[DOCS] Changes level offset for anomaly detection APIs (#59920) (#59928)

docs/reference/ml/anomaly-detection/apis/close-job.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-close-job]]
-=== Close {anomaly-jobs} API
+= Close {anomaly-jobs} API
 ++++
 <titleabbrev>Close jobs</titleabbrev>
 ++++
@@ -13,7 +13,7 @@ A closed job cannot receive data or perform analysis
 operations, but you can still explore and navigate results.
 
 [[ml-close-job-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/anomaly_detectors/<job_id>/_close` +
 
@@ -22,7 +22,7 @@ operations, but you can still explore and navigate results.
 `POST _ml/anomaly_detectors/_all/_close` +
 
 [[ml-close-job-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
@@ -31,7 +31,7 @@ operations, but you can still explore and navigate results.
 <<ml-stop-datafeed>>.
 
 [[ml-close-job-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 You can close multiple {anomaly-jobs} in a single API request by using a group
 name, a comma-separated list of jobs, or a wildcard expression. You can close
@@ -57,14 +57,14 @@ situations where the job has already failed, or where you are not interested in
 results the job might have recently produced or might produce in the future.
 
 [[ml-close-job-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection-wildcard]
 
 [[ml-close-job-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `allow_no_jobs`::
 (Optional, boolean)
@@ -79,14 +79,14 @@ which has not responded to its initial close request.
 has closed. The default value is 30 minutes.
 
 [[ml-close-job-response-codes]]
-==== {api-response-codes-title}
+== {api-response-codes-title}
 
 `404` (Missing resources)::
   If `allow_no_jobs` is `false`, this code indicates that there are no 
   resources that match the request or only partial matches for the request.
 
 [[ml-close-job-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/delete-calendar-event.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-delete-calendar-event]]
-=== Delete events from calendar API
+= Delete events from calendar API
 ++++
 <titleabbrev>Delete events from calendar</titleabbrev>
 ++++
@@ -9,26 +9,26 @@
 Deletes scheduled events from a calendar.
 
 [[ml-delete-calendar-event-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `DELETE _ml/calendars/<calendar_id>/events/<event_id>`
 
 [[ml-delete-calendar-event-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-delete-calendar-event-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 This API removes individual events from a calendar. To remove all scheduled
 events and delete the calendar, see the
 <<ml-delete-calendar,delete calendar API>>.
 
 [[ml-delete-calendar-event-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<calendar_id>`::
 (Required, string)
@@ -39,7 +39,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=calendar-id]
 identifier by using the <<ml-get-calendar-event,get calendar events API>>.
 
 [[ml-delete-calendar-event-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/delete-calendar-job.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-delete-calendar-job]]
-=== Delete {anomaly-jobs} from calendar API
+= Delete {anomaly-jobs} from calendar API
 ++++
 <titleabbrev>Delete jobs from calendar</titleabbrev>
 ++++
@@ -9,19 +9,19 @@
 Deletes {anomaly-jobs} from a calendar.
 
 [[ml-delete-calendar-job-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `DELETE _ml/calendars/<calendar_id>/jobs/<job_id>`
 
 [[ml-delete-calendar-job-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-delete-calendar-job-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<calendar_id>`::
 (Required, string)
@@ -32,7 +32,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=calendar-id]
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection-list]
 
 [[ml-delete-calendar-job-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/delete-calendar.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-delete-calendar]]
-=== Delete calendar API
+= Delete calendar API
 ++++
 <titleabbrev>Delete calendar</titleabbrev>
 ++++
@@ -9,32 +9,32 @@
 Deletes a calendar.
 
 [[ml-delete-calendar-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `DELETE _ml/calendars/<calendar_id>`
 
 [[ml-delete-calendar-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-delete-calendar-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 This API removes all scheduled events from the calendar then deletes the
 calendar.
 
 [[ml-delete-calendar-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<calendar_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=calendar-id]
 
 [[ml-delete-calendar-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/delete-datafeed.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-delete-datafeed]]
-=== Delete {dfeeds} API
+= Delete {dfeeds} API
 
 [subs="attributes"]
 ++++
@@ -11,12 +11,12 @@
 Deletes an existing {dfeed}.
 
 [[ml-delete-datafeed-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `DELETE _ml/datafeeds/<feed_id>`
 
 [[ml-delete-datafeed-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * Unless you use the `force` parameter, you must stop the {dfeed} before you
 can delete it.
@@ -25,21 +25,21 @@ can delete it.
 <<security-privileges>>.
 
 [[ml-delete-datafeed-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<feed_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=datafeed-id]
 
 [[ml-delete-datafeed-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `force`::
   (Optional, boolean) Use to forcefully delete a started {dfeed}; this method is
   quicker than stopping and deleting the {dfeed}.
 
 [[ml-delete-datafeed-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/delete-expired-data.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-delete-expired-data]]
-=== Delete expired data API
+= Delete expired data API
 ++++
 <titleabbrev>Delete expired data</titleabbrev>
 ++++
@@ -9,21 +9,21 @@
 Deletes expired and unused machine learning data.
 
 [[ml-delete-expired-data-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `DELETE _ml/_delete_expired_data` +
 
 `DELETE _ml/_delete_expired_data/<job_id>`
 
 [[ml-delete-expired-data-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-delete-expired-data-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 Deletes all job results, model snapshots and forecast data that have exceeded
 their `retention days` period. Machine learning state documents that are not
@@ -35,7 +35,7 @@ You can delete expired data for all {anomaly-jobs} by using `_all`, by specifyin
 `*` as the `<job_id>`, or by omitting the `<job_id>`.
 
 [[ml-delete-expired-data-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Optional, string)
@@ -43,7 +43,7 @@ Identifier for an {anomaly-job}. It can be a job identifier, a group name, or a
 wildcard expression.
 
 [[ml-delete-expired-data-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `requests_per_second`::
 (Optional, float) The desired requests per second for the deletion processes.
@@ -54,7 +54,7 @@ The default behavior is no throttling.
 The default value is `8h` (8 hours).
 
 [[ml-delete-expired-data-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 The endpoint takes no arguments:
 

docs/reference/ml/anomaly-detection/apis/delete-filter.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-delete-filter]]
-=== Delete filter API
+= Delete filter API
 ++++
 <titleabbrev>Delete filter</titleabbrev>
 ++++
@@ -9,33 +9,33 @@
 Deletes a filter.
 
 [[ml-delete-filter-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `DELETE _ml/filters/<filter_id>`
 
 [[ml-delete-filter-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-delete-filter-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 This API deletes a {ml-docs}/ml-rules.html[filter]. 
 If a {ml} job references the filter, you cannot delete the filter. You must 
 update or delete the job before you can delete the filter.
 
 [[ml-delete-filter-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<filter_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=filter-id]
 
 [[ml-delete-filter-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/delete-forecast.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-delete-forecast]]
-=== Delete forecast API
+= Delete forecast API
 ++++
 <titleabbrev>Delete forecast</titleabbrev>
 ++++
@@ -9,7 +9,7 @@
 Deletes forecasts from a {ml} job.  
 
 [[ml-delete-forecast-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `DELETE _ml/anomaly_detectors/<job_id>/_forecast` +
 
@@ -18,14 +18,14 @@ Deletes forecasts from a {ml} job.
 `DELETE _ml/anomaly_detectors/<job_id>/_forecast/_all`
 
 [[ml-delete-forecast-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-delete-forecast-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 By default, forecasts are retained for 14 days. You can specify a different 
 retention period with the `expires_in` parameter in the
@@ -38,7 +38,7 @@ For more information, see
 {ml-docs}/ml-overview.html#ml-forecasting[Forecasting the future].
 
 [[ml-delete-forecast-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<forecast_id>`::
 (Optional, string) A comma-separated list of forecast identifiers. If you do not
@@ -51,7 +51,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
   
 
 [[ml-delete-forecast-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `allow_no_forecasts`::
   (Optional, boolean) Specifies whether an error occurs when there are no
@@ -65,7 +65,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
   the API fails and returns an error. The default value is `30s`.
 
