diff --git a/docs/en/observability/create-alerts.asciidoc b/docs/en/observability/create-alerts.asciidoc
index 270a4c948c..7622d64633 100644
--- a/docs/en/observability/create-alerts.asciidoc
+++ b/docs/en/observability/create-alerts.asciidoc
@@ -11,7 +11,7 @@ Alerting enables you to detect complex conditions defined by a *rule*
within the Applications, Logs, Infrastructure, Synthetics, and Uptime UIs. When a condition is met, the rule
tracks it as an *alert* and responds by triggering one or more *actions*.
-Alerts and rules related to service level objectives (SLOs), and {observability} apps, including Applications, Logs, Infrastructure, Synthetics, and Uptime, can be managed in the {observability} UI.
+Alerts and rules related to service-level objectives (SLOs), and {observability} apps, including Applications, Logs, Infrastructure, Synthetics, and Uptime, can be managed in the {observability} UI.
You can also manage {observability} app rules alongside rules for other apps from the {kibana-ref}/create-and-manage-rules.html[{kib} Management UI].
[discrete]
diff --git a/docs/en/observability/slo-overview.asciidoc b/docs/en/observability/slo-overview.asciidoc
index a9a9832e9f..968c246f7b 100644
--- a/docs/en/observability/slo-overview.asciidoc
+++ b/docs/en/observability/slo-overview.asciidoc
@@ -1,9 +1,5 @@
[[slo]]
-= SLOs
-
-++++
-Service-level objectives (SLOs)
-++++
+= Service-level objectives (SLOs)
// tag::slo-license[]
[IMPORTANT]
diff --git a/docs/en/serverless/ai-assistant/ai-assistant.asciidoc b/docs/en/serverless/ai-assistant/ai-assistant.asciidoc
index 2685a7ab06..d630d02ef6 100644
--- a/docs/en/serverless/ai-assistant/ai-assistant.asciidoc
+++ b/docs/en/serverless/ai-assistant/ai-assistant.asciidoc
@@ -1,5 +1,5 @@
[[observability-ai-assistant]]
-= AI Assistant
+= {observability} AI Assistant
// :keywords: serverless, observability, overview
diff --git a/docs/en/serverless/application-and-service-monitoring.asciidoc b/docs/en/serverless/application-and-service-monitoring.asciidoc
new file mode 100644
index 0000000000..96002a5037
--- /dev/null
+++ b/docs/en/serverless/application-and-service-monitoring.asciidoc
@@ -0,0 +1,17 @@
+[[application-and-service-monitoring]]
+= Application and service monitoring
+
+++++
+Applications and services
+++++
+
+Explore the topics in this section to learn how to observe and monitor software applications and services running in your environment.
+
+[cols="1,1"]
+|===
+|<>
+|Monitor software services and applications in real time, by collecting detailed performance information on response time for incoming requests, database queries, calls to caches, external HTTP requests, and more.
+
+|<>
+|Monitor the availability of network endpoints and services.
+|===
\ No newline at end of file
diff --git a/docs/en/serverless/dashboards/dashboards-and-visualizations.asciidoc b/docs/en/serverless/dashboards/dashboards-and-visualizations.asciidoc
index 047f64916c..6dca71ecc2 100644
--- a/docs/en/serverless/dashboards/dashboards-and-visualizations.asciidoc
+++ b/docs/en/serverless/dashboards/dashboards-and-visualizations.asciidoc
@@ -1,5 +1,5 @@
[[observability-dashboards]]
-= Dashboards
+= Get started with dashboards
// :description: Visualize your observability data using pre-built dashboards or create your own.
// :keywords: serverless, observability, overview
diff --git a/docs/en/serverless/images/get-started.svg b/docs/en/serverless/images/get-started.svg
new file mode 100644
index 0000000000..487355b2f9
--- /dev/null
+++ b/docs/en/serverless/images/get-started.svg
@@ -0,0 +1,21 @@
+
diff --git a/docs/en/serverless/incident-management.asciidoc b/docs/en/serverless/incident-management.asciidoc
new file mode 100644
index 0000000000..8c8bf6b8a4
--- /dev/null
+++ b/docs/en/serverless/incident-management.asciidoc
@@ -0,0 +1,19 @@
+[[incident-management]]
+= Incident management
+
+Explore the topics in this section to learn how to respond to incidents detected in your {observability} data.
+
+
+[cols="1,1"]
+|===
+|<>
+|Trigger alerts when incidents occur, and use built-in connectors to send the alerts to email, slack, or other third-party systems, such as your external incident management application.
+
+|<>
+|Collect and share information about {observability} issues by opening cases and optionally sending them to your external incident management application.
+
+|<>
+|Set clear, measurable targets for your service performance, based on factors like availability, response times, error rates, and other key metrics.
+|===
+
+
diff --git a/docs/en/serverless/index.asciidoc b/docs/en/serverless/index.asciidoc
index 0f6b56f2a8..908c8a6b84 100644
--- a/docs/en/serverless/index.asciidoc
+++ b/docs/en/serverless/index.asciidoc
@@ -10,18 +10,136 @@ include::{asciidoc-dir}/../../shared/attributes.asciidoc[]
include::./what-is-observability-serverless.asciidoc[leveloffset=+2]
-include::./observability-overview.asciidoc[leveloffset=+2]
+// Group: Get started with Elastic Observability
+include::observability-get-started.asciidoc[leveloffset=+2]
-include::./quickstarts/overview.asciidoc[leveloffset=+2]
+// What is Observability?
