From 3ce40a5b9dbf5a07325d6066a7418ec3d8691fff Mon Sep 17 00:00:00 2001
From: MBishop17 <mark@rancher.com>
Date: Mon, 6 Aug 2018 18:06:10 -0700
Subject: [PATCH] adding elasticsearch draft

---
 .../en/tools/logging/elasticsearch/_index.md  | 42 +++++++++++++++++++
 .../v2.x/en/tools/logging/splunk/_index.md    |  1 -
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 content/rancher/v2.x/en/tools/logging/elasticsearch/_index.md

diff --git a/content/rancher/v2.x/en/tools/logging/elasticsearch/_index.md b/content/rancher/v2.x/en/tools/logging/elasticsearch/_index.md
new file mode 100644
index 00000000000..82d18e77577
--- /dev/null
+++ b/content/rancher/v2.x/en/tools/logging/elasticsearch/_index.md
@@ -0,0 +1,42 @@
+---
+title: Elasticsearch
+weight: 200
+---
+
+If your organization uses Elasticsearch, you can configure it to log events from your cluster. Afterwards, you can use Elasticsearch to view data from cluster and containers.
+
+## Configuring Cluster Logging
+
+>**Prerequisites:** Configure an [Elasticsearch deployment](https://www.elastic.co/guide/en/cloud/saas-release/ec-create-deployment.html).
+
+1. From the **Global** view, open the cluster that you want to configure logging for.
+
+1. From the main menu, select **Tools > Logging**.
+
+1. Select **Elasticsearch**.
+
+1. Complete the **Elasticsearch Configuration** form.
+
+    1. From the **Endpoint** field, enter the IP address and port for your Elasticsearch. You can copy this information from your the dashboard of your Elasticseach deployment.
+    
+    1. If you are using [X-Pack Security](https://www.elastic.co/guide/en/x-pack/current/xpack-introduction.html), enter your Elasticsearch **Username** and **Password** for authentication.
+
+    1. Enter an [Index Pattern](https://www.elastic.co/guide/en/kibana/current/index-patterns.html).
+
+1. Complete the **SSL Configuration** form.
+
+    1. Enter a private key and client certificate.
+
+    1. Enter your private key password.
+
+    1. If you want to verify connections to the Elasticsearch, select the **Enabled - Input trusted server certificate** option and then enter your truster server certificate.
+
+1. Complete the **Additional Logging Configuration** form.
+
+    1. Use the **Add Field** button to add key value pairs used to filter log events.
+
+    1. Enter a **Flush Interval**. This value determines how often the buffered logs are flushed.
+
+1. Click **Save**.
+
+**Result:** Rancher is now configured to send cluster and container events to Elasticsearch for logging.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/tools/logging/splunk/_index.md b/content/rancher/v2.x/en/tools/logging/splunk/_index.md
index 4b37cbedc95..add9f417f0d 100755
--- a/content/rancher/v2.x/en/tools/logging/splunk/_index.md
+++ b/content/rancher/v2.x/en/tools/logging/splunk/_index.md
@@ -37,7 +37,6 @@ If your organization uses Splunk, you can configure it to log events from your c
 
 1. Click **Save**.
 
-
 **Result:** Rancher is now configured to send cluster and container events to Splunk for logging.
 
 ## Viewing Logs