`
+15. [path_prefix](#attrib-path_prefix) {applies_to}`stack: ga 9.1.4+`
+16. [custom_properties](#attrib-custom-properties) {applies_to}`stack: ga 9.1.0+`
 
 ## `account_name` [attrib-account-name]