+include::./observability-overview.asciidoc[leveloffset=+3]
+
+// Observability billing dimensions
+include::./projects/billing.asciidoc[leveloffset=+3]
+
+// Create an Elastic Observability Serverless project
+include::./projects/create-an-observability-project.asciidoc[leveloffset=+3]
+
+// Quickstarts
include::./quickstarts/monitor-hosts-with-elastic-agent.asciidoc[leveloffset=+3]
include::./quickstarts/k8s-logs-metrics.asciidoc[leveloffset=+3]
include::./quickstarts/collect-data-with-aws-firehose.asciidoc[leveloffset=+3]
-include::./projects/billing.asciidoc[leveloffset=+2]
+// Dashboards
+include::./dashboards/dashboards-and-visualizations.asciidoc[leveloffset=+3]
+
+// Group: Application and service monitoring
+include::./application-and-service-monitoring.asciidoc[leveloffset=+2]
+
+// APM
+include::./apm/apm.asciidoc[leveloffset=+3]
+include::./apm/apm-get-started.asciidoc[leveloffset=+4]
+include::./apm/apm-send-traces-to-elastic.asciidoc[leveloffset=+4]
+include::./apm-agents/apm-agents-elastic-apm-agents.asciidoc[leveloffset=+5]
+include::./apm-agents/apm-agents-opentelemetry.asciidoc[leveloffset=+5]
+include::./apm-agents/apm-agents-opentelemetry-opentelemetry-native-support.asciidoc[leveloffset=+6]
+include::./apm-agents/apm-agents-opentelemetry-collect-metrics.asciidoc[leveloffset=+6]
+include::./apm-agents/apm-agents-opentelemetry-limitations.asciidoc[leveloffset=+6]
+include::./apm-agents/apm-agents-opentelemetry-resource-attributes.asciidoc[leveloffset=+6]
+include::./apm-agents/apm-agents-aws-lambda-functions.asciidoc[leveloffset=+5]
+include::./apm/apm-view-and-analyze-traces.asciidoc[leveloffset=+4]
+include::./apm/apm-find-transaction-latency-and-failure-correlations.asciidoc[leveloffset=+5]
+include::./apm/apm-integrate-with-machine-learning.asciidoc[leveloffset=+5]
+include::./apm/apm-create-custom-links.asciidoc[leveloffset=+5]
+include::./apm/apm-track-deployments-with-annotations.asciidoc[leveloffset=+5]
+include::./apm/apm-query-your-data.asciidoc[leveloffset=+5]
+include::./apm/apm-filter-your-data.asciidoc[leveloffset=+5]
+include::./apm/apm-observe-lambda-functions.asciidoc[leveloffset=+5]
+include::./apm/apm-ui-overview.asciidoc[leveloffset=+5]
+include::./apm/apm-ui-services.asciidoc[leveloffset=+6]
+include::./apm/apm-ui-traces.asciidoc[leveloffset=+6]
+include::./apm/apm-ui-dependencies.asciidoc[leveloffset=+6]
+include::./apm/apm-ui-service-map.asciidoc[leveloffset=+6]
+include::./apm/apm-ui-service-overview.asciidoc[leveloffset=+6]
+include::./apm/apm-ui-transactions.asciidoc[leveloffset=+6]
+include::./apm/apm-ui-trace-sample-timeline.asciidoc[leveloffset=+6]
+include::./apm/apm-ui-errors.asciidoc[leveloffset=+6]
+include::./apm/apm-ui-metrics.asciidoc[leveloffset=+6]
+include::./apm/apm-ui-infrastructure.asciidoc[leveloffset=+6]
+include::./apm/apm-ui-logs.asciidoc[leveloffset=+6]
+include::./apm/apm-data-types.asciidoc[leveloffset=+4]
+include::./apm/apm-distributed-tracing.asciidoc[leveloffset=+4]
+include::./apm/apm-reduce-your-data-usage.asciidoc[leveloffset=+4]
+include::./apm/apm-transaction-sampling.asciidoc[leveloffset=+5]
+include::./apm/apm-compress-spans.asciidoc[leveloffset=+5]
+include::./apm/apm-stacktrace-collection.asciidoc[leveloffset=+5]
+include::./apm/apm-keep-data-secure.asciidoc[leveloffset=+4]
+include::./apm/apm-troubleshooting.asciidoc[leveloffset=+4]
+include::./apm/apm-reference.asciidoc[leveloffset=+4]
+include::./apm/apm-kibana-settings.asciidoc[leveloffset=+5]
+include::./apm/apm-server-api.asciidoc[leveloffset=+5]
+
+// Synthetics
+include::./synthetics/synthetics-intro.asciidoc[leveloffset=+3]
+
+include::./synthetics/synthetics-get-started.asciidoc[leveloffset=+4]
+include::./synthetics/synthetics-get-started-project.asciidoc[leveloffset=+5]
+include::./synthetics/synthetics-get-started-ui.asciidoc[leveloffset=+5]
+
+include::./synthetics/synthetics-journeys.asciidoc[leveloffset=+4]
+include::./synthetics/synthetics-create-test.asciidoc[leveloffset=+5]
+include::./synthetics/synthetics-monitor-use.asciidoc[leveloffset=+5]
+include::./synthetics/synthetics-recorder.asciidoc[leveloffset=+5]
+
