diff --git a/source/resources/apps/elasticsearch/README b/source/resources/apps/elasticsearch/README
new file mode 100644
index 0000000..de109b4
--- /dev/null
+++ b/source/resources/apps/elasticsearch/README
@@ -0,0 +1,31 @@
+# Clone Debian Stretch template, set up IPs, hostname, ssh keys
+apt update
+apt -y dist-upgrade
+
+# Install elasticsearch
+# Get key
+wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
+# Install deps (should be installed already):
+apt-get -y install apt-transport-https
+# Set up repo for previous release 5.x (current is 6.x).
+# Graylog 2 only works with 5.x. Graylog 3, due in 2018, works with elasticsearch 6.x
+#echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list
+
+echo "deb https://artifacts.elastic.co/packages/5.x/apt stable main" | tee -a /etc/apt/sources.list.d/elastic-5.x.list
+
+# Disable apt-cache in /etc/apt/apt.conf, it doesn't work with https
+apt update
+apt install openjdk-8-jre-headless
+apt install elasticsearch
+# Note for Version 6.x, use
+# apt install elasticsearch-oss
+
+# Configure a cluster name and answer on IP.
+# Open firewall
+
+# Start on boot:
+systemctl enable elasticsearch.service
+
+### XXX Backups
+### XXX Prometheus :)
+
diff --git a/source/resources/spreadsheets/sharkfork.ods b/source/resources/spreadsheets/sharkfork.ods
index 9c1c879..50d5951 100644
Binary files a/source/resources/spreadsheets/sharkfork.ods and b/source/resources/spreadsheets/sharkfork.ods differ