 [[ml-delete-forecast-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/delete-job.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-delete-job]]
-=== Delete {anomaly-jobs} API
+= Delete {anomaly-jobs} API
 ++++
 <titleabbrev>Delete jobs</titleabbrev>
 ++++
@@ -9,12 +9,12 @@
 Deletes an existing {anomaly-job}.
 
 [[ml-delete-job-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `DELETE _ml/anomaly_detectors/<job_id>`
 
 [[ml-delete-job-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If {es} {security-features} are enabled, you must have `manage_ml` or `manage`
 cluster privileges to use this API. See <<security-privileges>>.
@@ -23,7 +23,7 @@ with it. See <<ml-delete-datafeed>>.
 * Before you can delete a job, you must close it (unless you specify the `force` parameter). See <<ml-close-job>>.
 
 [[ml-delete-job-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 All job configuration, model state and results are deleted.
 
@@ -36,14 +36,14 @@ It is not currently possible to delete multiple jobs using wildcards or a comma
 separated list.
 
 [[ml-delete-job-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 
 [[ml-delete-job-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `force`::
 (Optional, boolean) Use to forcefully delete an opened job; this method is
@@ -54,7 +54,7 @@ quicker than closing and deleting the job.
 wait until the job deletion completes. Defaults to `true`.
 
 [[ml-delete-job-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/delete-snapshot.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-delete-snapshot]]
-=== Delete model snapshots API
+= Delete model snapshots API
 ++++
 <titleabbrev>Delete model snapshots</titleabbrev>
 ++++
@@ -9,25 +9,25 @@
 Deletes an existing model snapshot.
 
 [[ml-delete-snapshot-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `DELETE _ml/anomaly_detectors/<job_id>/model_snapshots/<snapshot_id>`
 
 [[ml-delete-snapshot-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See <<security-privileges>>.
 
 [[ml-delete-snapshot-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 IMPORTANT: You cannot delete the active model snapshot. To delete that snapshot,
 first revert to a different one. To identify the active model snapshot, refer to
 the `model_snapshot_id` in the results from the get jobs API.
 
 [[ml-delete-snapshot-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
@@ -38,7 +38,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=snapshot-id]
 
 [[ml-delete-snapshot-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/estimate-model-memory.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-estimate-model-memory]]
-=== Estimate {anomaly-jobs} model memory API
+= Estimate {anomaly-jobs} model memory API
 ++++
 <titleabbrev>Estimate model memory</titleabbrev>
 ++++
@@ -12,12 +12,12 @@ fields it references.
 
 
 [[ml-estimate-model-memory-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/anomaly_detectors/_estimate_model_memory`
 
 [[ml-estimate-model-memory-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 If the {es} {security-features} are enabled, you must have the following 
 equivalent privileges:
@@ -28,7 +28,7 @@ For more information, see <<security-privileges>>.
 
 
 [[ml-estimate-model-memory-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `analysis_config`::
 (Required, object) 
@@ -54,7 +54,7 @@ no effect on the estimation. +
 `over_field_name` or `partition_field_name`.
 
 [[ml-estimate-model-memory-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/find-file-structure.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="basic"]
 [[ml-find-file-structure]]
-=== Find file structure API
+= Find file structure API
 ++++
 <titleabbrev>Find file structure</titleabbrev>
 ++++
@@ -13,13 +13,13 @@ suitable to be ingested into {es}.
 
 
 [[ml-find-file-structure-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/find_file_structure`
 
 
 [[ml-find-file-structure-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml` or
 `monitor` cluster privileges to use this API. See
@@ -27,7 +27,7 @@ suitable to be ingested into {es}.
 
 
 [[ml-find-file-structure-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 This API provides a starting point for ingesting data into {es} in a format that
 is suitable for subsequent use with other {ml} functionality.
@@ -60,7 +60,7 @@ chosen.
 
 
 [[ml-find-file-structure-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `charset`::
   (Optional, string) The file's character set. It must be a character set that
@@ -233,7 +233,7 @@ for more information about date and time format syntax.
 --
 
 [[ml-find-file-structure-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 The text file that you want to analyze. It must contain data that is suitable to
 be ingested into {es}. It does not need to be in JSON format and it does not
@@ -241,10 +241,10 @@ need to be UTF-8 encoded. The size is limited to the {es} HTTP receive buffer
 size, which defaults to 100 Mb.
 
 [[ml-find-file-structure-examples]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [[ml-find-file-structure-example-nld-json]]
-===== Ingesting newline-delimited JSON
+=== Ingesting newline-delimited JSON
 
 Suppose you have a newline-delimited JSON file that contains information about
 some books. You can send the contents to the `find_file_structure` endpoint:
@@ -556,7 +556,7 @@ If the request does not encounter errors, you receive the following result:
 
 
 [[ml-find-file-structure-example-nyc]]
-===== Finding the structure of NYC yellow cab example data
+=== Finding the structure of NYC yellow cab example data
 
 The next example shows how it's possible to find the structure of some New York
 City yellow cab trip data. The first `curl` command downloads the data, the
@@ -1479,7 +1479,7 @@ If the request does not encounter errors, you receive the following result:
 
 
 [[ml-find-file-structure-example-timeout]]
-===== Setting the timeout parameter
+=== Setting the timeout parameter
 
 If you try to analyze a lot of data then the analysis will take a long time.
 If you want to limit the amount of processing your {es} cluster performs for
@@ -1525,7 +1525,7 @@ data.
 
 
 [[ml-find-file-structure-example-eslog]]
-===== Analyzing {es} log files
+=== Analyzing {es} log files
 
 This is an example of analyzing {es}'s own log file:
 
@@ -1677,7 +1677,7 @@ this:
 
 
 [[ml-find-file-structure-example-grok]]
-===== Specifying `grok_pattern` as query parameter
+=== Specifying `grok_pattern` as query parameter
 
 If you recognize more fields than the simple `grok_pattern` produced by the
 structure finder unaided then you can resubmit the request specifying a more

docs/reference/ml/anomaly-detection/apis/flush-job.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-flush-job]]
-=== Flush jobs API
+= Flush jobs API
 ++++
 <titleabbrev>Flush jobs</titleabbrev>
 ++++
@@ -9,19 +9,19 @@
 Forces any buffered data to be processed by the job.
 
 [[ml-flush-job-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/anomaly_detectors/<job_id>/_flush`
 
 [[ml-flush-job-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-flush-job-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 The flush jobs API is only applicable when sending data for analysis using the
 <<ml-post-data,post data API>>. Depending on the content of the buffer, then it
@@ -34,14 +34,14 @@ additionally prunes and persists the model state to disk and the job must be
 opened again before analyzing further data.
 
 [[ml-flush-job-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 
 [[ml-flush-job-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `advance_time`::
   (string) Optional. Specifies to advance to a particular time value. Results are
@@ -65,7 +65,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
   range of buckets on which to calculate interim results.
 
 [[ml-flush-job-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/forecast.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-forecast]]
-=== Forecast jobs API
+= Forecast jobs API
 ++++
 <titleabbrev>Forecast jobs</titleabbrev>
 ++++
@@ -9,19 +9,19 @@
 Predicts the future behavior of a time series by using its historical behavior. 
 
 [[ml-forecast-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/anomaly_detectors/<job_id>/_forecast`
 
 [[ml-forecast-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-forecast-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 You can create a forecast job based on an {anomaly-job} to extrapolate future 
 behavior. Refer to 
@@ -41,14 +41,14 @@ forecast. For more information about this property, see <<ml-put-job>>.
 ===============================
 
 [[ml-forecast-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 
 [[ml-forecast-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `duration`::
   (Optional, <<time-units, time units>>) A period of time that indicates how far 
@@ -70,7 +70,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
   below that amount.
 
 [[ml-forecast-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-bucket.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-bucket]]
-=== Get buckets API
+= Get buckets API
 ++++
 <titleabbrev>Get buckets</titleabbrev>
 ++++
@@ -9,14 +9,14 @@
 Retrieves {anomaly-job} results for one or more buckets.
 
 [[ml-get-bucket-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/anomaly_detectors/<job_id>/results/buckets` +
 
 `GET _ml/anomaly_detectors/<job_id>/results/buckets/<timestamp>`
 
 [[ml-get-bucket-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. You also
@@ -27,13 +27,13 @@ privileges. For more information, see
 <<built-in-roles>>.
 