+include::./synthetics/synthetics-lightweight.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-manage-monitors.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-params-secrets.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-analyze.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-private-location.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-command-reference.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-configuration.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-mfa.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-settings.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-feature-roles.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-manage-retention.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-scale-and-architect.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-security-encryption.asciidoc[leveloffset=+4]
+
+include::./synthetics/synthetics-troubleshooting.asciidoc[leveloffset=+4]
+
+// Group: Infrastructure and hosts
+include::./infrastructure-and-host-monitoring-intro.asciidoc[leveloffset=+2]
+
+include::./infra-monitoring/infra-monitoring.asciidoc[leveloffset=+3]
+include::./infra-monitoring/get-started-with-metrics.asciidoc[leveloffset=+4]
+include::./infra-monitoring/view-infrastructure-metrics.asciidoc[leveloffset=4]
+include::./infra-monitoring/analyze-hosts.asciidoc[leveloffset=+4]
+include::./infra-monitoring/detect-metric-anomalies.asciidoc[leveloffset=+4]
+include::./infra-monitoring/configure-infra-settings.asciidoc[leveloffset=+4]
-include::./projects/create-an-observability-project.asciidoc[leveloffset=+2]
+include::./infra-monitoring/troubleshooting-infra.asciidoc[leveloffset=+3]
+include::./infra-monitoring/handle-no-results-found-message.asciidoc[leveloffset=+4]
+
+include::./infra-monitoring/metrics-reference.asciidoc[leveloffset=+3]
+include::./infra-monitoring/host-metrics.asciidoc[leveloffset=+4]
+include::./infra-monitoring/container-metrics.asciidoc[leveloffset=+4]
+include::./infra-monitoring/kubernetes-pod-metrics.asciidoc[leveloffset=+4]
+include::./infra-monitoring/aws-metrics.asciidoc[leveloffset=+4]
+
+// Group: Logs
+// TODO: Check the diff to see which changes need to be applied to these files. Also ask Mike if it's expected for serverless and stateful to be out of sync.
include::./logging/log-monitoring.asciidoc[leveloffset=+2]
+
include::./logging/get-started-with-logs.asciidoc[leveloffset=+3]
include::./logging/stream-log-files.asciidoc[leveloffset=+3]
include::./logging/correlate-application-logs.asciidoc[leveloffset=+3]
@@ -35,127 +153,71 @@ include::./logging/add-logs-service-name.asciidoc[leveloffset=+3]
include::./logging/run-log-pattern-analysis.asciidoc[leveloffset=+3]
include::./logging/troubleshoot-logs.asciidoc[leveloffset=+3]
+//TODO: Figure out where to put this. It's under "view and analyze data" in stateful, but that category doesn't exist in serverless yet.
include::./inventory.asciidoc[leveloffset=+2]
-include::./apm/apm.asciidoc[leveloffset=+2]
-include::./apm/apm-get-started.asciidoc[leveloffset=+3]
-include::./apm/apm-send-traces-to-elastic.asciidoc[leveloffset=+3]
-include::./apm-agents/apm-agents-elastic-apm-agents.asciidoc[leveloffset=+4]
-include::./apm-agents/apm-agents-opentelemetry.asciidoc[leveloffset=+4]
-include::./apm-agents/apm-agents-opentelemetry-opentelemetry-native-support.asciidoc[leveloffset=+5]
-include::./apm-agents/apm-agents-opentelemetry-collect-metrics.asciidoc[leveloffset=+5]
-include::./apm-agents/apm-agents-opentelemetry-limitations.asciidoc[leveloffset=+5]
-include::./apm-agents/apm-agents-opentelemetry-resource-attributes.asciidoc[leveloffset=+5]
-include::./apm-agents/apm-agents-aws-lambda-functions.asciidoc[leveloffset=+4]
-include::./apm/apm-view-and-analyze-traces.asciidoc[leveloffset=+3]
-include::./apm/apm-find-transaction-latency-and-failure-correlations.asciidoc[leveloffset=+4]
-include::./apm/apm-integrate-with-machine-learning.asciidoc[leveloffset=+4]
-include::./apm/apm-create-custom-links.asciidoc[leveloffset=+4]
-include::./apm/apm-track-deployments-with-annotations.asciidoc[leveloffset=+4]
-include::./apm/apm-query-your-data.asciidoc[leveloffset=+4]
-include::./apm/apm-filter-your-data.asciidoc[leveloffset=+4]
-include::./apm/apm-observe-lambda-functions.asciidoc[leveloffset=+4]
-include::./apm/apm-ui-overview.asciidoc[leveloffset=+4]
-include::./apm/apm-ui-services.asciidoc[leveloffset=+5]
-include::./apm/apm-ui-traces.asciidoc[leveloffset=+5]
-include::./apm/apm-ui-dependencies.asciidoc[leveloffset=+5]
-include::./apm/apm-ui-service-map.asciidoc[leveloffset=+5]
-include::./apm/apm-ui-service-overview.asciidoc[leveloffset=+5]
-include::./apm/apm-ui-transactions.asciidoc[leveloffset=+5]
