diff --git a/docs/en/settings/graph-settings.asciidoc b/docs/en/settings/graph-settings.asciidoc
new file mode 100644
index 00000000000..879dc870bc1
--- /dev/null
+++ b/docs/en/settings/graph-settings.asciidoc
@@ -0,0 +1,9 @@
+[[graph-settings]]
+== Graph Settings
+You do not need to configure any settings to use {graph}.
+
+[float]
+[[general-graph-settings]]
+=== General Graph Settings
+`xpack.graph.enabled`::
+Set to `false` to disable {graph}.
\ No newline at end of file
diff --git a/docs/en/settings/index.asciidoc b/docs/en/settings/index.asciidoc
new file mode 100644
index 00000000000..be2fb013092
--- /dev/null
+++ b/docs/en/settings/index.asciidoc
@@ -0,0 +1,20 @@
+[[xpack-settings]]
+= X-Pack Settings
+
+[partintro]
+--
+You configure settings for X-Pack features in the `elasticsearch.yml` and `kibana.yml`
+configuration files.
+
+* <<security-settings, Security Settings>>
+* <<monitoring-settings, Monitoring Settings>>
+* <<notification-settings, Watcher Settings>>
+* <<reporting-settings, Reporting Settings>>
+--
+
+include::security-settings.asciidoc[]
+include::monitoring-settings.asciidoc[]
+include::graph-settings.asciidoc[]
+include::notification-settings.asciidoc[]
+include::reporting-settings.asciidoc[]
+
diff --git a/docs/en/settings/monitoring-settings.asciidoc b/docs/en/settings/monitoring-settings.asciidoc
new file mode 100644
index 00000000000..69d514ab5fe
--- /dev/null
+++ b/docs/en/settings/monitoring-settings.asciidoc
@@ -0,0 +1,346 @@
+[[monitoring-settings]]
+== Monitoring Settings
+
+:imagesdir:         images/monitoring
+
+You configure <<monitoring-collection-settings, `xpack.monitoring.collection`>>
+settings in `elasticsearch.yml` to control how data is collected from your
+Elasticsearch nodes. You can adjust how monitoring data is displayed in the
+Monitoring UI by configuring <<monitoring-ui-settings, `xpack.monitoring`>>
+settings in `kibana.yml`.
+
+For more information, see <<configuring-monitoring, Configuring Monitoring>>.
+
+[float]
+[[general-monitoring-settings]]
+=== General Monitoring Settings
+`xpack.monitoring.enabled`::
+Set to `false` to disable {monitoring}.
+Configure in both `elasticsearch.yml` and `kibana.yml`.
+
+[float]
+[[monitoring-collection-settings]]
+=== Monitoring Collection Settings
+
+`xpack.monitoring.collection.cluster.state.timeout`::
+
+Sets the timeout for collecting the cluster state. Defaults to `10m`.
+
+`xpack.monitoring.collection.cluster.stats.timeout`::
+
+Sets the timeout for collecting the cluster statistics. Defaults to `10m`.
+
+`xpack.monitoring.collection.indices`::
+
+Controls which indices Monitoring collects data from. Defaults to all indices. Specify the index names
+as a comma-separated list, for example `test1,test2,test3`. Names can include wildcards, for
+example `test*`. You can explicitly include or exclude indices by prepending
+`+` to include the index, or `-` to exclude the index. For example, to include all indices that
+start with `test` except `test3`, you could specify `+test*,-test3`.
++
+You can update this setting through the Cluster Update Settings API.
+
+`xpack.monitoring.collection.index.stats.timeout`::
+
+Sets the timeout for collecting index statistics. Defaults to `10m`.
+
+`xpack.monitoring.collection.indices.stats.timeout`::
+
+Sets the timeout for collecting total indices statistics. Defaults to `10m`.
+
+`xpack.monitoring.exporters` ::
+
+Configures where the agent stores monitoring data. By default, the agent uses a local exporter that
+indexes monitoring data on the cluster where it is installed. Use an HTTP exporter to send data to
+a separate monitoring cluster. For more information, see <<monitoring-cluster, Setting up a Separate
+Monitoring Cluster>>.
+
+`xpack.monitoring.collection.index.recovery.active_only`::
+
+Controls whether or not all recoveries are collected. Set to `true` to
+collect only active recoveries. Defaults to `false`.
+
+`xpack.monitoring.collection.index.recovery.timeout`::
+
+Sets the timeout for collecting the recovery information. Defaults to `10m`.
+
+`xpack.monitoring.collection.interval`::
+
+Controls how often data samples are collected. Defaults to `10s`. If you
+modify the collection interval, set the `xpack.monitoring.min_interval_seconds`
+option in `kibana.yml` to the same value. Set to `-1` to temporarily disable
+data collection. You can update this setting through the Cluster Update
+Settings API.
+
+`xpack.monitoring.history.duration`::
+
+Sets the retention duration beyond which the indices created by a Monitoring exporter will
+be automatically deleted. Defaults to `7d` (7 days).
++
+This setting has a minimum value of `1d` (1 day) to ensure that something is being monitored,
+and it cannot be disabled.
++
+IMPORTANT: This setting currently only impacts `local`-type exporters. Indices created using
+the `http` exporter will not be deleted automatically.
+
+
+[float]
+[[monitoring-ui-settings]]
+=== Monitoring UI Settings
+
+You can set the following `xpack.monitoring` settings in `kibana.yml` to adjust
+how the Monitoring UI displays monitoring data. However, the defaults work best
+in most circumstances. For more information about configuring Kibana, see
+{kibana-ref}/settings.html[Setting Kibana
+Server Properties] in the Kibana User Guide.
+
+`xpack.monitoring.elasticsearch.url`::
+
+The location of the Elasticsearch instance(s) where your monitoring data is
+stored. By default, this is the same as the `elasticsearch.url`. This setting
+enables you to use a single Kibana instance to search and visualize data in
+your production cluster as well as monitor data sent to a dedicated monitoring
+cluster.
+
+`xpack.monitoring.max_bucket_size`::
+
+The number of term buckets to return out of the overall terms list when
+performing terms aggregations to retrieve index and node metrics. For more
+information about the `size` parameter, see {ref}/search-aggregations-bucket-terms-aggregation.html#_size[
+Terms Aggregation] in the Elasticsearch Reference. Defaults to 10000.
+
+`xpack.monitoring.min_interval_seconds`::
+
+The minimum number of seconds that a time bucket in a chart can represent.
+Defaults to 10. If you modify the `xpack.monitoring.collection.interval`
+in `elasticsearch.yml`, set this option to the same value.
+
+`xpack.monitoring.node_resolver`::
+
+The node resolver controls how nodes are considered unique. This can be set to either `uuid`,
+`transport_address`, or `name`. `uuid` controls uniqueness based on the node's persistent ID.
+`transport_address` controls uniqueness based on the node's published
+hostname/IP and port. `name` controls uniqueness based on the node's `node.name` setting. Defaults to
+`uuid`.
+
+`xpack.monitoring.report_stats`::
+
+Whether or not to send cluster statistics to Elastic. Reporting your cluster statistics
+helps us improve your user experience. Your data is never shared with anyone. Set to
+`false` to disable statistics reporting from any browser connected to the Kibana instance.
