for read bombs

README.md

@@ -52,4 +52,36 @@ So far I only have one outout plugin called "elastic_nom"
     ]
 }
 
-```
+```
+
+## Plugins
+
+### Elasticsearch "elastic_nom"
+
+``` json
+{
+    "name" : "elastic_nom",
+    "enabled" : true,
+    "es_host" : "localhost",
+    "es_port" : "9200",
+    "es_index" : "evtx_nom",
+    "security" : "none",
+    "es_user" : "USERNAME",
+    "es_pass" : "PASSWORD",
+    "es_api_key" : "APIKEY",
+    "es_scheme" : "http"
+}
+```
+
+| field | value type | notes |
+| --- | --- | --- |
+| name | elastic_nom | it must be elastic_nom |
+| enabled | bool | true or false, if true it will be used |
+| es_host | string | ip or host of elasticsearch |
+| es_port | string | port of elasticsearch (default is 9200) |
+| es_index | string | index to write events to |
+| security | string | can be "none" , "basic" or "api" |
+| es_user | string | elasticsearch security username (for basic auth |
+| es_pass | string | elasticsearch security password ( for basic auth)|
+| es_api_key | string | base64 encoded api key (for api auth) |
+| es_scheme| string | http or https (for security you will be using https) |