-include::./apm/apm-ui-trace-sample-timeline.asciidoc[leveloffset=+5]
-include::./apm/apm-ui-errors.asciidoc[leveloffset=+5]
-include::./apm/apm-ui-metrics.asciidoc[leveloffset=+5]
-include::./apm/apm-ui-infrastructure.asciidoc[leveloffset=+5]
-include::./apm/apm-ui-logs.asciidoc[leveloffset=+5]
-include::./apm/apm-data-types.asciidoc[leveloffset=+3]
-include::./apm/apm-distributed-tracing.asciidoc[leveloffset=+3]
-include::./apm/apm-reduce-your-data-usage.asciidoc[leveloffset=+3]
-include::./apm/apm-transaction-sampling.asciidoc[leveloffset=+4]
-include::./apm/apm-compress-spans.asciidoc[leveloffset=+4]
-include::./apm/apm-stacktrace-collection.asciidoc[leveloffset=+4]
-include::./apm/apm-keep-data-secure.asciidoc[leveloffset=+3]
-include::./apm/apm-troubleshooting.asciidoc[leveloffset=+3]
-include::./apm/apm-reference.asciidoc[leveloffset=+3]
-include::./apm/apm-kibana-settings.asciidoc[leveloffset=+4]
-include::./apm/apm-server-api.asciidoc[leveloffset=+4]
-
-include::./infra-monitoring/infra-monitoring.asciidoc[leveloffset=+2]
-include::./infra-monitoring/get-started-with-metrics.asciidoc[leveloffset=+3]
-include::./infra-monitoring/view-infrastructure-metrics.asciidoc[leveloffset=+3]
-include::./infra-monitoring/analyze-hosts.asciidoc[leveloffset=+3]
-include::./infra-monitoring/detect-metric-anomalies.asciidoc[leveloffset=+3]
-include::./infra-monitoring/configure-infra-settings.asciidoc[leveloffset=+3]
-include::./infra-monitoring/troubleshooting-infra.asciidoc[leveloffset=+3]
-include::./infra-monitoring/handle-no-results-found-message.asciidoc[leveloffset=+4]
-include::./infra-monitoring/metrics-reference.asciidoc[leveloffset=+3]
-include::./infra-monitoring/host-metrics.asciidoc[leveloffset=+4]
-include::./infra-monitoring/container-metrics.asciidoc[leveloffset=+4]
-include::./infra-monitoring/kubernetes-pod-metrics.asciidoc[leveloffset=+4]
-include::./infra-monitoring/aws-metrics.asciidoc[leveloffset=+4]
-include::./infra-monitoring/metrics-app-fields.asciidoc[leveloffset=+3]
-
-include::./synthetics/synthetics-intro.asciidoc[leveloffset=+2]
-include::./synthetics/synthetics-get-started.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-get-started-project.asciidoc[leveloffset=+4]
-include::./synthetics/synthetics-get-started-ui.asciidoc[leveloffset=+4]
-include::./synthetics/synthetics-journeys.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-create-test.asciidoc[leveloffset=+4]
-include::./synthetics/synthetics-monitor-use.asciidoc[leveloffset=+4]
-include::./synthetics/synthetics-recorder.asciidoc[leveloffset=+4]
-include::./synthetics/synthetics-lightweight.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-manage-monitors.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-params-secrets.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-analyze.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-private-location.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-command-reference.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-configuration.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-mfa.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-settings.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-feature-roles.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-manage-retention.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-scale-and-architect.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-security-encryption.asciidoc[leveloffset=+3]
-include::./synthetics/synthetics-troubleshooting.asciidoc[leveloffset=+3]
-
-include::./dashboards/dashboards-and-visualizations.asciidoc[leveloffset=+2]
-
-include::./alerting/alerting.asciidoc[leveloffset=+2]
-include::./alerting/create-manage-rules.asciidoc[leveloffset=+3]
-include::./alerting/aiops-generate-anomaly-alerts.asciidoc[leveloffset=+4]
-include::./alerting/create-anomaly-alert-rule.asciidoc[leveloffset=+4]
-include::./alerting/create-custom-threshold-alert-rule.asciidoc[leveloffset=+4]
-include::./alerting/create-elasticsearch-query-alert-rule.asciidoc[leveloffset=+4]
-include::./alerting/create-error-count-threshold-alert-rule.asciidoc[leveloffset=+4]
-include::./alerting/create-failed-transaction-rate-threshold-alert-rule.asciidoc[leveloffset=+4]
-include::./alerting/create-inventory-threshold-alert-rule.asciidoc[leveloffset=+4]
-include::./alerting/create-latency-threshold-alert-rule.asciidoc[leveloffset=+4]