+You can also opt-out on a per-browser basis through the Monitoring user interface. Defaults to `true`.
+
+`xpack.monitoring.kibana.collection.enabled`::
+
+Whether or not to enable data collection from the Kibana NodeJS server for
+Kibana Dashboards to be featured in the Monitoring UI. Defaults to `true`.
+
+`xpack.monitoring.kibana.collection.interval`::
+
+Number of milliseconds to wait in between data sampling for Kibana's NodeJS
+server for the metrics that are displayed in the Kibana dashboards. Defaults to
+`10000` (10 seconds).
+
+[float]
+[[monitoring-ui-cgroup-settings]]
+==== Monitoring UI Container Settings
+
+The Monitoring UI exposes the Cgroup statistics that we collect for you to make better decisions
+about your container performance, rather than guessing based on the overall machine performance.
+If you are not running your applications in a container, then Cgroup statistics will not be useful.
+
+`xpack.monitoring.ui.container.elasticsearch.enabled`::
+
+For Elasticsearch clusters that are running in containers, this setting changes the Node Listing to
+display the CPU Utilization based on the reported Cgroup statistics. This will also add the calculated
+Cgroup CPU Utilization to the Node Overview page instead of the overall operating system's CPU
+Utilization. Defaults to `false`.
++
+image::monitoring-es-cgroup-true.png["Elasticsearch Inside a Container",link="images/monitoring-es-cgroup-true.png"]
+
+[float]
+[[local-exporter-settings]]
+==== Local Exporter Settings
+
+The `local` exporter is the default exporter used by Monitoring. As the name is
+meant to imply, it exports data to the _local_ cluster, which means that there
+is not much needed to be configured.
+
+If you do not supply _any_ exporters, then Monitoring will automatically create
+one for you. If any exporter is provided, then no default is added.
+
+[source,yaml]
+----------------------------------
+xpack.monitoring.exporters.my_local:
+  type: local
+----------------------------------
+
+`type`::
+
+The value for a Local exporter must always be `local` and it is required.
+
+`use_ingest`::
+
+Whether to supply a placeholder pipeline to the cluster and a pipeline processor with
+every bulk request. The default value is `true`. If disabled, then it means that it will not
+use pipelines, which means that a future release cannot automatically upgrade bulk requests
+to future-proof them.
+
+[float]
+[[http-exporter-settings]]
+==== HTTP Exporter Settings
+
+The following lists settings that can be supplied with the `http` exporter.
+All settings are shown as what follows the name you select for your exporter:
+
+[source,yaml]
+----------------------------------
+xpack.monitoring.exporters.my_remote:
+  type: http
+  host: ["host:port", ...]
+----------------------------------
+
+`type`::
+
+The value for an HTTP exporter must always be `http` and it is required.
+
+`host`::
+
+Host supports multiple formats, both as an array or as a single value. Supported formats include
+`hostname`, `hostname:port`, `http://hostname` `http://hostname:port`, `https://hostname`, and
+`https://hostname:port`. Hosts cannot be assumed. The default scheme is always `http` and the default
+port is always `9200` if not supplied as part of the `host` string.
++
+[source,yaml]
+----------------------------------
+xpack.monitoring.exporters:
+  example1:
+    type: http
+    host: "10.1.2.3"
+  example2:
+    type: http
+    host: ["http://10.1.2.4"]
+  example3:
+    type: http
+    host: ["10.1.2.5", "10.1.2.6"]
+  example4:
+    type: http
+    host: ["https://10.1.2.3:9200"]
+----------------------------------
+
+`auth.username`::
+
+The username is required if a `auth.password` is supplied.
+
+`auth.password`::
+
+The password for the `auth.username`.
+
+`connection.timeout`::
+
+The amount of time that the HTTP connection is supposed to wait for a socket to open for the
+request. The default value is `6s`.
+
+`connection.read_timeout`::
+
+The amount of time that the HTTP connection is supposed to wait for a socket to
+send back a response. The default value is `10 * connection.timeout` (`60s` if neither are set).
+
+`ssl`::
+
+Each HTTP exporter can define its own TLS / SSL settings or inherit them. See the
+<<ssl-monitoring-settings, TLS / SSL section below>>.
+
+`proxy.base_path`::
+
+The base path to prefix any outgoing request, such as `/base/path` (e.g., bulk requests would
+then be sent as `/base/path/_bulk`). There is no default value.
+
+`headers`::
+
+Optional headers that are added to every request, which can assist with routing requests through
+proxies.
++
+[source,yaml]
+----------------------------------
+xpack.monitoring.exporters.my_remote:
+  headers:
+    X-My-Array: [abc, def, xyz]
+    X-My-Header: abc123
+----------------------------------
++
+Array-based headers are sent `n` times where `n` is the size of the array. `Content-Type`
+and `Content-Length` cannot be set. Any headers created by the Monitoring agent will override
+anything defined here.
+
+`index.name.time_format`::
+
+A mechanism for changing the default date suffix for the, by default, daily Monitoring indices.
+The default value is `YYYY.MM.DD`, which is why the indices are created daily.
+
+`use_ingest`::
+
+Whether to supply a placeholder pipeline to the monitoring cluster and a pipeline processor with
+every bulk request. The default value is `true`. If disabled, then it means that it will not
+use pipelines, which means that a future release cannot automatically upgrade bulk requests
+to future-proof them.
+
+[[ssl-monitoring-settings]]
+:ssl-prefix:             xpack.monitoring.exporters.$NAME
+:component:              {monitoring}
+:verifies:
+:server!:
+
+include::ssl-settings.asciidoc[]
+
+[float]
+[[monitoring-logstash-settings]]
+=== Monitoring Logstash Settings
+
+You can set the following `xpack.monitoring` settings in `logstash.yml` to control how monitoring data is
+collected from your Logstash nodes. However, the defaults work best in most circumstances. For more
+information about configuring Logstash, see {logstash-ref}/logstash-settings-file.html[Settings File]
+section.
+
+`xpack.monitoring.enabled`::
+
+Set to `false` to disable X-Pack monitoring.
+
+`xpack.monitoring.collection.interval`::
+
+Controls how often data samples are collected and shipped on the Logstash side. Defaults to `10s`.
+
+`xpack.monitoring.elasticsearch.url`::
+
+The Elasticsearch instance(s) that you want to ship your Logstash metrics to.
+This might be the same Elasticsearch instance specified in the `outputs`
+section in your Logstash configuration, or a different one. This is *not*
+the URL of your dedicated monitoring cluster. Even if you are using a dedicated
+monitoring cluster, the Logstash metrics must be routed through your production
+cluster. You can specify a single host as a string, or specify multiple
+hosts as an array. Defaults to `http://localhost:9200`.
+
+`xpack.monitoring.elasticsearch.username` and `xpack.monitoring.elasticsearch.password`::
+
+If your Elasticsearch is protected with basic authentication, these settings provide the username and
+password that the Logstash instance uses to authenticate for shipping monitoring data.