 [[ml-get-bucket-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 The get buckets API presents a chronological view of the records, grouped by
 bucket.
 
 [[ml-get-bucket-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
@@ -44,7 +44,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 specify this parameter, the API returns information about all buckets.
 
 [[ml-get-bucket-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `anomaly_score`::
 (Optional, double) Returns buckets with anomaly scores greater or equal than
@@ -79,7 +79,7 @@ default, the buckets are sorted by the `timestamp` field.
 
 [role="child_attributes"]
 [[ml-get-bucket-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns an array of bucket objects, which have the following properties:
 
@@ -174,7 +174,7 @@ the results for the bucket.
 --
 
 [[ml-get-bucket-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-calendar-event.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-calendar-event]]
-=== Get scheduled events API
+= Get scheduled events API
 ++++
 <titleabbrev>Get scheduled events</titleabbrev>
 ++++
@@ -9,21 +9,21 @@
 Retrieves information about the scheduled events in calendars.
 
 [[ml-get-calendar-event-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/calendars/<calendar_id>/events` +
 
 `GET _ml/calendars/_all/events`
 
 [[ml-get-calendar-event-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-get-calendar-event-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 You can get scheduled event information for a single calendar or for all
 calendars by using `_all`.
@@ -32,14 +32,14 @@ For more information, see
 {ml-docs}/ml-calendars.html[Calendars and scheduled events].
 
 [[ml-get-calendar-event-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<calendar_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=calendar-id]
 
 [[ml-get-calendar-event-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `end`::
 (Optional, string) Specifies to get events with timestamps earlier than this
@@ -55,7 +55,7 @@ time.
 (Optional, string) Specifies to get events with timestamps after this time.
 
 [[ml-get-calendar-event-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns an array of scheduled event resources, which have the
 following properties:
@@ -79,7 +79,7 @@ the epoch or ISO 8601 format.
 since the epoch or ISO 8601 format.
 
 [[ml-get-calendar-event-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-calendar.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-calendar]]
-=== Get calendars API
+= Get calendars API
 ++++
 <titleabbrev>Get calendars</titleabbrev>
 ++++
@@ -9,21 +9,21 @@
 Retrieves configuration information for calendars.
 
 [[ml-get-calendar-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/calendars/<calendar_id>` +
 
 `GET _ml/calendars/_all`
 
 [[ml-get-calendar-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-get-calendar-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 You can get information for a single calendar or for all calendars by using
 `_all`.
@@ -32,14 +32,14 @@ For more information, see
 {ml-docs}/ml-calendars.html[Calendars and scheduled events].
 
 [[ml-get-calendar-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<calendar_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=calendar-id]
 
 [[ml-get-calendar-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `page`.`from`::
 (Optional, integer) Skips the specified number of calendars.
@@ -48,7 +48,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=calendar-id]
 (Optional, integer) Specifies the maximum number of calendars to obtain.
 
 [[ml-get-calendar-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns an array of calendar resources, which have the following
 properties:
@@ -61,7 +61,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=calendar-id]
 (array) An array of {anomaly-job} identifiers. For example: `["total-requests"]`.
 
 [[ml-get-calendar-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-category.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-category]]
-=== Get categories API
+= Get categories API
 ++++
 <titleabbrev>Get categories</titleabbrev>
 ++++
@@ -9,14 +9,14 @@
 Retrieves {anomaly-job} results for one or more categories.
 
 [[ml-get-category-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/anomaly_detectors/<job_id>/results/categories` +
 
 `GET _ml/anomaly_detectors/<job_id>/results/categories/<category_id>`
 
 [[ml-get-category-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. You also
@@ -26,7 +26,7 @@ privileges. See <<security-privileges>> and
 <<built-in-roles>>.
 
 [[ml-get-category-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 When `categorization_field_name` is specified in the job configuration, it is
 possible to view the definitions of the resulting categories. A category
@@ -40,7 +40,7 @@ examine the description and examples of that category. For more information, see
 {ml-docs}/ml-configuring-categories.html[Categorizing log messages].
 
 [[ml-get-category-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<category_id>`::
 (Optional, long) Identifier for the category, which is unique in the job. If you
@@ -54,7 +54,7 @@ specified partition.
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 
 [[ml-get-category-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `page`.`from`::
 (Optional, integer) Skips the specified number of categories.
@@ -66,7 +66,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 (Optional, string) Only return categories for the specified partition.
 
 [[ml-get-category-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns an array of category objects, which have the following
 properties:
@@ -126,7 +126,7 @@ category and not any of the categories in this list. This is only guaranteed
 to have the latest accurate list of categories after a job `_flush` or `_close`
 
 [[ml-get-category-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-datafeed-stats.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-datafeed-stats]]
-=== Get {dfeed} statistics API
+= Get {dfeed} statistics API
 
 [subs="attributes"]
 ++++
@@ -11,7 +11,7 @@
 Retrieves usage information for {dfeeds}.
 
 [[ml-get-datafeed-stats-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/datafeeds/<feed_id>/_stats` +
 
@@ -22,14 +22,14 @@ Retrieves usage information for {dfeeds}.
 `GET _ml/datafeeds/_all/_stats` 
 
 [[ml-get-datafeed-stats-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-get-datafeed-stats-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 You can get statistics for multiple {dfeeds} in a single API request by using a
 comma-separated list of {dfeeds} or a wildcard expression. You can get
@@ -42,7 +42,7 @@ If the {dfeed} is stopped, the only information you receive is the
 IMPORTANT: This API returns a maximum of 10,000 {dfeeds}.
 
 [[ml-get-datafeed-stats-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<feed_id>`::
 (Optional, string)
@@ -54,7 +54,7 @@ all {dfeeds}.
 --
 
 [[ml-get-datafeed-stats-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `allow_no_datafeeds`::
 (Optional, boolean)
@@ -62,7 +62,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=allow-no-datafeeds]
 
 [role="child_attributes"]
 [[ml-get-datafeed-stats-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns an array of {dfeed} count objects. All of these properties are
 informational; you cannot update their values.
@@ -140,14 +140,14 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=search-time]
 
 
 [[ml-get-datafeed-stats-response-codes]]
-==== {api-response-codes-title}
+== {api-response-codes-title}
 
 `404` (Missing resources)::
   If `allow_no_datafeeds` is `false`, this code indicates that there are no
   resources that match the request or only partial matches for the request. 
 
 [[ml-get-datafeed-stats-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-datafeed.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-datafeed]]
-=== Get {dfeeds} API
+= Get {dfeeds} API
 
 [subs="attributes"]
 ++++
@@ -11,7 +11,7 @@
 Retrieves configuration information for {dfeeds}.
 
 [[ml-get-datafeed-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/datafeeds/<feed_id>` +
 
@@ -22,14 +22,14 @@ Retrieves configuration information for {dfeeds}.
 `GET _ml/datafeeds/_all` 
 
 [[ml-get-datafeed-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-get-datafeed-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 You can get information for multiple {dfeeds} in a single API request by using a
 comma-separated list of {dfeeds} or a wildcard expression. You can get
@@ -39,7 +39,7 @@ information for all {dfeeds} by using `_all`, by specifying `*` as the
 IMPORTANT: This API returns a maximum of 10,000 {dfeeds}. 
 
 [[ml-get-datafeed-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<feed_id>`::
 (Optional, string)
@@ -51,27 +51,27 @@ all {dfeeds}.
 --
 
 [[ml-get-datafeed-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `allow_no_datafeeds`::
 (Optional, boolean)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=allow-no-datafeeds]
 
 [[ml-get-datafeed-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns an array of {dfeed} resources. For the full list of properties,
 see <<ml-put-datafeed-request-body,create {dfeeds} API>>.
 
 [[ml-get-datafeed-response-codes]]
-==== {api-response-codes-title}
+== {api-response-codes-title}
 
 `404` (Missing resources)::
   If `allow_no_datafeeds` is `false`, this code indicates that there are no
   resources that match the request or only partial matches for the request.
 
 [[ml-get-datafeed-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-filter.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-filter]]
-=== Get filters API
+= Get filters API
 ++++
 <titleabbrev>Get filters</titleabbrev>
 ++++
@@ -9,34 +9,34 @@
 Retrieves filters.
 
