Add docs for elasticsearch configuration

docs/config.md

@@ -25,7 +25,7 @@ splunk:
   url: https://splunk.example.com:8089/services/search/jobs
   username: splunkuser
   password: splunkpass
-logstash:
+elasticsearch:
   url: http://logstash.example.com:9200
   result_field_truncate: 200
 ```
@@ -53,6 +53,24 @@ Similar to the ``formatter_dir`` option, ``message_dir`` and ``helper_dir`` can
 locations of **your custom message classes and helper classes**, respectively. These classes will get
 loaded in addition to default messages and helpers.
 
+### Elasticsearch configuration
+
+The `check_elasticsearch` formatter makes alerts generated by elasticsearch results more readable by including relevant information in emails like links to Kibana.
+
+Here are some configuration options you can place under `elasticsearch` in `config.yml`. 
+
+``url`` - The URL of your elasticsearch API server (usually port 9200 on one of your elasticsearch nodes).
+
+``frontend_url`` - The URL of your elasticsearch frontend (usually kibana).
+
+``fields_in_email`` - Fields from an elasticsearch document that show up in alert emails. These fields give you a quick view of the log lines in your email inbox before you click through to your frontend.
+
+``result_field_truncate`` - Truncate fields in elasticsearch to this length.
+
+``num_results`` - The number of results to show in one alert email.
+
+See [config.yml.example](https://github.com/etsy/nagios-herald/blob/master/etc/config.yml.example) for an example configuration file.
+
 ### Icinga Support
 
 ``nagios-herald`` relies on the environment variables set when a notification is sent.