-include::./alerting/create-slo-burn-rate-alert-rule.asciidoc[leveloffset=+4]
-include::./alerting/synthetic-monitor-status-alert.asciidoc[leveloffset=+4]
-include::./alerting/aggregation-options.asciidoc[leveloffset=+3]
-include::./alerting/rate-aggregation.asciidoc[leveloffset=+4]
-include::./alerting/view-alerts.asciidoc[leveloffset=+3]
-include::./alerting/triage-slo-burn-rate-breaches.asciidoc[leveloffset=+4]
-include::./alerting/triage-threshold-breaches.asciidoc[leveloffset=+4]
-
-include::./slos/slos.asciidoc[leveloffset=+2]
-include::./slos/create-an-slo.asciidoc[leveloffset=+3]
-
-include::./cases/cases.asciidoc[leveloffset=+2]
-include::./cases/create-manage-cases.asciidoc[leveloffset=+3]
-include::./cases/manage-cases-settings.asciidoc[leveloffset=+3]
-
-include::./aiops/aiops.asciidoc[leveloffset=+2]
-include::./aiops/aiops-detect-anomalies.asciidoc[leveloffset=+3]
-include::./aiops/aiops-tune-anomaly-detection-job.asciidoc[leveloffset=+4]
-include::./aiops/aiops-forecast-anomaly.asciidoc[leveloffset=+4]
-include::./aiops/aiops-analyze-spikes.asciidoc[leveloffset=+3]
-include::./aiops/aiops-detect-change-points.asciidoc[leveloffset=+3]
-
+// Group: Incident management
+include::./incident-management.asciidoc[leveloffset=+2]
+
+// Alerting
+include::./alerting/alerting.asciidoc[leveloffset=+3]
+include::./alerting/create-manage-rules.asciidoc[leveloffset=+4]
+include::./alerting/aiops-generate-anomaly-alerts.asciidoc[leveloffset=+5]
+include::./alerting/create-anomaly-alert-rule.asciidoc[leveloffset=+5]
+include::./alerting/create-custom-threshold-alert-rule.asciidoc[leveloffset=+5]
+include::./alerting/create-elasticsearch-query-alert-rule.asciidoc[leveloffset=+5]
+include::./alerting/create-error-count-threshold-alert-rule.asciidoc[leveloffset=+5]
+include::./alerting/create-failed-transaction-rate-threshold-alert-rule.asciidoc[leveloffset=+5]
+include::./alerting/create-inventory-threshold-alert-rule.asciidoc[leveloffset=+5]
+include::./alerting/create-latency-threshold-alert-rule.asciidoc[leveloffset=+5]
+include::./alerting/create-slo-burn-rate-alert-rule.asciidoc[leveloffset=+5]
+include::./alerting/synthetic-monitor-status-alert.asciidoc[leveloffset=+5]
+include::./alerting/aggregation-options.asciidoc[leveloffset=+4]
+include::./alerting/rate-aggregation.asciidoc[leveloffset=+5]
+include::./alerting/view-alerts.asciidoc[leveloffset=+4]
+include::./alerting/triage-slo-burn-rate-breaches.asciidoc[leveloffset=+5]
+include::./alerting/triage-threshold-breaches.asciidoc[leveloffset=+5]
+
+// Cases
+include::./cases/cases.asciidoc[leveloffset=+3]
+
+include::./cases/create-manage-cases.asciidoc[leveloffset=+4]
+
+include::./cases/manage-cases-settings.asciidoc[leveloffset=+4]
+
+//SLOs
+include::./slos/slos.asciidoc[leveloffset=+3]
+
+include::./slos/create-an-slo.asciidoc[leveloffset=+4]
+
+//Data Set Quality
include::./monitor-datasets.asciidoc[leveloffset=+2]
+//Observability AI Assistant
include::./ai-assistant/ai-assistant.asciidoc[leveloffset=+2]
-include::./elastic-entity-model.asciidoc[leveloffset=+2]
+//Machine learning
+
+include::./machine-learning/machine-learning.asciidoc[leveloffset=+2]
+include::./machine-learning/aiops-detect-anomalies.asciidoc[leveloffset=+3]
+include::./machine-learning/aiops-tune-anomaly-detection-job.asciidoc[leveloffset=+4]
+include::./machine-learning/aiops-forecast-anomaly.asciidoc[leveloffset=+4]
+include::./machine-learning/aiops-analyze-spikes.asciidoc[leveloffset=+3]
+include::./machine-learning/aiops-detect-change-points.asciidoc[leveloffset=+3]
+
+// Reference group
+
+include::./reference.asciidoc[leveloffset=+2]
+
+// Fields
+
+include::./reference/metrics-app-fields.asciidoc[leveloffset=+3]
+
+// Elastic Entity Model
+
+include::./reference/elastic-entity-model.asciidoc[leveloffset=+3]
+
+// Technical preview limitations
include::./limitations.asciidoc[leveloffset=+2]
diff --git a/docs/en/serverless/infra-monitoring/infra-monitoring.asciidoc b/docs/en/serverless/infra-monitoring/infra-monitoring.asciidoc
index 83afbfd638..3dbc6bcdbf 100644
--- a/docs/en/serverless/infra-monitoring/infra-monitoring.asciidoc
+++ b/docs/en/serverless/infra-monitoring/infra-monitoring.asciidoc
@@ -1,5 +1,5 @@
[[observability-infrastructure-monitoring]]
-= Infrastructure monitoring
+= Analyze infrastructure and host metrics
// :description: Monitor metrics from your servers, Docker, Kubernetes, Prometheus, and other services and applications.