 [[ml-get-filter-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/filters/<filter_id>` +
 
 `GET _ml/filters/`
 
 [[ml-get-filter-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-get-filter-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 You can get a single filter or all filters. For more information, see 
 {ml-docs}/ml-rules.html[Machine learning custom rules].
 
 [[ml-get-filter-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<filter_id>`::
 (Optional, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=filter-id]
 
 [[ml-get-filter-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `from`::
 (Optional, integer) Skips the specified number of filters.
@@ -45,7 +45,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=filter-id]
 (Optional, integer) Specifies the maximum number of filters to obtain.
 
 [[ml-get-filter-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns an array of filter resources, which have the following
 properties:
@@ -61,7 +61,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=filter-id]
 (array of strings) An array of strings which is the filter item list.
 
 [[ml-get-filter-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-influencer.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-influencer]]
-=== Get influencers API
+= Get influencers API
 ++++
 <titleabbrev>Get influencers</titleabbrev>
 ++++
@@ -9,12 +9,12 @@
 Retrieves {anomaly-job} results for one or more influencers.
 
 [[ml-get-influencer-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/anomaly_detectors/<job_id>/results/influencers`
 
 [[ml-get-influencer-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. You also
@@ -24,21 +24,21 @@ privileges. See <<security-privileges>> and
 <<built-in-roles>>.
 
 [[ml-get-influencer-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 Influencers are the entities that have contributed to, or are to blame for,
 the anomalies. Influencer results are available only if an
 `influencer_field_name` is specified in the job configuration.
 
 [[ml-get-influencer-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 
 [[ml-get-influencer-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `desc`::
 (Optional, boolean)
@@ -69,7 +69,7 @@ default, the influencers are sorted by the `influencer_score` value.
 (Optional, string) Returns influencers with timestamps after this time.
 
 [[ml-get-influencer-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns an array of influencer objects, which have the following
 properties:
@@ -123,7 +123,7 @@ field `user_name` is added to the result document. This information enables you
 filter the anomaly results more easily.
 
 [[ml-get-influencer-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-job-stats.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-job-stats]]
-=== Get {anomaly-job} statistics API
+= Get {anomaly-job} statistics API
 ++++
 <titleabbrev>Get job statistics</titleabbrev>
 ++++
@@ -9,7 +9,7 @@
 Retrieves usage information for {anomaly-jobs}.
 
 [[ml-get-job-stats-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/anomaly_detectors/<job_id>/_stats`
 
@@ -20,14 +20,14 @@ Retrieves usage information for {anomaly-jobs}.
 `GET _ml/anomaly_detectors/_all/_stats` 
 
 [[ml-get-job-stats-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-get-job-stats-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 You can get statistics for multiple {anomaly-jobs} in a single API request by
 using a group name, a comma-separated list of jobs, or a wildcard expression.
@@ -37,14 +37,14 @@ as the `<job_id>`, or by omitting the `<job_id>`.
 IMPORTANT: This API returns a maximum of 10,000 jobs.
 
 [[ml-get-job-stats-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Optional, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection-default]
 
 [[ml-get-job-stats-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `allow_no_jobs`::
 (Optional, boolean)
@@ -52,7 +52,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=allow-no-jobs]
 
 [role="child_attributes"]
 [[ml-get-job-stats-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns the following information about the operational progress of a
 job:
@@ -360,14 +360,14 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=bucket-time-total]
 //End timing_stats
 
 [[ml-get-job-stats-response-codes]]
-==== {api-response-codes-title}
+== {api-response-codes-title}
 
 `404` (Missing resources)::
   If `allow_no_jobs` is `false`, this code indicates that there are no 
   resources that match the request or only partial matches for the request.
 
 [[ml-get-job-stats-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-job.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-job]]
-=== Get {anomaly-jobs} API
+= Get {anomaly-jobs} API
 ++++
 <titleabbrev>Get jobs</titleabbrev>
 ++++
@@ -9,7 +9,7 @@
 Retrieves configuration information for {anomaly-jobs}.
 
 [[ml-get-job-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/anomaly_detectors/<job_id>` +
 
@@ -20,14 +20,14 @@ Retrieves configuration information for {anomaly-jobs}.
 `GET _ml/anomaly_detectors/_all`
 
 [[ml-get-job-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-get-job-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 You can get information for multiple {anomaly-jobs} in a single API request by
 using a group name, a comma-separated list of jobs, or a wildcard expression.
@@ -37,21 +37,21 @@ You can get information for all {anomaly-jobs} by using `_all`, by specifying
 IMPORTANT: This API returns a maximum of 10,000 jobs. 
 
 [[ml-get-job-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Optional, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection-default]
 
 [[ml-get-job-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `allow_no_jobs`::
 (Optional, boolean)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=allow-no-jobs]
 
 [[ml-get-job-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns an array of {anomaly-job} resources. For the full list of
 properties, see <<ml-put-job-request-body,create {anomaly-jobs} API>>.
@@ -76,14 +76,14 @@ value.
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=snapshot-id]
 
 [[ml-get-job-response-codes]]
-==== {api-response-codes-title}
+== {api-response-codes-title}
 
 `404` (Missing resources)::
   If `allow_no_jobs` is `false`, this code indicates that there are no 
   resources that match the request or only partial matches for the request.
 
 [[ml-get-job-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-ml-info.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[get-ml-info]]
-=== Get machine learning info API
+= Get machine learning info API
 
 [subs="attributes"]
 ++++
@@ -11,12 +11,12 @@
 Returns defaults and limits used by machine learning.
 
 [[get-ml-info-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/info`
 
 [[get-ml-info-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. The
@@ -25,7 +25,7 @@ privileges. See <<security-privileges>> and
 <<built-in-roles>>.
 
 [[get-ml-info-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 This endpoint is designed to be used by a user interface that needs to fully
 understand machine learning configurations where some options are not specified,
@@ -33,7 +33,7 @@ meaning that the defaults should be used.  This endpoint may be used to find out
 what those defaults are.
 
 [[get-ml-info-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 The endpoint takes no arguments:
 

docs/reference/ml/anomaly-detection/apis/get-overall-buckets.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-overall-buckets]]
-=== Get overall buckets API
+= Get overall buckets API
 ++++
 <titleabbrev>Get overall buckets</titleabbrev>
 ++++
@@ -10,7 +10,7 @@ Retrieves overall bucket results that summarize the bucket results of multiple
 {anomaly-jobs}.
 
 [[ml-get-overall-buckets-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/anomaly_detectors/<job_id>/results/overall_buckets` +
 
@@ -19,7 +19,7 @@ Retrieves overall bucket results that summarize the bucket results of multiple
 `GET _ml/anomaly_detectors/_all/results/overall_buckets`
 
 [[ml-get-overall-buckets-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. You also
@@ -28,7 +28,7 @@ need `read` index privilege on the index that stores the results. The
 privileges. See <<security-privileges>> and <<built-in-roles>>.
 
 [[ml-get-overall-buckets-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 You can summarize the bucket results for all {anomaly-jobs} by using `_all` or
 by specifying `*` as the `<job_id>`.
@@ -52,14 +52,14 @@ the `bucket_span` parameter (to a value greater than its default), the
 a span equal to the jobs' largest bucket span.
 
 [[ml-get-overall-buckets-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection-wildcard-list]
 
 [[ml-get-overall-buckets-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `allow_no_jobs`::
 (Optional, boolean)
@@ -95,7 +95,7 @@ equal to this value.
 the `overall_score` calculation. The default value is `1`.
 
 [[ml-get-overall-buckets-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns an array of overall bucket objects, which have the following
 properties:
@@ -121,7 +121,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=is-interim]
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=timestamp-results]
 
 [[ml-get-overall-buckets-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-record.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-record]]
-=== Get records API
+= Get records API
 ++++
 <titleabbrev>Get records</titleabbrev>
 ++++
@@ -9,12 +9,12 @@
 Retrieves anomaly records for an {anomaly-job}.
 