+
+`xpack.monitoring.elasticsearch.ssl.ca`::
+
+Optional setting that enables you to specify a path to the `.pem` file for the certificate authority for your Elasticsearch instance.
+
+`xpack.monitoring.elasticsearch.ssl.truststore.path`::
+
+Optional settings that provide the paths to the Java keystore (JKS) to validate the server’s certificate.
+
+`xpack.monitoring.elasticsearch.ssl.truststore.password`::
+
+Optional settings that provide the password to the truststore.
+
+`xpack.monitoring.elasticsearch.ssl.keystore.path`::
+
+Optional settings that provide the paths to the Java keystore (JKS) to validate the client’s certificate.
+
+`xpack.monitoring.elasticsearch.ssl.keystore.password`::
+
+Optional settings that provide the password to the keystore.
diff --git a/docs/en/settings/notification-settings.asciidoc b/docs/en/settings/notification-settings.asciidoc
new file mode 100644
index 00000000000..97a40b3f2e6
--- /dev/null
+++ b/docs/en/settings/notification-settings.asciidoc
@@ -0,0 +1,292 @@
+[[notification-settings]]
+== {watcher} Settings
+
+You configure `xpack.notification` settings in `elasticsearch.yml` to 
+send set up {watcher} and send notifications via <<email-notification-settings, email>>, <<hipchat-notification-settings, HipChat>>, <<slack-notification-settings, 
+Slack>>, and <<pagerduty-notification-settings, PagerDuty>>.
+
+[float]
+[[general-notification-settings]]
+=== General Watcher Settings
+`xpack.watcher.enabled`::
+Set to `false` to disable {watcher}.
+
+`xpack.http.proxy.host`::
+Specifies the address of the proxy server to use to connect to HTTP services.
+
+`xpack.http.proxy.port`::
+Specifies the port number to use to connect to the proxy server.
+
+[[ssl-notification-settings]]
+:ssl-prefix:             xpack.http
+:component:              {watcher}
+:verifies:
+:server!:
+
+include::ssl-settings.asciidoc[]
+
+[float]
+[[email-notification-settings]]
+=== Email Notification Settings
+You can configure the following email notification settings in 
+`elasticsearch.yml`. For more information about sending notifications 
+via email, see <<configuring-email, Configuring Email>>.
+
+`xpack.notification.email.account`::
+Specifies account information for sending notifications via email. You 
+can specify the following email account attributes:
+
+[[email-account-attributes]]
+  `profile`;; 
+  The <<email-profile, profile>> to use to build the MIME messages
+  that are sent from the account. Valid values: `standard`, `gmail` and 
+  `outlook`. Defaults to `standard`.
+
+  `email_defaults.*`;; 
+  An optional set of email attributes to use as defaults 
+  for the emails sent from the account. See <<email-action-attributes, Email Action 
+  Attributes>> for the supported attributes.
+
+  `smtp.auth`;; 
+  Set to `true` to attempt to authenticate the user using the 
+  AUTH command. Defaults to `false`.
+
+  `smtp.host`;; 
+  The SMTP server to connect to. Required.
+
+  `smtp.port`;; 
+  The SMTP server port to connect to. Defaults to 25.
+
+  `smtp.user`;; 
+  The user name for SMTP. Required.
+
+  `smtp.password`;; 
+  The password for the specified SMTP user.
+
+  `smtp.starttls.enable`;; 
+  Set to `true` to enable the use of the `STARTTLS` 
+  command (if supported by the server) to switch the connection to a 
+  TLS-protected connection before issuing any login commands. Note that 
+  an appropriate trust store must configured so that the client will 
+  trust the server's certificate. Defaults to `false`.
+
+  `smtp.*`;; 
+  SMTP attributes that enable fine control over the SMTP 
+  protocol when sending messages. See 
+  https://javamail.java.net/nonav/docs/api/com/sun/mail/smtp/package-summary.html[com.sun.mail.smtp]
+  for the full list of SMTP properties you can set. Note that all timeouts 
+  (`writetimeout`, `connection_timeout` and `timeout`) default to 2 minutes.
+
+`xpack.notification.email.html.sanitization.allow`::
+Specifies the HTML elements that are allowed in email notifications. For
+more information, see <<email-html-sanitization, Configuring HTML 
+Sanitization Options>>. You can specify individual HTML elements
+and the following HTML feature groups:
+
+[[html-feature-groups]]
+  `_tables`;;   
+  All table related elements: `<table>`, `<th>`, `<tr>` 
+                      and `<td>`.
+
+  `_blocks`;;   
+  The following block elements: `<p>`, `<div>`, `<h1>`,
+                      `<h2>`, `<h3>`, `<h4>`, `<h5>`, `<h6>`, `<ul>`, `<ol>`,
+                      `<li>`, and `<blockquote>`.
+
+  `_formatting`;;   
+  The following inline formatting elements: `<b>`, `<i>`,
+                      `<s>`, `<u>`, `<o>`, `<sup>`, `<sub>`, `<ins>`, `<del>`,
+                      `<strong>`, `<strike>`, `<tt>`, `<code>`, `<big>`,
+                      `<small>`, `<br>`, `<span>`, and `<em>`.
+
+  `_links`;;   
+  The `<a>` element with an `href` attribute that points
+                      to a URL using the following protocols: `http`, `https`
+                      and `mailto`.
+  
+  `_styles`;;   
+  The `style` attribute on all elements. Note that CSS
+                      attributes are also sanitized to prevent XSS attacks.
+
+  `img`;;
+  `img:all`;;    
+  All images (external and embedded).
+
+  `img:embedded`;;  
+  Only embedded images. Embedded images can only use the
+                    `cid:` URL protocol in their `src` attribute.
+
+`xpack.notification.email.html.sanitization.disallow`::
+Specifies the HTML elements that are NOT allowed in email notifications. 
+You can specify individual HTML elements and <<html-feature-groups, 
+HTML feature groups>>.
+
+`xpack.notification.email.html.sanitization.enabled` :: 
+Set to `false` to completely disable HTML sanitation. Not recommended. 
+Defaults to `true`.
+
+[float]
+[[hipchat-notification-settings]]
+=== HipChat Notification Settings
+You can configure the following HipChat notification settings in 
+`elasticsearch.yml`. For more information about sending notifications 
+via HipChat, see <<configuring-hipchat, Configuring HipChat>>.
+
+`xpack.notification.hipchat` ::
+Specifies account information for sending notifications
+via HipChat. You can specify the following HipChat account attributes:
+
+[[hipchat-account-attributes]]
+  `profile`;; 
+  The HipChat account profile to use: `integration`, 
+                      `user`, or `v1`. Required.
+
+  `auth_token`;; 
+  The authentication token to use to access 
+                      the HipChat API. Required.
+
+  `host`;; 
+  The HipChat server hostname. Defaults to `api.hipchat.com`.
+  
+  `port`;; 
+  The HipChat server port number. Defaults to 443.
+
+  `room`;; 
+  The room you want to send messages to. Must be specified 
+                      if the `profile` is set to `integration`. Not valid for  
+                      the `user` or `vi` profiles.
+  
+  `user`;; 
+  The HipChat user account to use to send messages. 
