updated logstash-forwarder section
diff --git a/containers/elk/README.md b/containers/elk/README.md
index 9c214e7..676e718 100644
--- a/containers/elk/README.md
+++ b/containers/elk/README.md
@@ -41,6 +41,10 @@
#### Logstash-forwarder
+The logstash-forwarder container is configured to mount the /var/log/ directory of the host machine, which means all files in /var/log are visible to the container. Modify the "files" section conf/config.json to include the files you want logstash-forwarder to handle.
+
+You can modify the mount options in the Makefile if you need to access files that live in a directory other than /var/log/.
+
To build the Loststash-forwarder container
```