 [[ml-get-record-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/anomaly_detectors/<job_id>/results/records`
 
 [[ml-get-record-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. You also
@@ -23,7 +23,7 @@ need `read` index privilege on the index that stores the results. The
 privileges. See <<security-privileges>> and <<built-in-roles>>.
 
 [[ml-get-record-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 Records contain the detailed analytical results. They describe the anomalous
 activity that has been identified in the input data based on the detector
@@ -39,14 +39,14 @@ bucket, which relates to the number of time series being modeled and the number
 of detectors.
 
 [[ml-get-record-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 
 [[ml-get-record-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `desc`::
 (Optional, boolean)
@@ -77,7 +77,7 @@ default, the records are sorted by the `anomaly_score` value.
 (Optional, string) Returns records with timestamps after this time.
 
 [[ml-get-record-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns an array of record objects, which have the following properties:
 
@@ -198,7 +198,7 @@ analyzed. For example, if it's analyzing `hostname` as a _by field_, then a fiel
 filter the anomaly results more easily.
 
 [[ml-get-record-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/get-snapshot.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-get-snapshot]]
-=== Get model snapshots API
+= Get model snapshots API
 ++++
 <titleabbrev>Get model snapshots</titleabbrev>
 ++++
@@ -9,21 +9,21 @@
 Retrieves information about model snapshots.
 
 [[ml-get-snapshot-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/anomaly_detectors/<job_id>/model_snapshots` +
 
 `GET _ml/anomaly_detectors/<job_id>/model_snapshots/<snapshot_id>`
 
 [[ml-get-snapshot-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `monitor_ml`,
 `monitor`, `manage_ml`, or `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-get-snapshot-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
@@ -39,7 +39,7 @@ all model snapshots.
 --
 
 [[ml-get-snapshot-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `desc`::
   (Optional, boolean) If true, the results are sorted in descending order.
@@ -62,7 +62,7 @@ all model snapshots.
 
 [role="child_attributes"]
 [[ml-get-snapshot-results]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 The API returns an array of model snapshot objects, which have the following
 properties:
@@ -198,7 +198,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=snapshot-id]
 (date) The creation timestamp for the snapshot.
 
 [[ml-get-snapshot-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/index.asciidoc

@@ -0,0 +1,65 @@
+include::ml-apis.asciidoc[leveloffset=+1]
+//ADD
+include::post-calendar-event.asciidoc[leveloffset=+2]
+include::put-calendar-job.asciidoc[leveloffset=+2]
+//CLOSE
+include::close-job.asciidoc[leveloffset=+2]
+//CREATE
+include::put-job.asciidoc[leveloffset=+2]
+include::put-calendar.asciidoc[leveloffset=+2]
+include::put-datafeed.asciidoc[leveloffset=+2]
+include::put-filter.asciidoc[leveloffset=+2]
+//DELETE
+include::delete-calendar.asciidoc[leveloffset=+2]
+include::delete-datafeed.asciidoc[leveloffset=+2]
+include::delete-calendar-event.asciidoc[leveloffset=+2]
+include::delete-filter.asciidoc[leveloffset=+2]
+include::delete-forecast.asciidoc[leveloffset=+2]
+include::delete-job.asciidoc[leveloffset=+2]
+include::delete-calendar-job.asciidoc[leveloffset=+2]
+include::delete-snapshot.asciidoc[leveloffset=+2]
+include::delete-expired-data.asciidoc[leveloffset=+2]
+//ESTIMATE
+include::estimate-model-memory.asciidoc[leveloffset=+2]
+//FIND
+include::find-file-structure.asciidoc[leveloffset=+2]
+//FLUSH
+include::flush-job.asciidoc[leveloffset=+2]
+//FORECAST
+include::forecast.asciidoc[leveloffset=+2]
+//GET
+include::get-bucket.asciidoc[leveloffset=+2]
+include::get-calendar.asciidoc[leveloffset=+2]
+include::get-category.asciidoc[leveloffset=+2]
+include::get-datafeed.asciidoc[leveloffset=+2]
+include::get-datafeed-stats.asciidoc[leveloffset=+2]
+include::get-influencer.asciidoc[leveloffset=+2]
+include::get-job.asciidoc[leveloffset=+2]
+include::get-job-stats.asciidoc[leveloffset=+2]
+include::get-ml-info.asciidoc[leveloffset=+2]
+include::get-snapshot.asciidoc[leveloffset=+2]
+include::get-overall-buckets.asciidoc[leveloffset=+2]
+include::get-calendar-event.asciidoc[leveloffset=+2]
+include::get-filter.asciidoc[leveloffset=+2]
+include::get-record.asciidoc[leveloffset=+2]
+//OPEN
+include::open-job.asciidoc[leveloffset=+2]
+//POST
+include::post-data.asciidoc[leveloffset=+2]
+//PREVIEW
+include::preview-datafeed.asciidoc[leveloffset=+2]
+//REVERT
+include::revert-snapshot.asciidoc[leveloffset=+2]
+//SET/START/STOP
+include::set-upgrade-mode.asciidoc[leveloffset=+2]
+include::start-datafeed.asciidoc[leveloffset=+2]
+include::stop-datafeed.asciidoc[leveloffset=+2]
+//UPDATE
+include::update-datafeed.asciidoc[leveloffset=+2]
+include::update-filter.asciidoc[leveloffset=+2]
+include::update-job.asciidoc[leveloffset=+2]
+include::update-snapshot.asciidoc[leveloffset=+2]
+//VALIDATE
+//include::validate-detector.asciidoc[leveloffset=+2]
+//include::validate-job.asciidoc[leveloffset=+2]
+

docs/reference/ml/anomaly-detection/apis/ml-apis.asciidoc

@@ -1,15 +1,15 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-apis]]
-== {ml-cap} {anomaly-detect} APIs
+= {ml-cap} {anomaly-detect} APIs
 
 You can use the following APIs to perform {ml} {anomaly-detect} activities.
 
-See also <<ml-df-analytics-apis>>. 
+See also <<ml-df-analytics-apis>>.
 
 [discrete]
 [[ml-api-anomaly-job-endpoint]]
-=== {anomaly-jobs-cap}
+== {anomaly-jobs-cap}
 //* <<ml-valid-detector,Validate detectors>>, <<ml-valid-job,Validate job>>
 * <<ml-put-job,Create>> or <<ml-delete-job,delete {anomaly-jobs}>>
 * <<ml-put-calendar-job,Add>> or <<ml-delete-calendar-job,delete a {anomaly-job} from a calendar>>
@@ -23,7 +23,7 @@ See also <<ml-df-analytics-apis>>.
 
 [discrete]
 [[ml-api-calendar-endpoint]]
-=== Calendars
+== Calendars
 
 * <<ml-put-calendar,Create calendar>>, <<ml-delete-calendar,Delete calendar>>
 * <<ml-put-calendar-job,Add job to calendar>>, <<ml-delete-calendar-job,Delete job from calendar>>
@@ -32,7 +32,7 @@ See also <<ml-df-analytics-apis>>.
 
 [discrete]
 [[ml-api-filter-endpoint]]
-=== Filters
+== Filters
 
 * <<ml-put-filter,Create filter>>, <<ml-delete-filter,Delete filter>>
 * <<ml-update-filter,Update filters>>
@@ -40,7 +40,7 @@ See also <<ml-df-analytics-apis>>.
 
 [discrete]
 [[ml-api-datafeed-endpoint]]
-=== {dfeeds-cap}
+== {dfeeds-cap}
 
 * <<ml-put-datafeed,Create {dfeed}>>, <<ml-delete-datafeed,Delete {dfeed}>>
 * <<ml-start-datafeed,Start {dfeed}>>, <<ml-stop-datafeed,Stop {dfeed}>>
@@ -51,7 +51,7 @@ See also <<ml-df-analytics-apis>>.
 
 [discrete]
 [[ml-api-snapshot-endpoint]]
-=== Model Snapshots
+== Model Snapshots
 
 * <<ml-delete-snapshot,Delete model snapshot>>
 * <<ml-get-snapshot,Get model snapshot info>>
@@ -61,7 +61,7 @@ See also <<ml-df-analytics-apis>>.
 
