adding content after asking Bill about different aspects of logging.

content/rancher/v2.x/en/tools/logging/elasticsearch/_index.md

@@ -33,25 +33,26 @@ You can configure Elasticsearch to log events at both the cluster and project le
 
     1. Enter an [Index Pattern](https://www.elastic.co/guide/en/kibana/current/index-patterns.html).
 
-1. If your instance of Elasticsearch uses SSL, complete the **SSL Configuration** form.
+1. If your instance of Elasticsearch uses SSL, complete the **SSL Configuration** form. 
 
-    1. Enter a private key and client certificate. Either copy and paste them or browse to them using **Read from a file**.
+    1. Enter a private key and client certificate. Either copy and paste them or browse to them using **Read from a file**. This certificate will be installed on your logging server.
 
-        You can generate a key and certificate one using an openssl command. For example:
-        
+        You can use either a self-signed certificate or one provided by a certificate authority.
+
+        You can generate a self-signed certificate using an openssl command. For example:
             
             openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
        
 
     1. Enter your private key password.
 
-    1. If you want to verify connections to Elasticsearch, select the **Enabled - Input trusted server certificate** option and then enter your **Trusted Server Certificate**.
+    1. If you are using a certificate from a certificate authority (and not a self-signed certificate), select the **Enabled - Input trusted server certificate** option and then enter your **Trusted Server Certificate**.
 
 1. Complete the **Additional Logging Configuration** form.
 
-    1. Use the **Add Field** button to add key value pairs that represent custom log fields to filter log events.
+    1. **Optional:** Use the **Add Field** button to add custom log fields to your logging configuration. These fields are key value pairs (such as `foo=bar`) that you can use to filter the logs from another system.
 
-    1. Enter a **Flush Interval**. This value determines how often the buffered logs are flushed.
+    1. Enter a **Flush Interval**. This value determines how often [Fluentd](https://www.fluentd.org/) flushes event data to the logging server. Intervals are measured in seconds.
 
 1. Click **Save**.
 

content/rancher/v2.x/en/tools/logging/kafka/_index.md

@@ -37,9 +37,9 @@ You can configure Kafka to log events at both the cluster and project level.
 
 1. Complete the **Additional Logging Configuration** form.
 
-    1. **Optional**: Use the **Add Field** button to add key value pairs that represent custom log fields used to filter log events.
-
-    1. Enter a **Flush Interval**. This value determines how often the buffered logs are flushed.
+    1. **Optional:** Use the **Add Field** button to add custom log fields to your logging configuration. These fields are key value pairs (such as `foo=bar`) that you can use to filter the logs from another system.
+    
+    1. Enter a **Flush Interval**. This value determines how often [Fluentd](https://www.fluentd.org/) flushes event data to the logging server. Intervals are measured in seconds.
 
 1. Click **Save**.
 

content/rancher/v2.x/en/tools/logging/splunk/_index.md

@@ -38,7 +38,7 @@ You can configure Splunk to log events at both the cluster and project level.
     
         Splunk usually uses port `8088`. If you're using Splunk Cloud, you'll need to work with [Splunk support](https://www.splunk.com/en_us/support-and-services.html) to get an endpoint URL.
 
-    1. Enter the **Token** you obtained while completing the prerequisites(i.e., when you created a token in Splunk).
+    1. Enter the **Token** you obtained while completing the prerequisites (i.e., when you created a token in Splunk).
 
     1. From the **Source** field, enter the name of the token as entered in Splunk.
 
@@ -46,9 +46,9 @@ You can configure Splunk to log events at both the cluster and project level.
 
 1. Complete the **Additional Logging Configuration** form.
 
-    1. Use the **Add Field** button to add key value pairs that represent custom log fields used to filter log events.
+    1. **Optional:** Use the **Add Field** button to add custom log fields to your logging configuration. These fields are key value pairs (such as `foo=bar`) that you can use to filter the logs from another system.
 
-    1. Enter a **Flush Interval**. This value determines how often the buffered logs are flushed.
+    1. Enter a **Flush Interval**. This value determines how often [Fluentd](https://www.fluentd.org/) flushes event data to the logging server. Intervals are measured in seconds.
 
 1. Click **Save**.
 

content/rancher/v2.x/en/tools/logging/syslog/_index.md

@@ -40,20 +40,22 @@ You can configure Syslog to log events at both the cluster level and the project
 
 1. If your Syslog server uses **TCP** protocol, complete the **SSL Configuration** form.
 
-    1. Enter a private key and client certificate. Either copy and paste them or browse to them using **Read from a file**.
+    1. Enter a private key and client certificate. Either copy and paste them or browse to them using **Read from a file**. This certificate will be installed on your logging server.
 
-        You can generate a key and client using an openssl command. For example:
+        You can use either a self-signed certificate or one provided by a certificate authority.
+
+        You can generate a self-signed certificate using an openssl command. For example:
         
             
             openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
 
-    1. If you want to verify connections to the Syslog service, select the **Enabled - Input trusted server certificate** option and then enter your truster server certificate.
+    1. If you are using a certificate from a certificate authority (and not a self-signed certificate), select the **Enabled - Input trusted server certificate** option and then enter your **Trusted Server Certificate**.
 
 1. Complete the **Additional Logging Configuration** form.
 
-    1. Use the **Add Field** button to add key value pairs used to filter log events.
-
-    1. Enter a **Flush Interval**. This value determines how often the buffered logs are flushed.
+    1. **Optional:** Use the **Add Field** button to add custom log fields to your logging configuration. These fields are key value pairs (such as `foo=bar`) that you can use to filter the logs from another system.
+    
+     1. Enter a **Flush Interval**. This value determines how often [Fluentd](https://www.fluentd.org/) flushes event data to the logging server. Intervals are measured in seconds.
 
 1. Click **Save**.