+                      Specified as an email address. Must be specified if the
+                      `profile` is set to `user`. Not valid for the `integration` 
+                      or `v1` profiles.
+
+  `message.format`;; 
+  The format of the message: `text` or `html`. 
+                      Defaults to `html`.
+
+  `message.color`;; 
+  The background color of the notification in the room. 
+                      Defaults to  `yellow`.
+  `message.notify`;; 
+  Indicates whether people in the room should be
+                      actively notified. Defaults to `false`.
+
+
+[float]
+[[slack-notification-settings]]
+=== Slack Notification Settings
+You can configure the following Slack notification settings in
+`elasticsearch.yml`. For more information about sending notifications
+via Slack, see  <<configuring-slack, Configuring Slack>>.
+
+`xpack.notification.slack` ::
+Specifies account information for sending notifications
+via Slack. You can specify the following Slack account attributes:
+
+[[slack-account-attributes]]
+
+  `url`;;
+  The Incoming Webhook URL to use to post
+                                    messages to Slack. Required.
+
+  `message_defaults.from`;;
+  The sender name to display in the
+                                    Slack message. Defaults to the watch ID.
+
+  `message_defaults.to`;;
+  The default Slack channels or groups you
+                                             want to send messages to.
+
+  `message_defaults.icon`;;
+  The icon to display in the Slack messages.
+                                             Overrides the incoming webhook's configured
+                                             icon. Accepts a public URL to an image.
+
+  `message_defaults.text`;;
+  The default message content.
+
+  `message_defaults.attachment`;;
+  Default message attachments. Slack message attachments
+                                    enable you to create more richly-formatted messages.
+                                    Specified as an array as defined in the
+                                    https://api.slack.com/docs/attachments[
+                                   Slack attachments documentation].
+
+
+[float]
+[[jira-notification-settings]]
+=== Jira Notification Settings
+You can configure the following Jira notification settings in
+`elasticsearch.yml`. For more information about using notifications
+to create issues in Jira, see  <<configuring-jira, Configuring Jira>>.
+
+`xpack.notification.jira` ::
+Specifies account information for using notifications to create
+issues in Jira. You can specify the following Jira account attributes:
+
+[[jira-account-attributes]]
+
+  `url`;; 
+  The URL of the Jira Software server. Required.
+
+  `user`;;
+  The name of the user to connect to the Jira Software server. Required.
+
+  `password`;;
+  The password of the user to connect to the Jira Software server. Required.
+
+  `issue_defaults`;;
+  Default fields values for the issue created in Jira. See
+  <<jira-action-attributes, Jira Action Attributes>> for more information.
+  Optional.
+
+
+[float]
+[[pagerduty-notification-settings]]
+=== PagerDuty Notification Settings
+You can configure the following PagerDuty notification settings in 
+`elasticsearch.yml`. For more information about sending notifications 
+via PagerDuty, see  <<configuring-pagerduty, Configuring PagerDuty>>.
+
+
+[[pagerduty-account-attributes]]
+`xpack.notification.pagerduty`::
+Specifies account information for sending notifications
+via PagerDuty. You can specify the following PagerDuty account attributes:
+
+  `name`;;
+  A name for the PagerDuty account associated with the API key you
+  are using to access PagerDuty. Required.
+                                    
+  `service_api_key`;;
+   The https://developer.pagerduty.com/documentation/rest/authentication[
+   PagerDuty API key] to use to access PagerDuty. Required.
+
+  
+  `event_defaults`;;
+  Default values for  <<pagerduty-event-trigger-incident-attributes,PagerDuty event attributes>>. Optional.
+
+        `description`::
+        A string that contains the default description for PagerDuty events.
+        If no default is configured, each PagerDuty action must specify a
+        `description`.
+        
+        `incident_key`:: 
+        A string that contains the default incident key to use when sending
+        PagerDuty events.
+        
+        `client`::
+        A string that specifies the default monitoring client.
+
+        `client_url`::
+        The URL of the default monitoring client. 
+        
+        `event_type`::
+        The default event type. Valid values: `trigger`,`resolve`, `acknowledge`.
+        
+        `attach_payload`::
+        Whether or not to provide the watch payload as context for 
+        the event by default. Valid values: `true`, `false`.
+
diff --git a/docs/en/settings/reporting-settings.asciidoc b/docs/en/settings/reporting-settings.asciidoc
new file mode 100644
index 00000000000..06925d2bc06
--- /dev/null
+++ b/docs/en/settings/reporting-settings.asciidoc
@@ -0,0 +1,89 @@
+[[reporting-settings]]
+== Reporting Settings
+
+You configure `xpack.reporting` settings in `kibana.yml` to
+control how {reporting} <<reporting-kibana-server-settings, communicates
+with the Kibana server>>, <<reporting-job-queue-settings, manages background
+jobs>>, and <<reporting-capture-settings, captures screenshots>>.
+
+[float]
+[[general-reporting-settings]]
+=== General Reporting Settings
+`xpack.reporting.enabled`::
+Set to `false` to disable {reporting}.
+
+`xpack.reporting.encryptionKey`::
+Set to any text string. By default, Kibana generates a random key when it starts,
+which causes any pending reports to fail on restart. Configure this setting to use
+the same key across restarts.
+
+[float]
+[[reporting-kibana-server-settings]]
+=== Kibana Server Settings
+
+Reporting uses the Kibana interface to generate reports. In most cases, you don't need
+to configure Reporting to communicate with Kibana, it just works out of the box.
+However, if you use a proxy in your stack or otherwise change how you access Kibana, you
+might need to configure the following settings.
+
+`xpack.reporting.kibanaApp`::
+The root path used to access Kibana, defaults to `/app/kibana`.
+
+`xpack.reporting.kibanaServer.port`::
+The port used to access Kibana, if different than the `server.port` value.
+
+`xpack.reporting.kibanaServer.protocol`::
+The protocol used to access Kibana, typically `http` or `https`.
+
+`xpack.reporting.kibanaServer.hostname`::
+The hostname used to access Kibana, if different than the `server.name` value.
+
+[float]
+[[reporting-job-queue-settings]]
+=== Background Job Settings
+
+Reporting generates reports in the background and jobs are coordinated using documents
+in Elasticsearch. Depending on how often you generate reports and the overall number of
+reports, you may need to change some of the following settings.
+
+`xpack.reporting.queue.indexInterval`::
+How often the index that stores reporting jobs rolls over to a new index.
+Valid values are `year`, `month`, `week`, `day`, and `hour`. Defaults to `week`.
+
+`xpack.reporting.queue.pollInterval`::
+How often idle workers poll the index for pending jobs. Defaults to `3000` (3 seconds).
+
+`xpack.reporting.queue.timeout`::
+How long each worker has to produce a report. If your machine is slow or under constant
+heavy load, you might need to increase this timeout. Specified in milliseconds.
+Defaults to `30000` (30 seconds).
+
+[float]
+[[reporting-capture-settings]]
+=== Capture Settings
+
+Reporting works by capturing screenshots from Kibana. These settings are used to
+control various aspects of the capturing process.
