diff --git a/docs/index.asciidoc b/docs/index.asciidoc
index 3d8756c..a51406f 100644
--- a/docs/index.asciidoc
+++ b/docs/index.asciidoc
@@ -28,31 +28,41 @@ Like stdin and file inputs, each event is assumed to be one line of text.
Can either accept connections from clients or connect to a server,
depending on `mode`.
-===== Accepting log4j2 logs
-
-Log4j2 can send JSON over a socket, and we can use that combined with our tcp
-input to accept the logs.
-
-First, we need to configure your application to send logs in JSON over a
-socket. The following log4j2.xml accomplishes this task.
-
-Note, you will want to change the `host` and `port` settings in this
-configuration to match your needs.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-To accept this in Logstash, you will want tcp input and a date filter:
+===== Accepting Log4j 2 logs
+
+Log4j 2 can write ECS-compliant JSON-formatted log events to a TCP socket.
+We can combine with our TCP input to accept the logs from applications using Log4j 2.
+
+First, we need to configure your application to write JSON-formatted logs to a TCP socket:
+
+.Example `log4j2.xml` configuration for writing JSON-formatted logs to Logstash TCP input
+[source,xml]
+----
+
+
+
+
+ eventTemplateUri="classpath:EcsLayout.json"
+ nullEventDelimiterEnabled="true"/>
+
+
+
+
+
+
+
+
+----
+<1> Using Socket Appender to write logs to a TCP socket – make sure to *change the `host` attribute* to match your setup
+<2> Using https://logging.apache.org/log4j/2.x/manual/json-template-layout.html[JSON Template Layout] to encode log events in JSON
+<3> Using the ECS (Elastic Common Schema) layout bundled with JSON Template Layout
+<4> Configuring that written log events should be terminated with a null (i.e., `\0`) character
+
+To accept this in Logstash, you will want a TCP input:
input {
tcp {
@@ -61,15 +71,6 @@ To accept this in Logstash, you will want tcp input and a date filter:
}
}
-and add a date filter to take log4j2's `timeMillis` field and use it as the
-event timestamp
-
- filter {
- date {
- match => [ "timeMillis", "UNIX_MS" ]
- }
- }
-
[id="plugins-{type}s-{plugin}-ecs_metadata"]
==== Event Metadata and the Elastic Common Schema (ECS)