 [discrete]
 [[ml-api-result-endpoint]]
-=== Results
+== Results
 
 * <<ml-get-bucket,Get buckets>>
 * <<ml-get-overall-buckets,Get overall buckets>>
@@ -71,89 +71,24 @@ See also <<ml-df-analytics-apis>>.
 
 [discrete]
 [[ml-api-file-structure-endpoint]]
-=== File structure
+== File structure
 
 * <<ml-find-file-structure,Find file structure>>
 
 [discrete]
 [[ml-api-ml-info-endpoint]]
-=== Info
+== Info
 
 * <<get-ml-info,Machine learning info>>
 
 [discrete]
 [[ml-api-delete-expired-data-endpoint]]
-=== Delete expired data
+== Delete expired data
 
 * <<ml-delete-expired-data,Delete expired data>>
 
 [discrete]
 [[ml-set-upgrade-mode-endpoint]]
-=== Set upgrade mode
+== Set upgrade mode
 
 * <<ml-set-upgrade-mode, Set upgrade mode>>
-
-//ADD
-include::post-calendar-event.asciidoc[]
-include::put-calendar-job.asciidoc[]
-//CLOSE
-include::close-job.asciidoc[]
-//CREATE
-include::put-job.asciidoc[]
-include::put-calendar.asciidoc[]
-include::put-datafeed.asciidoc[]
-include::put-filter.asciidoc[]
-//DELETE
-include::delete-calendar.asciidoc[]
-include::delete-datafeed.asciidoc[]
-include::delete-calendar-event.asciidoc[]
-include::delete-filter.asciidoc[]
-include::delete-forecast.asciidoc[]
-include::delete-job.asciidoc[]
-include::delete-calendar-job.asciidoc[]
-include::delete-snapshot.asciidoc[]
-include::delete-expired-data.asciidoc[]
-//ESTIMATE
-include::estimate-model-memory.asciidoc[]
-//FIND
-include::find-file-structure.asciidoc[]
-//FLUSH
-include::flush-job.asciidoc[]
-//FORECAST
-include::forecast.asciidoc[]
-//GET
-include::get-bucket.asciidoc[]
-include::get-calendar.asciidoc[]
-include::get-category.asciidoc[]
-include::get-datafeed.asciidoc[]
-include::get-datafeed-stats.asciidoc[]
-include::get-influencer.asciidoc[]
-include::get-job.asciidoc[]
-include::get-job-stats.asciidoc[]
-include::get-ml-info.asciidoc[]
-include::get-snapshot.asciidoc[]
-include::get-overall-buckets.asciidoc[]
-include::get-calendar-event.asciidoc[]
-include::get-filter.asciidoc[]
-include::get-record.asciidoc[]
-//OPEN
-include::open-job.asciidoc[]
-//POST
-include::post-data.asciidoc[]
-//PREVIEW
-include::preview-datafeed.asciidoc[]
-//REVERT
-include::revert-snapshot.asciidoc[]
-//SET/START/STOP
-include::set-upgrade-mode.asciidoc[]
-include::start-datafeed.asciidoc[]
-include::stop-datafeed.asciidoc[]
-//UPDATE
-include::update-datafeed.asciidoc[]
-include::update-filter.asciidoc[]
-include::update-job.asciidoc[]
-include::update-snapshot.asciidoc[]
-//VALIDATE
-//include::validate-detector.asciidoc[]
-//include::validate-job.asciidoc[]
-

docs/reference/ml/anomaly-detection/apis/open-job.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-open-job]]
-=== Open {anomaly-jobs} API
+= Open {anomaly-jobs} API
 ++++
 <titleabbrev>Open jobs</titleabbrev>
 ++++
@@ -9,19 +9,19 @@
 Opens one or more {anomaly-jobs}.
 
 [[ml-open-job-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/anomaly_detectors/{job_id}/_open`
 
 [[ml-open-job-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-open-job-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 An {anomaly-job} must be opened in order for it to be ready to receive and
 analyze data. It can be opened and closed multiple times throughout its
@@ -34,21 +34,21 @@ loaded. The job is ready to resume its analysis from where it left off, once new
 data is received.
 
 [[ml-open-job-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 
 [[ml-open-job-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `timeout`::
   (Optional, time) Controls the time to wait until a job has opened. The default
   value is 30 minutes.
 
 [[ml-open-job-response-body]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 `node`::
   (string) The ID of the node that the job was opened on. If the job is allowed to 
@@ -59,7 +59,7 @@ open lazily and has not yet been assigned to a node, this value is an empty stri
   exception is returned instead.
 
 [[ml-open-job-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/post-calendar-event.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-post-calendar-event]]
-=== Add events to calendar API
+= Add events to calendar API
 ++++
 <titleabbrev>Add events to calendar</titleabbrev>
 ++++
@@ -9,25 +9,25 @@
 Posts scheduled events in a calendar.
 
 [[ml-post-calendar-event-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/calendars/<calendar_id>/events`
 
 [[ml-post-calendar-event-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-post-calendar-event-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 This API accepts a list of {ml-docs}/ml-calendars.html[scheduled events], each
 of which must have a start time, end time, and description.
 
 [[ml-post-calendar-event-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<calendar_id>`::
 (Required, string)
@@ -35,7 +35,7 @@ include::../../ml-shared.asciidoc[tag=calendar-id]
 
 [role="child_attributes"]
 [[ml-post-calendar-event-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `events`::
 (Required, array) A list of one of more scheduled events. The event's start and
@@ -58,7 +58,7 @@ milliseconds since the epoch or ISO 8601 format.
 ====
 
 [[ml-post-calendar-event-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/post-data.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-post-data]]
-=== Post data to jobs API
+= Post data to jobs API
 ++++
 <titleabbrev>Post data to jobs</titleabbrev>
 ++++
@@ -9,19 +9,19 @@
 Sends data to an anomaly detection job for analysis.
 
 [[ml-post-data-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/anomaly_detectors/<job_id>/_data`
 
 [[ml-post-data-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-post-data-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 The job must have a state of `open` to receive and process the data.
 
@@ -43,21 +43,19 @@ The following documents will not be processed:
 * Documents not in chronological order and outside the latency window
 * Records with an invalid timestamp
 
-//TBD link to Working with Out of Order timeseries concept doc
-
 IMPORTANT:  For each job, data can only be accepted from a single connection at
 a time. It is not currently possible to post data to multiple jobs using wildcards
 or a comma-separated list.
 
 [[ml-post-data-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 
 [[ml-post-data-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `reset_start`::
 		(Optional, string) Specifies the start of the bucket resetting range.
@@ -66,13 +64,13 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 		(Optional, string) Specifies the end of the bucket resetting range.
 
 [[ml-post-data-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 A sequence of one or more JSON documents containing the data to be analyzed.
 Only whitespace characters are permitted in between the documents.
 
 [[ml-post-data-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 The following example posts data from the `it_ops_new_kpi.json` file to the
 `it_ops_new_kpi` job:

docs/reference/ml/anomaly-detection/apis/preview-datafeed.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-preview-datafeed]]
-=== Preview {dfeeds} API
+= Preview {dfeeds} API
 
 [subs="attributes"]
 ++++
@@ -11,19 +11,19 @@
 Previews a {dfeed}.
 
 [[ml-preview-datafeed-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `GET _ml/datafeeds/<datafeed_id>/_preview`
 
 [[ml-preview-datafeed-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If {es} {security-features} are enabled, you must have `monitor_ml`, `monitor`,
 `manage_ml`, or `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-preview-datafeed-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 The preview {dfeeds} API returns the first "page" of results from the `search`
 that is created by using the current {dfeed} settings. This preview shows the
@@ -40,14 +40,14 @@ it to ensure it is returning the expected data. Alternatively, use
 supply the credentials.
 
 [[ml-preview-datafeed-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<datafeed_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=datafeed-id]
 
 [[ml-preview-datafeed-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/put-calendar-job.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-put-calendar-job]]
-=== Add {anomaly-jobs} to calendar API
+= Add {anomaly-jobs} to calendar API
 ++++
 <titleabbrev>Add jobs to calendar</titleabbrev>
 ++++
@@ -9,19 +9,19 @@
 Adds an {anomaly-job} to a calendar.
 