// :keywords: serverless, observability, overview
diff --git a/docs/en/serverless/infrastructure-and-host-monitoring-intro.asciidoc b/docs/en/serverless/infrastructure-and-host-monitoring-intro.asciidoc
new file mode 100644
index 0000000000..e621408bc9
--- /dev/null
+++ b/docs/en/serverless/infrastructure-and-host-monitoring-intro.asciidoc
@@ -0,0 +1,20 @@
+[[infrastructure-and-host-monitoring-intro]]
+= Infrastructure and host monitoring
+
+++++
+Infrastructure and hosts
+++++
+
+Explore the topics in this section to learn how to observe and monitor hosts and other systems running in your environment.
+
+[cols="1,1"]
+|===
+|<>
+|Visualize infrastructure metrics to help diagnose problematic spikes, identify high resource utilization, automatically discover and track pods, and unify your metrics with other observability data.
+
+|<>
+|Troubleshoot common issues on your own or ask for help.
+
+|<>
+|Learn about the key metrics displayed in the Infrastructure UI and how they are calculated.
+|===
diff --git a/docs/en/serverless/logging/log-monitoring.asciidoc b/docs/en/serverless/logging/log-monitoring.asciidoc
index 860d1cd2bb..ccc9ce684e 100644
--- a/docs/en/serverless/logging/log-monitoring.asciidoc
+++ b/docs/en/serverless/logging/log-monitoring.asciidoc
@@ -1,6 +1,10 @@
[[observability-log-monitoring]]
= Log monitoring
+++++
+Logs
+++++
+
// :description: Use Elastic to deploy and manage logs at a petabyte scale, and get insights from your logs in minutes.
// :keywords: serverless, observability, overview
diff --git a/docs/en/serverless/aiops/aiops-analyze-spikes.asciidoc b/docs/en/serverless/machine-learning/aiops-analyze-spikes.asciidoc
similarity index 100%
rename from docs/en/serverless/aiops/aiops-analyze-spikes.asciidoc
rename to docs/en/serverless/machine-learning/aiops-analyze-spikes.asciidoc
diff --git a/docs/en/serverless/aiops/aiops-detect-anomalies.asciidoc b/docs/en/serverless/machine-learning/aiops-detect-anomalies.asciidoc
similarity index 100%
rename from docs/en/serverless/aiops/aiops-detect-anomalies.asciidoc
rename to docs/en/serverless/machine-learning/aiops-detect-anomalies.asciidoc
diff --git a/docs/en/serverless/aiops/aiops-detect-change-points.asciidoc b/docs/en/serverless/machine-learning/aiops-detect-change-points.asciidoc
similarity index 100%
rename from docs/en/serverless/aiops/aiops-detect-change-points.asciidoc
rename to docs/en/serverless/machine-learning/aiops-detect-change-points.asciidoc
diff --git a/docs/en/serverless/aiops/aiops-forecast-anomaly.asciidoc b/docs/en/serverless/machine-learning/aiops-forecast-anomaly.asciidoc
similarity index 100%
rename from docs/en/serverless/aiops/aiops-forecast-anomaly.asciidoc
rename to docs/en/serverless/machine-learning/aiops-forecast-anomaly.asciidoc
diff --git a/docs/en/serverless/aiops/aiops-tune-anomaly-detection-job.asciidoc b/docs/en/serverless/machine-learning/aiops-tune-anomaly-detection-job.asciidoc
similarity index 100%
rename from docs/en/serverless/aiops/aiops-tune-anomaly-detection-job.asciidoc
rename to docs/en/serverless/machine-learning/aiops-tune-anomaly-detection-job.asciidoc
diff --git a/docs/en/serverless/aiops/aiops.asciidoc b/docs/en/serverless/machine-learning/machine-learning.asciidoc
similarity index 72%
rename from docs/en/serverless/aiops/aiops.asciidoc
rename to docs/en/serverless/machine-learning/machine-learning.asciidoc
index 1a3f86c0c2..3c49557cee 100644
--- a/docs/en/serverless/aiops/aiops.asciidoc
+++ b/docs/en/serverless/machine-learning/machine-learning.asciidoc
@@ -1,10 +1,14 @@
-[[observability-aiops]]
-= AIOps
+[[observability-machine-learning]]
+= Machine learning and AIOps
+
+++++
+Machine learning
+++++
// :description: Automate anomaly detection and accelerate root cause analysis with AIOps.
// :keywords: serverless, observability, overview
-The AIOps capabilities available in {obs-serverless} enable you to consume and process large observability data sets at scale, reducing the time and effort required to detect, understand, investigate, and resolve incidents.
+The machine learning capabilities available in {obs-serverless} enable you to consume and process large observability data sets at scale, reducing the time and effort required to detect, understand, investigate, and resolve incidents.
Built on predictive analytics and {ml}, our AIOps capabilities require no prior experience with {ml}.
DevOps engineers, SREs, and security analysts can get started right away using these AIOps features with little or no advanced configuration:
diff --git a/docs/en/serverless/monitor-datasets.asciidoc b/docs/en/serverless/monitor-datasets.asciidoc
index a6a17b7297..897253df6a 100644
--- a/docs/en/serverless/monitor-datasets.asciidoc
+++ b/docs/en/serverless/monitor-datasets.asciidoc
@@ -1,6 +1,10 @@
[[observability-monitor-datasets]]
= Data set quality monitoring
+++++
+Data set quality
+++++
+
// :description: Monitor data sets to find degraded documents.