+
+`xpack.reporting.capture.concurrency`::
+The number of concurrent capture processes to run. Note that jobs are CPU bound,
+and exceeding the number of cores available on the machine will likely be very
+slow and might cause issues. Defaults to the number of cores on
+the machine.
+
+`xpack.reporting.capture.loadDelay`::
+When visualizations are not evented, this is the amount of time to before
+taking a screenshot. All visualizations that ship with Kibana are evented, so this
+setting shouldn't have much effect. If you are seeing empty images instead of
+visualizations in your reports, try increasing this value.
+Defaults to `3000` (3 seconds).
+
+`xpack.reporting.capture.settleTime`::
+When visualizations are evented, this is the amount of time to wait for their rendering
+to settle. If visualizations in your PDF are smaller than they should be, try increasing
+this value.
+Defaults to `1000` (1 second).
+
+`xpack.reporting.capture.timeout`::
+The maximum amount of time to wait for things to render in Kibana when capturing
+screenshots. Defaults to `6000` (6 seconds).
\ No newline at end of file
diff --git a/docs/en/settings/security-settings.asciidoc b/docs/en/settings/security-settings.asciidoc
new file mode 100644
index 00000000000..d21951f2c1f
--- /dev/null
+++ b/docs/en/settings/security-settings.asciidoc
@@ -0,0 +1,607 @@
+[[security-settings]]
+== Security Settings
+
+You configure `xpack.security` settings  to 
+<<anonymous-access-settings, enable anonymous access>>
+and perform message authentication,
+<<field-document-security-settings, set up document and field 
+level security>>, <<realm-settings, configure realms>>, 
+and <<ssl-tls-settings, encrypt communications with SSL>>.
+
+[float]
+[[general-security-settings]]
+=== General Security Settings
+`xpack.security.enabled`::
+Set to `false` to disable {security}.
+Configure in both `elasticsearch.yml` and `kibana.yml`. 
+
+[float]
+[[password-security-settings]]
+=== Default Password Security Settings
+`xpack.security.authc.accept_default_password`::
+In `elasticsearch.yml`, set this to `false` to disable support for the default "changeme" password.
+For more information, see <<disabling-default-password, Disable Default Password Functionality>>.
+
+[float]
+[[anonymous-access-settings]]
+=== Anonymous Access Settings
+You can configure the following anonymous access settings in 
+`elasticsearch.yml`.  For more information, see <<anonymous-access, 
+Enabling Anonymous Access>>.
+
+`xpack.security.authc.anonymous.username`::
+The username (principal) of the anonymous user. Defaults to `_es_anonymous_user`. 
+
+`xpack.security.authc.anonymous.roles`::
+The roles to associate with the anonymous user. Required.
+
+`xpack.security.authc.anonymous.authz_exception`::
+When `true`, an HTTP 403 response is returned if the anonymous user
+does not have the appropriate permissions for the requested action. The
+user is not prompted to provide credentials to access the requested
+resource. When set to `false`, a HTTP 401 is returned and the user 
+can provide credentials with the appropriate permissions to gain 
+access. Defaults to `true`.
+
+[float]
+[[field-document-security-settings]]
+=== Document and Field Level Security Settings
+
+You can set the following document and field level security
+settings in `elasticsearch.yml`. For more information, see 
+<<field-and-document-access-control, Setting Up Document and Field
+Level Security>>.
+
+`xpack.security.dls_fls.enabled`::
+Set to `false` to prevent document and field level security 
+from being configured. Defaults to `true`.
+
+[float]
+[[realm-settings]]
+=== Realm Settings
+You configure realm settings in the `xpack.security.authc.realms` 
+namespace in `elasticsearch.yml`. For example:
+
+[source,yaml]
+----------------------------------------
+xpack.security.authc.realms:
+
+    realm1:
+        type: native
+        order: 0
+        ...
+
+    realm2:
+        type: ldap
+        order: 1
+        ...
+
+    realm3:
+        type: active_directory
+        order: 2
+        ...
+    ...
+----------------------------------------
+
+The valid settings vary depending on the realm type. For more 
+information, see <<setting-up-authentication, Setting Up Authentication>>.
+
+[float]
+==== Settings Valid for All Realms
+
+`type`::  
+The type of the realm: `native, `ldap`, `active_directory`, `pki`, or `file`. Required.
+
+`order`::     
+The priority of the realm within the realm chain. Defaults to `Integer.MAX_VALUE`. 
+
+`enabled`::     
+Enable/disable the realm. Defaults to `true`.
+
+[[ref-users-settings]]
+
+[float]
+==== File Realm Settings
+
+`cache.ttl`::       
+The time-to-live for cached user entries--user credentials are cached for 
+this configured period of time. Defaults to `20m`. Specify values using the
+standard Elasticsearch {ref}/common-options.html#time-units[time units]. 
+Defaults to `20m`.
+
+`cache.max_users`:: 
+The maximum number of user entries that can live in the cache at a given time. 
+Defaults to 100,000.
+
+`cache.hash_algo`::   
+(Expert Setting) The hashing algorithm that is used for the in-memory cached 
+user credentials. See the <<cache-hash-algo,Cache hash algorithms>> table f
+or all possible values. Defaults to `ssha256`.
+
+[[ref-ldap-settings]]
+[float]
+==== LDAP Realm Settings
+`url`::                              
+An LDAP URL in the format `ldap[s]://<server>:<port>`. Required.
+
+`load_balance.type`::                     
+The behavior to use when there are multiple LDAP URLs defined. For supported 
+values see <<ldap-load-balancing, LDAP load balancing and failover types>>.
+Defaults to `failover`.
+
+`load_balance.cache_ttl`::                
+When using `dns_failover` or `dns_round_robin` as the load balancing type, 
+this setting controls the amount of time to cache DNS lookups. Defaults 
+to `1h`.
+
+`bind_dn`::                             
+The DN of the user that will be used to bind to the LDAP and perform searches. 
+If this is not specified, an anonymous bind will be attempted. 
+Defaults to Empty.
+
+`bind_password`::                    
+The password for the user that will be used to bind to the LDAP. 
+Defaults to Empty.
+
+`user_dn_templates`::                      
+The DN template that replaces the user name with the string `{0}`. 
+This element is multivalued; you can specify multiple user contexts. 
+Required to operate in user template mode. Not valid
+if `user_search.base_dn` is specified. For more information on
+the different modes, see <<ldap-realm, ldap realms>>. 
+
+`user_group_attribute`::                      
+Specifies the attribute to examine on the user for group membership. 
+The default is `memberOf`. This setting will be ignored if any 
+`group_search` settings are specified. Defaults to  `memberOf`.
+
+`user_search.base_dn`::                     
+Specifies a container DN to search for users. Required 
+to operated in user search mode. Not valid if 
+`user_dn_templates is specified. For more information on
+the different modes, see <<ldap-realm, ldap realms>>.
+
+`user_search.scope`::                         
+The scope of the user search. Valid values are `sub_tree`, `one_level` or 
+`base`. `one_level` only searches objects directly contained within the 
+`base_dn`. `sub_tree` searches all objects contained under `base_dn`. 