 [[ml-put-calendar-job-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `PUT _ml/calendars/<calendar_id>/jobs/<job_id>`
 
 [[ml-put-calendar-job-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-put-calendar-job-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<calendar_id>`::
 (Required, string)
@@ -32,7 +32,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=calendar-id]
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection-list]
 
 [[ml-put-calendar-job-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/put-calendar.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-put-calendar]]
-=== Create calendar API
+= Create calendar API
 ++++
 <titleabbrev>Create calendar</titleabbrev>
 ++++
@@ -9,38 +9,38 @@
 Instantiates a calendar.
 
 [[ml-put-calendar-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `PUT _ml/calendars/<calendar_id>`
 
 [[ml-put-calendar-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-put-calendar-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 For more information, see
 {ml-docs}/ml-calendars.html[Calendars and scheduled events].
 
 [[ml-put-calendar-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<calendar_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=calendar-id]
 
 [[ml-put-calendar-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `description`::
   (Optional, string) A description of the calendar.
 
 [[ml-put-calendar-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/put-datafeed.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-put-datafeed]]
-=== Create {dfeeds} API
+= Create {dfeeds} API
 
 [subs="attributes"]
 ++++
@@ -11,12 +11,12 @@
 Instantiates a {dfeed}.
 
 [[ml-put-datafeed-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `PUT _ml/datafeeds/<feed_id>`
 
 [[ml-put-datafeed-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * You must create an {anomaly-job} before you create a {dfeed}.  
 * If {es} {security-features} are enabled, you must have `manage_ml` or `manage`
@@ -24,7 +24,7 @@ cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-put-datafeed-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 {ml-docs}/ml-dfeeds.html[{dfeeds-cap}] retrieve data from {es} for analysis by
 an {anomaly-job}. You can associate only one {dfeed} to each {anomaly-job}.
@@ -47,7 +47,7 @@ credentials are used instead.
 ====
 
 [[ml-put-datafeed-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<feed_id>`::
 (Required, string)
@@ -55,7 +55,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=datafeed-id]
 
 [role="child_attributes"]
 [[ml-put-datafeed-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `aggregations`::
 (Optional, object)
@@ -107,7 +107,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=indices-options]
 
 
 [[ml-put-datafeed-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/put-filter.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-put-filter]]
-=== Create filter API
+= Create filter API
 ++++
 <titleabbrev>Create filter</titleabbrev>
 ++++
@@ -9,33 +9,33 @@
 Instantiates a filter.
 
 [[ml-put-filter-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `PUT _ml/filters/<filter_id>`
 
 [[ml-put-filter-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-put-filter-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 A {ml-docs}/ml-rules.html[filter] contains a list of strings. 
 It can be used by one or more jobs. Specifically, filters are referenced in 
 the `custom_rules` property of detector configuration objects. 
 
 [[ml-put-filter-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<filter_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=filter-id]
 
 [[ml-put-filter-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `description`::
   (Optional, string) A description of the filter.
@@ -46,7 +46,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=filter-id]
   each filter.
 
 [[ml-put-filter-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/put-job.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-put-job]]
-=== Create {anomaly-jobs} API
+= Create {anomaly-jobs} API
 ++++
 <titleabbrev>Create jobs</titleabbrev>
 ++++
@@ -9,19 +9,19 @@
 Instantiates an {anomaly-job}.
 
 [[ml-put-job-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `PUT _ml/anomaly_detectors/<job_id>`
 
 [[ml-put-job-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-put-job-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 IMPORTANT: You must use {kib} or this API to create an {anomaly-job}. Do not put
 a job directly to the `.ml-config` index using the {es} index API. If {es}
@@ -29,7 +29,7 @@ a job directly to the `.ml-config` index using the {es} index API. If {es}
 `.ml-config` index.
 
 [[ml-put-job-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
@@ -37,7 +37,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection-define
 
 [role="child_attributes"]
 [[ml-put-job-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `allow_lazy_open`::
 (Optional, boolean)
@@ -292,7 +292,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=results-index-name]
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=results-retention-days]
 
 [[ml-put-job-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/revert-snapshot.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-revert-snapshot]]
-=== Revert model snapshots API
+= Revert model snapshots API
 ++++
 <titleabbrev>Revert model snapshots</titleabbrev>
 ++++
@@ -9,12 +9,12 @@
 Reverts to a specific snapshot.
 
 [[ml-revert-snapshot-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/anomaly_detectors/<job_id>/model_snapshots/<snapshot_id>/_revert`
 
 [[ml-revert-snapshot-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * Before you revert to a saved snapshot, you must close the job.
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
@@ -22,7 +22,7 @@ Reverts to a specific snapshot.
 <<security-privileges>>.
 
 [[ml-revert-snapshot-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 The {ml-features} reacts quickly to anomalous input, learning new
 behaviors in data. Highly anomalous input increases the variance in the models
@@ -33,7 +33,7 @@ event. For example, you might consider reverting to a saved snapshot after Black
 Friday or a critical system failure.
 
 [[ml-revert-snapshot-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
@@ -44,7 +44,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=snapshot-id]
 
 [[ml-revert-snapshot-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `delete_intervening_results`::
   (Optional, boolean) If true, deletes the results in the time period between
@@ -56,7 +56,7 @@ the job will not accept input data that is older than the current time.
 If you want to resend data, then delete the intervening results.
 
 [[ml-revert-snapshot-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/set-upgrade-mode.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-set-upgrade-mode]]
-=== Set upgrade mode API
+= Set upgrade mode API
 ++++
 <titleabbrev>Set upgrade mode</titleabbrev>
 ++++
@@ -10,7 +10,7 @@ Sets a cluster wide upgrade_mode setting that prepares {ml} indices for an
 upgrade. 
 
 [[ml-set-upgrade-mode-request]]
-==== {api-request-title}
+== {api-request-title}
 //////////////////////////
 
 [source,console]
@@ -25,14 +25,14 @@ POST /_ml/set_upgrade_mode?enabled=false&timeout=10m
 `POST _ml/set_upgrade_mode`
 
 [[ml-set-upgrade-mode-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-set-upgrade-mode-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 When upgrading your cluster, in some circumstances you must restart your nodes and
 reindex your {ml} indices. In those circumstances, there must be no {ml} jobs running. 
@@ -57,7 +57,7 @@ IMPORTANT:  No new {ml} jobs can be opened while the `upgrade_mode` setting is
 `true`.
 
 [[ml-set-upgrade-mode-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `enabled`::
   (Optional, boolean) When `true`, this enables `upgrade_mode`. Defaults to
@@ -68,7 +68,7 @@ IMPORTANT:  No new {ml} jobs can be opened while the `upgrade_mode` setting is
   value is 30 seconds.
 
 [[ml-set-upgrade-mode-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/start-datafeed.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-start-datafeed]]
-=== Start {dfeeds} API
+= Start {dfeeds} API
 
 [subs="attributes"]
 ++++
@@ -11,12 +11,12 @@
 Starts one or more {dfeeds}.
 
 [[ml-start-datafeed-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/datafeeds/<feed_id>/_start`
 
 [[ml-start-datafeed-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * Before you can start a {dfeed}, the {anomaly-job} must be open. Otherwise, an
 error occurs.
@@ -25,7 +25,7 @@ cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-start-datafeed-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 A {dfeed} must be started in order to retrieve data from {es}.
 A {dfeed} can be started and stopped multiple times throughout its lifecycle.
@@ -73,14 +73,14 @@ creation/update and runs the query using those same roles. If you provided
 you created or updated the {dfeed}, those credentials are used instead.
 
 [[ml-start-datafeed-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<feed_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=datafeed-id]
 
 [[ml-start-datafeed-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `end`::
   (Optional, string) The time that the {dfeed} should end. This value is
@@ -95,7 +95,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=datafeed-id]
   The default value is 20 seconds.
 
 [[ml-start-datafeed-response-body]]
-==== {api-response-body-title}
+== {api-response-body-title}
 
 `node`::
   (string) The ID of the node that the {dfeed} was started on.
@@ -107,7 +107,7 @@ If the {dfeed} is allowed to open lazily and has not yet been
   exception is returned instead.
 
 [[ml-start-datafeed-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/stop-datafeed.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-stop-datafeed]]
-=== Stop {dfeeds} API
+= Stop {dfeeds} API
 
 [subs="attributes"]
 ++++
@@ -11,7 +11,7 @@
 Stops one or more {dfeeds}.
 