// :keywords: serverless, observability, how-to
diff --git a/docs/en/serverless/observability-get-started.asciidoc b/docs/en/serverless/observability-get-started.asciidoc
new file mode 100644
index 0000000000..30defd72be
--- /dev/null
+++ b/docs/en/serverless/observability-get-started.asciidoc
@@ -0,0 +1,78 @@
+[[observability-get-started]]
+= Get started with Elastic Observability
+
+++++
+Get started
+++++
+
+New to Elastic {observability}? Discover more about our observability features and how to get started.
+
+[discrete]
+== Learn about Elastic {observability}
+
+Learn about key features available to help you get value from your observability data and what it will cost you:
+
+* <>
+* <>
+
+[discrete]
+[[get-started-with-use-case]]
+== Get started with your use case
+
+Learn how to create an Observability project and use Elastic
+Observability to gain deeper insight into the behavior of your applications and
+systems.
+
+image::images/get-started.svg[]
+
+1. **Choose your source.** Elastic integrates with hundreds of data sources for
+unified visibility across all your applications and systems.
+
+2. **Ingest your data.** Turn-key integrations provide a repeatable workflow to
+ingest data from all your sources: you install an integration, configure it, and
+deploy an agent to collect your data.
+
+3. **View your data.** Navigate seamlessly between Observabilty UIs and
+dashboards to identify and resolve problems quickly.
+
+4. **Customize.** Expand your deployment and add features like alerting and anomaly
+detection.
+
+To get started, <>,
+then follow one of our <> to learn how to ingest and visualize your observability data.
+
+[discrete]
+[[quickstarts-overview]]
+=== Quickstarts
+
+Our quickstarts dramatically reduce your time-to-value by offering a fast path to ingest and visualize your Observability data.
+Each quickstart provides:
+
+* A highly opinionated, fast path to data ingestion
+* Sensible configuration defaults with minimal configuration required
+* Auto-detection of logs and metrics for monitoring hosts
+* Quick access to related dashboards and visualizations
+
+Follow the steps in these guides to get started quickly:
+
+* <>
+* <>
+* <>
+
+[discrete]
+=== Get started with other features
+
+Want to use {fleet} or some other feature not covered in the quickstarts?
+Follow the steps in these guides to get started:
+
+* <>
+* <>
+* <>
+
+[discrete]
+== Additional guides
+
+Ready to dig into more features of Elastic Observability? See these guides:
+
+* <>
+* <>
diff --git a/docs/en/serverless/observability-overview.asciidoc b/docs/en/serverless/observability-overview.asciidoc
index a526260f4e..8100cac66b 100644
--- a/docs/en/serverless/observability-overview.asciidoc
+++ b/docs/en/serverless/observability-overview.asciidoc
@@ -134,7 +134,7 @@ image::images/cases.png[Screenshot showing list of cases]
[discrete]
[[observability-serverless-observability-overview-aiops]]
-== AIOps
+== Machine learning and AIOps
Reduce the time and effort required to detect, understand, investigate, and resolve incidents at scale
by leveraging predictive analytics and machine learning:
@@ -146,4 +146,4 @@ by leveraging predictive analytics and machine learning:
[role="screenshot"]
image::images/log-rate-analysis.png[Log rate analysis page showing log rate spike ]
-<>
+<>
diff --git a/docs/en/serverless/quickstarts/collect-data-with-aws-firehose.asciidoc b/docs/en/serverless/quickstarts/collect-data-with-aws-firehose.asciidoc
index 6023ba2649..fdf8f4514e 100644
--- a/docs/en/serverless/quickstarts/collect-data-with-aws-firehose.asciidoc
+++ b/docs/en/serverless/quickstarts/collect-data-with-aws-firehose.asciidoc
@@ -1,7 +1,5 @@
[[collect-data-with-aws-firehose]]
-= Collect data with AWS Firehose
-
-preview::[]
+= Quickstart: Collect data with AWS Firehose
In this quickstart guide, you'll learn how to use AWS Firehose to send logs and metrics to Elastic.
@@ -47,10 +45,10 @@ You can use an AWS CLI command or upload the template to the AWS CloudFormation
* `FirehoseStreamNameForLogs`: Name for Amazon Data Firehose Stream for collecting CloudWatch logs. Default is `elastic-firehose-logs`.
====
-IMPORTANT: Some AWS services need additional manual configuration to properly ingest logs and metrics. For more information, check the
+IMPORTANT: Some AWS services need additional manual configuration to properly ingest logs and metrics. For more information, check the
link:https://www.elastic.co/docs/current/integrations/aws[AWS integration] documentation.
-Data collection with AWS Firehose is supported on Amazon Web Services.
+Data collection with AWS Firehose is supported on Amazon Web Services.
[discrete]
== Prerequisites
@@ -66,16 +64,16 @@ NOTE: The default CloudFormation stack is created in the AWS region selected for
The AWS Firehose receiver has the following limitations:
-* It does not support AWS PrivateLink.
-* The CloudFormation template detects and ingests logs and metrics within a single AWS region only.
+* It does not support AWS PrivateLink.
+* The CloudFormation template detects and ingests logs and metrics within a single AWS region only.