+`base` specifies that the `base_dn` is the user object, and that it is 
+the only user considered. Defaults to  `sub_tree`.
+
+`user_search.attribute`::                   
+The attribute to match with the username presented to. Defaults to `uid`.
+
+`user_search.pool.enabled`::
+Enables or disables connection pooling for user search. When
+disabled a new connection is created for every search. The
+default is `true`.
+
+`user_search.pool.size`::                   
+The maximum number of connections to the LDAP server to allow in the 
+connection pool. Defaults to `20`.
+
+`user_search.pool.initial_size`::          
+The initial number of connections to create to the LDAP server on startup.
+Defaults to `5`.
+
+`user_search.pool.health_check.enabled`::     
+Flag to enable or disable a health check on LDAP connections in the connection 
+pool. Connections are checked in the background at the specified interval.
+Defaults to `true`.
+
+`user_search.pool.health_check.dn`::       
+The distinguished name to be retrieved as part of the health check. 
+Defaults to the value of `bind_dn`. Required if `bind_dn` is not 
+specified.
+
+`user_search.pool.health_check.interval`::    
+The interval to perform background checks of connections in the pool.
+Defaults to `60s`.
+`group_search.base_dn`::                   
+The container DN to search for groups in which the user has membership. When 
+this element is absent, Security searches for the attribute specified by 
+`user_group_attribute` set on the user in order to determine group membership.
+
+`group_search.scope`::                         
+Specifies whether the group search should be `sub_tree`, `one_level` or 
+`base`.  `one_level` only searches objects directly contained within the 
+`base_dn`. `sub_tree` searches all objects contained under `base_dn`. 
+`base` specifies that the `base_dn` is a group object, and that it is the 
+only group considered. Defaults to  `sub_tree`.
+
+`group_search.filter`::                     
+When not set, the realm searches for `group`, `groupOfNames`, `groupOfUniqueNames`,
+or `posixGroup` with the attributes `member`, `memberOf`, or `memberUid`.  Any
+instance of `{0}` in the filter is replaced by the user attribute defined in
+`group_search.user_attribute`.
+
+`group_search.user_attribute`::             
+Specifies the user attribute that will be fetched and provided as a parameter to 
+the filter.  If not set, the user DN is passed into the filter. Defaults to Empty.
+
+`unmapped_groups_as_roles`::                
+Takes a boolean variable. When this element is set to `true`, the names of any 
+unmapped LDAP groups are used as role names and assigned to the user. Defaults
+to `false`.
+
+`files.role_mapping`::               
+The <<security-files-location,location>> for the <<ldap-role-mapping, 
+YAML role mapping configuration file>>. Defaults to  
+`CONFIG_DIR/x-pack/role_mapping.yml`.
+
+`follow_referrals`::                       
+Boolean value that specifies whether Securityshould follow referrals returned 
+by the LDAP server. Referrals are URLs returned by the server that are to be 
+used to continue the LDAP operation (e.g. search). Defaults to `true`.
+
+`timeout.tcp_connect`::
+The TCP connect timeout period for establishing an LDAP connection.
+An `s` at the end indicates seconds, or `ms` indicates milliseconds.
+Defaults to `5s` (5 seconds ).
+
+`timeout.tcp_read`::
+The TCP read timeout period after establishing an LDAP connection.
+An `s` at the end indicates seconds, or `ms` indicates milliseconds.
+Defaults to `5s` (5 seconds ).
+
+`timeout.ldap_search`::
+The LDAP Server enforced timeout period for an LDAP search.
+An `s` at the end indicates seconds, or `ms` indicates milliseconds.
+Defaults to `5s` (5 seconds ).
+
+`ssl.key`::
+Path to a PEM encoded file containing the private key.
+
+`ssl.key_passphrase`::
+The passphrase that will be used to decrypt the private key. This value is
+optional as the key may not be encrypted.
+
+`ssl.certificate`::
+Path to a PEM encoded file containing the certificate (or certificate chain)
+that will be presented to clients when they connect.
+
+`ssl.certificate_authorities`::
+List of paths to PEM encoded certificate files that should be trusted.
+
+`ssl.keystore.path`::
+The path to the Java Keystore file that contains a private key and certificate.
+`ssl.key` and `ssl.keystore.path` may not be used at the same time.
+
+`ssl.keystore.password`::
+The password to the keystore.
+
+`ssl.keystore.key_password`::
+The password for the key in the keystore. Defaults to the keystore password.
+
+`ssl.truststore.path`::
+The path to the Java Keystore file that contains the certificates to trust.
+`ssl.certificate_authorities` and `ssl.trustsore.path` may not be used at the same time.
+
+`ssl.truststore.password`::
+The password to the truststore.
+
+`ssl.verification_mode`::
+Indicates the type of verification when using `ldaps` to protect against man
+in the middle attacks and certificate forgery. Values are `none`, `certificate`,
+and `full`. Defaults to the value of `xpack.ssl.verification_mode`.
+
+`ssl.supported_protocols`::
+Supported protocols with versions. Defaults to the value of
+`xpack.ssl.supported_protocols`.
+
+`ssl.cipher_suites`
+Supported cipher suites can be found in Oracle's http://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html[
+Java Cryptography Architecture documentation]. Defaults to the value of
+`xpack.ssl.cipher_suites`.
+
+`cache.ttl`::                                 
+Specifies the time-to-live for cached user entries (a user and its credentials 
+are cached for this period of time). Use the standard Elasticsearch 
+{ref}/common-options.html#time-units[time units]). Defaults to  `20m`.
+
+`cache.max_users`::                          
+Specifies the maximum number of user entries that the cache can contain. 
+Defaults to `100000`.
+
+`cache.hash_algo`::                          
+(Expert Setting) Specifies the hashing algorithm that is used for the 
+in-memory cached user credentials (see <<cache-hash-algo,Cache hash algorithms>> 
+table for all possible values). Defaults to `ssha256`.
+
+[[ref-ad-settings]]
+[float]
+==== Active Directory Realm Settings
+
+`url`::                        
+A URL in the format `ldap[s]://<server>:<port>`. Defaults to `ldap://<domain_name>:389`. 
+
+`load_balance.type`::         
+The behavior to use when there are multiple LDAP URLs defined. For supported 
+values see <<ad-load-balancing, LDAP load balancing and failover types>>.
+Defaults to  `failover`.
+
+`load_balance.cache_ttl`::     
+When using `dns_failover` or `dns_round_robin` as the load balancing type, 
+this setting controls the amount of time to cache DNS lookups. Defaults
+to `1h`.
+
+`domain_name`::                
+The domain name of Active Directory. The cluster can derive the URL and 
+`user_search_dn` fields from values in this element if those fields are not 
+otherwise specified. Required.
+
+`unmapped_groups_as_roles`::                                                         
+Takes a boolean variable. When this element is set to `true`, the names of 
+any unmapped groups and the user's relative distinguished name are used as 
+role names and assigned to the user. Defaults to `false`.
+
+`files.role_mapping`::         
+The <<security-files-location,location>> for the <<ad-role-mapping, YAML 
+role mapping configuration file>>. Defaults to  `CONFIG_DIR/x-pack/role_mapping.yml`. 
