diff --git a/modules/cluster-logging-elasticsearch-audit.adoc b/modules/cluster-logging-elasticsearch-audit.adoc
index 7b0a47208fab..3029e3870807 100644
--- a/modules/cluster-logging-elasticsearch-audit.adoc
+++ b/modules/cluster-logging-elasticsearch-audit.adoc
@@ -59,29 +59,32 @@ spec:
   outputs:
    - name: elasticsearch-insecure
      type: "elasticsearch"
-     url: elasticsearch-insecure.svc.messaging.cluster.local
+     url: http://elasticsearch-insecure.messaging.svc.cluster.local
      insecure: true
    - name: elasticsearch-secure
      type: "elasticsearch"
-     url: elasticsearch-secure.svc.messaging.cluster.local
+     url: https://elasticsearch-secure.messaging.svc.cluster.local
      secret: 
-        name: es-audit
+       name: es-audit
    - name: secureforward-offcluster
-     type: "forward"
+     type: "fluentdForward"
      url: https://secureforward.offcluster.com:24224
      secret:
-        name: secureforward
+       name: secureforward
   pipelines: 
    - name: container-logs
-     inputRefs: application
+     inputRefs:
+     - application
      outputRefs:
      - secureforward-offcluster
    - name: infra-logs
-     inputRefs: infrastructure
+     inputRefs:
+     - infrastructure
      outputRefs:
      - elasticsearch-insecure
    - name: audit-logs
-     inputRefs: audit
+     inputRefs:
+     - audit
      outputRefs:
      - elasticsearch-secure
      - default <1>