The following table shows the type of data ingested by the supported AWS services:
|===
-| AWS Service | Data type
+| AWS Service | Data type
-| VPC Flow Logs |Logs
-| API Gateway|Logs, Metrics
+| VPC Flow Logs |Logs
+| API Gateway|Logs, Metrics
| CloudTrail | Logs
| Network Firewall | Logs, Metrics
| Route53 | Logs
diff --git a/docs/en/serverless/quickstarts/k8s-logs-metrics.asciidoc b/docs/en/serverless/quickstarts/k8s-logs-metrics.asciidoc
index 6a30cb6d7e..aad133d18b 100644
--- a/docs/en/serverless/quickstarts/k8s-logs-metrics.asciidoc
+++ b/docs/en/serverless/quickstarts/k8s-logs-metrics.asciidoc
@@ -1,5 +1,5 @@
[[observability-quickstarts-k8s-logs-metrics]]
-= Monitor your Kubernetes cluster with Elastic Agent
+= Quickstart: Monitor your Kubernetes cluster with Elastic Agent
// :description: Learn how to monitor your cluster infrastructure running on Kubernetes.
// :keywords: serverless, observability, how-to
diff --git a/docs/en/serverless/quickstarts/monitor-hosts-with-elastic-agent.asciidoc b/docs/en/serverless/quickstarts/monitor-hosts-with-elastic-agent.asciidoc
index ad1c92e011..77c781c4dc 100644
--- a/docs/en/serverless/quickstarts/monitor-hosts-with-elastic-agent.asciidoc
+++ b/docs/en/serverless/quickstarts/monitor-hosts-with-elastic-agent.asciidoc
@@ -1,5 +1,5 @@
[[observability-quickstarts-monitor-hosts-with-elastic-agent]]
-= Monitor hosts with {agent}
+= Quickstart: Monitor hosts with {agent}
// :description: Learn how to scan your hosts to detect and collect logs and metrics.
// :keywords: serverless, observability, how-to
@@ -117,7 +117,7 @@ You can also:
** <> to find degraded documents.
** <> to find patterns in unstructured log messages.
** <> that notify you when an Observability data type reaches or exceeds a given value.
-* Use <> to apply predictive analytics and machine learning to your data:
+* Use <> to apply predictive analytics and machine learning to your data:
+
** <> by comparing real-time and historical data from different sources to look for unusual, problematic patterns.
** <>.
diff --git a/docs/en/serverless/quickstarts/overview.asciidoc b/docs/en/serverless/quickstarts/overview.asciidoc
deleted file mode 100644
index 0ee9286435..0000000000
--- a/docs/en/serverless/quickstarts/overview.asciidoc
+++ /dev/null
@@ -1,21 +0,0 @@
-[[observability-quickstarts-overview]]
-= Quickstarts
-
-// :description: Learn how to ingest your observability data and get immediate value.
-// :keywords: serverless, observability, how-to
-
-Our quickstarts dramatically reduce your time-to-value by offering a fast path to ingest and visualize your Observability data.
-Each quickstart provides:
-
-* A highly opinionated, fast path to data ingestion
-* Sensible configuration defaults with minimal configuration required
-* Auto-detection of logs and metrics for monitoring hosts
-* Quick access to related dashboards and visualizations
-
-[discrete]
-[[observability-quickstarts-overview-available-quickstarts]]
-== Available quickstarts
-
-* <>
-* <>
-* <>
diff --git a/docs/en/serverless/redirects.asciidoc b/docs/en/serverless/redirects.asciidoc
index 12f500abae..8c9bffd8b7 100644
--- a/docs/en/serverless/redirects.asciidoc
+++ b/docs/en/serverless/redirects.asciidoc
@@ -7,3 +7,8 @@ The following pages have moved or been deleted.
=== Technical preview limitations
Refer to <>.
+
+[role="exclude",id="observability-aiops"]
+=== AIOps
+
+Refer to <>.
diff --git a/docs/en/serverless/reference.asciidoc b/docs/en/serverless/reference.asciidoc
new file mode 100644
index 0000000000..8774ed826c
--- /dev/null
+++ b/docs/en/serverless/reference.asciidoc
@@ -0,0 +1,7 @@
+[[reference]]
+= Reference
+
+This section contains reference information related to using Elastic {observability}.
+
+* <>
+* <>
diff --git a/docs/en/serverless/elastic-entity-model.asciidoc b/docs/en/serverless/reference/elastic-entity-model.asciidoc
similarity index 96%
rename from docs/en/serverless/elastic-entity-model.asciidoc
rename to docs/en/serverless/reference/elastic-entity-model.asciidoc
index 29d1e1e674..ecd42912c7 100644
--- a/docs/en/serverless/elastic-entity-model.asciidoc
+++ b/docs/en/serverless/reference/elastic-entity-model.asciidoc
@@ -29,7 +29,7 @@ The Elastic Entity Model currently supports the <>: Learn how to ingest your observability data and get immediate value.
+* <>: Discover more about our observability features and how to get started.
+* <>: Scan your host to detect and collect logs and metrics.
+* <>: Create the Kubernetes resources that are required to monitor your cluster infrastructure.
* <>: Add your log data to Elastic Observability and start exploring your logs.
* <>: Collect Application Performance Monitoring (APM) data and visualize it in real time.
* <>: Add your metrics data to Elastic Observability and visualize it in real time.