+
+`user_search.base_dn`::        
+The context to search for a user. Defaults to the root 
+of the Active Directory domain. 
+
+`user_search.scope`::          
+Specifies whether the user search should be `sub_tree`, `one_level` or `base`.  
+`one_level` only searches users directly contained within the `base_dn`. 
+`sub_tree` searches all objects contained under `base_dn`. `base` 
+specifies that the `base_dn` is a user object, and that it is the 
+only user considered. Defaults to `sub_tree`.
+
+`user_search.filter`::        
+Specifies a filter to use to lookup a user given a username.  The default 
+filter looks up `user` objects with either `sAMAccountName` or 
+`userPrincipalName`.
+
+`group_search.base_dn`::       
+The context to search for groups in which the user has membership.  Defaults 
+to the root of the  Active Directory domain.
+
+`group_search.scope`::          
+Specifies whether the group search should be `sub_tree`, `one_level` or 
+`base`.  `one_level` searches for groups directly contained within the 
+`base_dn`. `sub_tree` searches all objects contained under `base_dn`. 
+`base` specifies that the `base_dn` is a group object, and that it is 
+the only group considered. Defaults to `sub_tree`.
+
+`timeout.tcp_connect`::         
+The TCP connect timeout period for establishing an LDAP connection.  
+An `s` at the end indicates seconds, or `ms` indicates milliseconds.
+Defaults to `5s` (5 seconds ).
+
+`timeout.tcp_read`::           
+The TCP read timeout period after establishing an LDAP connection.  
+An `s` at the end indicates seconds, or `ms` indicates milliseconds.
+Defaults to `5s` (5 seconds ).
+
+`timeout.ldap_search`::       
+The LDAP Server enforced timeout period for an LDAP search.  
+An `s` at the end indicates seconds, or `ms` indicates milliseconds.
+Defaults to `5s` (5 seconds ).
+
+`ssl.key`::
+Path to the PEM encoded file containing the private key.
+
+`ssl.key_passphrase`::
+The passphrase that will be used to decrypt the private key. This value is
+optional as the key may not be encrypted.
+
+`ssl.certificate`::
+Path to a PEM encoded file containing the certificate (or certificate chain)
+that will be presented to clients when they connect.
+
+`ssl.certificate_authorities`::
+List of paths to PEM encoded certificate files that should be trusted.
+
+`ssl.keystore.path`::
+The path to the Java Keystore file that contains a private key and certificate.
+
+`ssl.keystore.password`::
+The password to the keystore.
+
+`ssl.keystore.key_password`::
+The password for the key in the keystore. Defaults to the keystore password.
+
+`ssl.truststore.path`::
+The path to the Java Keystore file that contains the certificates to trust.
+
+`ssl.truststore.password`::
+The password to the truststore.
+
+`ssl.verification_mode`::
+Indicates the type of verification when using `ldaps` to protect against man
+in the middle attacks and certificate forgery. Values are `none`, `certificate`,
+and `full`. Defaults to the value of `xpack.ssl.verification_mode`.
+
+`ssl.supported_protocols`::
+Supported protocols with versions. Defaults to the value of
+`xpack.ssl.supported_protocols`.
+
+`ssl.cipher_suites`
+Supported cipher suites can be found in Oracle's http://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html[
+Java Cryptography Architecture documentation]. Defaults to the value of
+`xpack.ssl.cipher_suites`.
+
+`cache.ttl`::                 
+Specifies the time-to-live for cached user entries (user
+credentials are cached for this configured period of time). Use the 
+standard Elasticsearch {ref}/common-options.html#time-units[time units]).
+Defaults to `20m`.
+
+`cache.max_users`::            
+Specifies the maximum number of user entries that the cache can contain. 
+Defaults to `100000`.
+
+`cache.hash_algo`::           
+(Expert Setting) Specifies the hashing algorithm that will be used for 
+the in-memory cached user credentials (see <<cache-hash-algo,Cache hash 
+algorithms>> table for all possible values). Defaults to `ssha256`.
+
+[[ref-pki-settings]]
+[float]
+==== PKI Realm Settings
+
+`username_pattern`::        
+The regular expression pattern used to extract the username from the 
+certificate DN. The first match group is the used as the username. 
+Defaults to `CN=(.*?)(?:,\|$)`
+
+`certificate_authorities`::
+List of PEM certificate files that should be used to authenticate a
+user's certificate as trusted. Defaults to the trusted certificates configured for SSL.
+This setting may not be used with `truststore.path`.
+
+`truststore.path`::          
+The path of a truststore to use. Defaults to the trusted certificates configured for SSL.
+This setting may not be used with `certificate_authorities`.
+ 
+`truststore.password`::    
+The password for the truststore. Must be provided if `truststore.path` is set.
+
+`truststore.algorithm`::                                                    
+Algorithm for the trustsore. Defaults to `SunX509`.
+
+`files.role_mapping`::     
+Specifies the <<security-files-location,location>> for the 
+<<pki-role-mapping, YAML role  mapping configuration file>>.
+Defaults to `CONFIG_DIR/x-pack/role_mapping.yml`.
+
+[float]
+[[ssl-tls-settings]]
+=== Default TLS/SSL Settings
+You can configure the following TLS/SSL settings in 
+`elasticsearch.yml`. For more information, see
+<<ssl-tls, Encrypting Communications>>. These settings will be used
+for all of {xpack} unless they have been overridden by more specific
+settings such as those for HTTP or Transport.
+
+`xpack.ssl.supported_protocols`::
+Supported protocols with versions. Valid protocols: `SSLv2Hello`,
+`SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`. Defaults to `TLSv1.2`, `TLSv1.1`,
+`TLSv1`.
+
+`xpack.ssl.client_authentication`::
+Controls the server's behavior in regard to requesting a certificate
+from client connections. Valid values are `required`, `optional`, and `none`.
+`required` forces a client to present a certificate, while `optional`
+requests a client certificate but the client is not required to present one.
+Defaults to `required`.
+
+`xpack.ssl.verification_mode`::
+Controls the verification of certificates. Valid values are `none`,
+`certificate`, and `full`. Defaults to `full`.
+
+`xpack.ssl.cipher_suites`
+Supported cipher suites can be found in Oracle's http://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html[
+Java Cryptography Architecture documentation]. Defaults to `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`,
+`TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`,
+`TLS_RSA_WITH_AES_128_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA`.
+
+[float]
+[[tls-ssl-key-settings]]
+==== Default TLS/SSL Key and Trusted Certificate Settings
+
+The following settings are used to specify a private key, certificate, and the
+trusted certificates that should be used when communicating over an SSL/TLS connection.
+If none of the settings below are specified, this will default to the <<ssl-tls-settings, {xpack}
+defaults>>. If no trusted certificates are configured, the default certificates that are trusted by the JVM will be
+trusted along with the certificate(s) from the <<tls-ssl-key-settings, key settings>>. The key and certificate must be in place
+for connections that require client authentication or when acting as a SSL enabled server.