 [[ml-stop-datafeed-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/datafeeds/<feed_id>/_stop` +
 
@@ -20,14 +20,14 @@ Stops one or more {dfeeds}.
 `POST _ml/datafeeds/_all/_stop`
 
 [[ml-stop-datafeed-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-stop-datafeed-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 A {dfeed} that is stopped ceases to retrieve data from {es}.
 A {dfeed} can be started and stopped multiple times throughout its lifecycle.
@@ -37,21 +37,21 @@ comma-separated list of {dfeeds} or a wildcard expression. You can close all
 {dfeeds} by using `_all` or by specifying `*` as the `<feed_id>`.
 
 [[ml-stop-datafeed-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<feed_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=datafeed-id-wildcard]
 
 [[ml-stop-datafeed-query-parms]]
-==== {api-query-parms-title}
+== {api-query-parms-title}
 
 `allow_no_datafeeds`::
 (Optional, boolean)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=allow-no-datafeeds]
 
 [[ml-stop-datafeed-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `force`::
   (Optional, boolean) If true, the {dfeed} is stopped forcefully.
@@ -61,14 +61,14 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=allow-no-datafeeds]
   The default value is 20 seconds.
 
 [[ml-stop-datafeed-response-codes]]
-==== {api-response-codes-title}
+== {api-response-codes-title}
 
 `404` (Missing resources)::
   If `allow_no_datafeeds` is `false`, this code indicates that there are no
   resources that match the request or only partial matches for the request.
 
 [[ml-stop-datafeed-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/update-datafeed.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-update-datafeed]]
-=== Update {dfeeds} API
+= Update {dfeeds} API
 
 [subs="attributes"]
 ++++
@@ -12,13 +12,13 @@ Updates certain properties of a {dfeed}.
 
 
 [[ml-update-datafeed-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/datafeeds/<feed_id>/_update`
 
 
 [[ml-update-datafeed-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If {es} {security-features} are enabled, you must have `manage_ml`, or `manage`
 cluster privileges to use this API. See
@@ -26,7 +26,7 @@ cluster privileges to use this API. See
 
 
 [[ml-update-datafeed-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 If you update a {dfeed} property, you must stop and start the {dfeed} for the 
 change to be applied.
@@ -38,7 +38,7 @@ using those same roles. If you provide
 credentials are used instead.
 
 [[ml-update-datafeed-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<feed_id>`::
 (Required, string)
@@ -46,7 +46,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=datafeed-id]
 
 [role="child_attributes"]
 [[ml-update-datafeed-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 The following properties can be updated after the {dfeed} is created:
 
@@ -109,7 +109,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=scroll-size]
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=indices-options]
 
 [[ml-update-datafeed-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/update-filter.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-update-filter]]
-=== Update filter API
+= Update filter API
 ++++
 <titleabbrev>Update filter</titleabbrev>
 ++++
@@ -9,26 +9,26 @@
 Updates the description of a filter, adds items, or removes items. 
 
 [[ml-update-filter-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/filters/<filter_id>/_update`
 
 [[ml-update-filter-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-update-filter-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<filter_id>`::
 (Required, string)
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=filter-id]
 
 [[ml-update-filter-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 `add_items`::
   (Optional, array of strings) The items to add to the filter.
@@ -40,7 +40,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=filter-id]
   (Optional, array of strings) The items to remove from the filter.
 
 [[ml-update-filter-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/update-job.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-update-job]]
-=== Update {anomaly-jobs} API
+= Update {anomaly-jobs} API
 ++++
 <titleabbrev>Update jobs</titleabbrev>
 ++++
@@ -9,12 +9,12 @@
 Updates certain properties of an {anomaly-job}.
 
 [[ml-update-job-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/anomaly_detectors/<job_id>/_update`
 
 [[ml-update-job-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
@@ -22,7 +22,7 @@ Updates certain properties of an {anomaly-job}.
 
 
 [[ml-update-job-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
@@ -30,7 +30,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 
 [role="child_attributes"]
 [[ml-update-job-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 The following properties can be updated after the job is created:
 
@@ -231,7 +231,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=results-retention-days]
 
 
 [[ml-update-job-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/update-snapshot.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-update-snapshot]]
-=== Update model snapshots API
+= Update model snapshots API
 ++++
 <titleabbrev>Update model snapshots</titleabbrev>
 ++++
@@ -9,12 +9,12 @@
 Updates certain properties of a snapshot.
 
 [[ml-update-snapshot-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/anomaly_detectors/<job_id>/model_snapshots/<snapshot_id>/_update`
 
 [[ml-update-snapshot-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
@@ -22,7 +22,7 @@ Updates certain properties of a snapshot.
 
 
 [[ml-update-snapshot-path-parms]]
-==== {api-path-parms-title}
+== {api-path-parms-title}
 
 `<job_id>`::
 (Required, string)
@@ -33,7 +33,7 @@ include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=job-id-anomaly-detection]
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=snapshot-id]
 
 [[ml-update-snapshot-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 The following properties can be updated after the model snapshot is created:
 
@@ -45,7 +45,7 @@ The following properties can be updated after the model snapshot is created:
 include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=retain]
 
 [[ml-update-snapshot-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 [source,console]
 --------------------------------------------------

docs/reference/ml/anomaly-detection/apis/validate-detector.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-valid-detector]]
-=== Validate detectors API
+= Validate detectors API
 ++++
 <titleabbrev>Validate detectors</titleabbrev>
 ++++
@@ -9,31 +9,31 @@
 Validates detector configuration information.
 
 [[ml-valid-detector-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/anomaly_detectors/_validate/detector`
 
 [[ml-valid-detector-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-valid-detector-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 This API enables you to validate the detector configuration
 before you create an {anomaly-job}.
 
 [[ml-valid-detector-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 For a list of the properties that you can specify in the body of this API,
 see detector configuration objects.
 
 [[ml-valid-detector-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 The following example validates detector configuration information:
 

docs/reference/ml/anomaly-detection/apis/validate-job.asciidoc

@@ -1,7 +1,7 @@
 [role="xpack"]
 [testenv="platinum"]
 [[ml-valid-job]]
-=== Validate {anomaly-jobs} API
+= Validate {anomaly-jobs} API
 ++++
 <titleabbrev>Validate jobs</titleabbrev>
 ++++
@@ -9,31 +9,31 @@
 Validates {anomaly-job} configuration information.
 
 [[ml-valid-job-request]]
-==== {api-request-title}
+== {api-request-title}
 
 `POST _ml/anomaly_detectors/_validate`
 
 [[ml-valid-job-prereqs]]
-==== {api-prereq-title}
+== {api-prereq-title}
 
 * If the {es} {security-features} are enabled, you must have `manage_ml` or
 `manage` cluster privileges to use this API. See
 <<security-privileges>>.
 
 [[ml-valid-job-desc]]
-==== {api-description-title}
+== {api-description-title}
 
 This API enables you to validate the {anomaly-job} configuration before you
 create the job.
 
 [[ml-valid-job-request-body]]
-==== {api-request-body-title}
+== {api-request-body-title}
 
 For a list of the properties that you can specify in the body of this API,
 see <<ml-put-job>>.
 
 [[ml-valid-job-example]]
-==== {api-examples-title}
+== {api-examples-title}
 
 The following example validates job configuration information:
 

docs/reference/rest-api/index.asciidoc

@@ -59,7 +59,7 @@ include::{es-repo-dir}/ilm/apis/ilm-api.asciidoc[]
 include::{es-repo-dir}/ingest/apis/index.asciidoc[]
 include::info.asciidoc[]
 include::{es-repo-dir}/licensing/index.asciidoc[]
-include::{es-repo-dir}/ml/anomaly-detection/apis/ml-api.asciidoc[]
+include::{es-repo-dir}/ml/anomaly-detection/apis/index.asciidoc[]
 include::{es-repo-dir}/ml/df-analytics/apis/index.asciidoc[]
 include::{es-repo-dir}/migration/migration.asciidoc[]
 include::{es-repo-dir}/indices/apis/reload-analyzers.asciidoc[]