+
+[float]
+===== PEM Encoded Files
+
+When using PEM encoded files, use the following settings:
+
+`xpack.ssl.key`::
+Path to the PEM encoded file containing the private key.
+
+`xpack.ssl.key_passphrase`::
+The passphrase that will be used to decrypt the private key. This value is
+optional as the key may not be encrypted.
+
+`xpack.ssl.certificate`::
+Path to a PEM encoded file containing the certificate (or certificate chain)
+that will be presented to clients when they connect.
+
+`xpack.ssl.certificate_authorities`::
+List of paths to the PEM encoded certificate files that should be trusted.
+
+[float]
+===== Java Keystore Files
+
+When using Java keystore files (JKS), which contain the private key, certificate
+and certificates that should be trusted, use the following settings:
+
+`xpack.ssl.keystore.path`::
+Path to the keystore that holds the private key and certificate.
+
+`xpack.ssl.keystore.password`::
+Password to the keystore.
+
+`xpack.ssl.keystore.key_password`::
+Password for the private key in the keystore. Defaults to the
+same value as `xpack.ssl.keystore.password`.
+
+`xpack.ssl.truststore.path`::
+Path to the truststore file.
+
+`xpack.ssl.truststore.password`::
+Password to the truststore.
+
+[[http-tls-ssl-settings]]
+:ssl-prefix:             xpack.security.http
+:component:              HTTP
+:client-auth-default:    none
+:verifies!:
+:server:
+
+include::ssl-settings.asciidoc[]
+
+[[transport-tls-ssl-settings]]
+:ssl-prefix:             xpack.security.transport
+:component:              Transport
+:client-auth-default!:
+:verifies:
+:server:
+
+include::ssl-settings.asciidoc[]
+
+[[ssl-tls-profile-settings]]
+[float]
+==== Transport Profile TLS/SSL Settings
+The same settings that are available for the <<transport-tls-ssl-settings, default transport>>
+are also available for each transport profile. By default, the settings for a
+transport profile will be the same as the default transport unless they
+are specified.
+
+As an example, lets look at the enabled setting. For the default transport
+this is `xpack.security.transport.ssl.enabled`. In order to use this setting in a
+transport profile, use the prefix `transport.profiles.$PROFILE.xpack.security.` and
+append the portion of the setting after `xpack.security.transport.`. For the enabled
+setting, this would be `transport.profiles.$PROFILE.xpack.security.ssl.enabled`.
+
+[float]
+[[ip-filtering-settings]]
+=== IP Filtering Settings
+You can configure the following settings for <<ip-filtering, IP filtering>>.
+
+`xpack.security.transport.filter.allow`::
+List of IP addresses to allow.
+
+`xpack.security.transport.filter.deny`::
+List of IP addresses to deny.
+
+`xpack.security.http.filter.allow`::
+List of IP addresses to allow just for HTTP.
+
+`xpack.security.http.filter.deny`::
+List of IP addresses to deny just for HTTP.
+
+`transport.profiles.$PROFILE.xpack.security.filter.allow`::
+List of IP addresses to allow for this profile.
+
+`transport.profiles.$PROFILE.xpack.security.filter.deny`::
+List of IP addresses to deny for this profile.
diff --git a/docs/en/settings/ssl-settings.asciidoc b/docs/en/settings/ssl-settings.asciidoc
new file mode 100644
index 00000000000..96cae0a1338
--- /dev/null
+++ b/docs/en/settings/ssl-settings.asciidoc
@@ -0,0 +1,96 @@
+[float]
+=== {component} TLS/SSL Settings
+You can configure the following TLS/SSL settings. If the settings are not configured,
+the <<ssl-tls-settings, {xpack} defaults>> will be used.
+
+ifdef::server[]
++{ssl-prefix}.ssl.enabled+::
+Used to enable or disable TLS/SSL. The default is `false`.
+endif::server[]
+
++{ssl-prefix}.ssl.supported_protocols+::
+Supported protocols with versions. Valid protocols: `SSLv2Hello`,
+`SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`. Defaults to `TLSv1.2`, `TLSv1.1`,
+`TLSv1`. Defaults to the value of `xpack.ssl.supported_protocols`.
+
+ifdef::server[]
++{ssl-prefix}.ssl.client_authentication+::
+Controls the server's behavior in regard to requesting a certificate
+from client connections. Valid values are `required`, `optional`, and `none`.
+`required` forces a client to present a certificate, while `optional`
+requests a client certificate but the client is not required to present one.
+ifndef::client-auth-default[]
+Defaults to the value of `xpack.ssl.client_authentication`.
+endif::client-auth-default[]
+ifdef::client-auth-default[]
+Defaults to +{client-auth-default}+.
+endif::client-auth-default[]
+endif::server[]
+
+ifdef::verifies[]
++{ssl-prefix}.ssl.verification_mode+::
+Controls the verification of certificates. Valid values are `none`,
+`certificate`, and `full`. Defaults to the value of `xpack.ssl.verification_mode`.
+endif::verifies[]
+
++{ssl-prefix}.ssl.cipher_suites+::
+Supported cipher suites can be found in Oracle's http://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html[
+Java Cryptography Architecture documentation]. Defaults to the value of
+`xpack.ssl.cipher_suites`.
+
+[float]
+==== {component} TLS/SSL Key and Trusted Certificate Settings
+
+The following settings are used to specify a private key, certificate, and the
+trusted certificates that should be used when communicating over an SSL/TLS connection.
+If none of the settings below are specified, this will default to the <<ssl-tls-settings, {xpack}
+defaults>>.
+ifdef::server[]
+A private key and certificate must be configured.
+endif::server[]
+ifndef::server[]
+A private key and certificate are optional and would be used if the server requires client authentication for PKI
+authentication.
+endif::server[]
+If none of the settings below are specified, the <<ssl-tls-settings, {xpack} defaults>> will be used.
+
+[float]
+===== PEM Encoded Files
+
+When using PEM encoded files, use the following settings:
+
++{ssl-prefix}.ssl.key+::
+Path to a PEM encoded file containing the private key.
+
++{ssl-prefix}.ssl.key_passphrase+::
+The passphrase that will be used to decrypt the private key. This value is
+optional as the key may not be encrypted.
+
++{ssl-prefix}.ssl.certificate+::
+Path to a PEM encoded file containing the certificate (or certificate chain)
+that will be presented when requested.
+
++{ssl-prefix}.ssl.certificate_authorities+::
+List of paths to the PEM encoded certificate files that should be trusted.
+
+[float]
+===== Java Keystore Files
+
+When using Java keystore files (JKS), which contain the private key, certificate
+and certificates that should be trusted, use the following settings:
+
++{ssl-prefix}.ssl.keystore.path+::
+Path to the keystore that holds the private key and certificate.
+
++{ssl-prefix}.ssl.keystore.password+::
+Password to the keystore.
+
++{ssl-prefix}.ssl.keystore.key_password+::
+Password for the private key in the keystore. Defaults to the
+same value as +{ssl-prefix}.ssl.keystore.password+.
+
++{ssl-prefix}.ssl.truststore.path+::
+Path to the truststore file.
+
++{ssl-prefix}.ssl.truststore.password+::
+Password to the truststore.