diff --git a/nladmin-system/README.md b/nladmin-system/README.md
index 4af111c..6e76684 100644
--- a/nladmin-system/README.md
+++ b/nladmin-system/README.md
@@ -2,3 +2,260 @@
 
 ## ES日志分支
 > 开启了ES，除了使用在日志上还可以用于其他功能，用户登录记录、操作记录、请求记录等长期存储的数据。
+
+## 使用
+可以自定义标签，在logback`xml`文件中进行设置
+```xml
+<appender name="ELASTIC" class="com.internetitem.logback.elasticsearch.ElasticsearchAppender">
+        <url>http://127.0.0.1:9200/_bulk</url>
+        <index>nl_lms</index>
+        <type>sever</type>
+        <loggerName>es-logger</loggerName> <!-- optional -->
+        <errorLoggerName>es-error-logger</errorLoggerName> <!-- optional -->
+        <connectTimeout>30000</connectTimeout> <!-- optional (in ms, default 30000) -->
+        <errorsToStderr>false</errorsToStderr> <!-- optional (default false) -->
+        <includeCallerData>false</includeCallerData> <!-- optional (default false) -->
+        <logsToStderr>false</logsToStderr> <!-- optional (default false) -->
+        <maxQueueSize>30000</maxQueueSize> <!-- optional (default 104857600) -->
+        <maxRetries>3</maxRetries> <!-- optional (default 3) -->
+        <readTimeout>30000</readTimeout> <!-- optional (in ms, default 30000) -->
+        <sleepTime>250</sleepTime> <!-- optional (in ms, default 250) -->
+        <rawJsonMessage>false</rawJsonMessage> <!-- optional (default false) -->
+        <includeMdc>true</includeMdc> <!-- optional (default false) -->
+        <maxMessageSize>-1</maxMessageSize> <!-- optional (default -1 -->
+        <authentication class="com.internetitem.logback.elasticsearch.config.BasicAuthentication" /> <!-- optional -->
+        <properties>
+            <property>
+                <name>host</name>
+                <value>127.0.0.1</value>
+                <allowEmpty>true</allowEmpty>
+            </property>
+            <property>
+                <name>time</name>
+                <value>%d{yyyy-MM-dd'T'HH:mm:ss.SSSXXX}</value>
+            </property>
+            <property>
+                <name>severity</name>
+                <value>%level</value>
+            </property>
+            <property>
+                <name>thread</name>
+                <value>%thread</value>
+            </property>
+            <property>
+                <name>stacktrace</name>
+                <value>%ex</value>
+            </property>
+            <property>
+                <name>logger</name>
+                <value>%logger</value>
+            </property>
+        </properties>
+        <headers>
+            <header>
+                <name>Content-Type</name>
+                <value>application/json</value>
+            </header>
+        </headers>
+    </appender>
+```
+在多台服务器中，可以通过配置`host`来区分是哪台服务器打印的日志。
+其中properties/property 可以自己定义需要的标签。也可以通过MDC来操作，在ES中，如果使用MDC会自动生成key-value。
+例如：
+```text
+MDC.put("k", "v");
+// 在ES中将存储
+"k": {
+    "type": "text",
+        "fields": {
+        "keyword": {
+            "type": "keyword",
+                "ignore_above": 256
+        }
+    }
+}
+```
+例如代码中`MDC.put("tag", TagNameEnum.LMS.getTag());`在ES中将会看到
+```json
+"tag": {
+  "type": "text",
+  "fields": {
+    "keyword": {
+      "type": "keyword",
+      "ignore_above": 256
+    }
+  }
+}
+```
+实际查询出来的数据："tag": "LMS系统"
+
+## ES常用两个api
+在浏览器可以通过ES的api查看数据
+### 根据索引执行搜索查询
+使用 http://127.0.0.1:9200/nl_lms/_search
+```json
+{"took":143,"timed_out":false,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{"value":1912,"relation":"eq"},"max_score":1.0,"hits":[{"_index":"nl_lms","_type":"sever","_id":"j0bTGpcBvVNdArQQWE4t","_score":1.0,"_source":{"@timestamp":"2025-05-29T14:55:47.498+0800","message":"Connection created [addr=redis://127.0.0.1:6379]","host":"127.0.0.1","time":"2025-05-29T14:55:47.498+08:00","severity":"DEBUG","thread":"redisson-netty-2-2","logger":"org.redisson.client.RedisConnection"}},{"_index":"nl_lms","_type":"sever","_id":"kEbTGpcBvVNdArQQWE4t","_score":1.0,"_source":{"@timestamp":"2025-05-29T14:55:47.498+0800","message":"Connection created [addr=redis://127.0.0.1:6379]","host":"127.0.0.1","time":"2025-05-29T14:55:47.498+08:00","severity":"DEBUG","thread":"redisson-netty-2-1","logger":"org.redisson.client.RedisConnection"}},{"_index":"nl_lms","_type":"sever","_id":"kUbTGpcBvVNdArQQWE4t","_score":1.0,"_source":{"@timestamp":"2025-05-29T14:55:47.498+0800","message":"Connection created [addr=redis://127.0.0.1:6379]","host":"127.0.0.1","time":"2025-05-29T14:55:47.498+08:00","severity":"DEBUG","thread":"redisson-netty-2-3","logger":"org.redisson.client.RedisConnection"}},{"_index":"nl_lms","_type":"sever","_id":"kkbTGpcBvVNdArQQWE4t","_score":1.0,"_source":{"@timestamp":"2025-05-29T14:55:47.498+0800","message":"Connection created [addr=redis://127.0.0.1:6379]","host":"127.0.0.1","time":"2025-05-29T14:55:47.498+08:00","severity":"DEBUG","thread":"redisson-netty-2-4","logger":"org.redisson.client.RedisConnection"}},{"_index":"nl_lms","_type":"sever","_id":"k0bTGpcBvVNdArQQWE4t","_score":1.0,"_source":{"@timestamp":"2025-05-29T14:55:47.499+0800","message":"Connection created [addr=redis://127.0.0.1:6379]","host":"127.0.0.1","time":"2025-05-29T14:55:47.499+08:00","severity":"DEBUG","thread":"redisson-netty-2-2","logger":"org.redisson.client.RedisConnection"}},{"_index":"nl_lms","_type":"sever","_id":"lEbTGpcBvVNdArQQWE4t","_score":1.0,"_source":{"@timestamp":"2025-05-29T14:55:47.499+0800","message":"Connection created [addr=redis://127.0.0.1:6379]","host":"127.0.0.1","time":"2025-05-29T14:55:47.499+08:00","severity":"DEBUG","thread":"redisson-netty-2-4","logger":"org.redisson.client.RedisConnection"}},{"_index":"nl_lms","_type":"sever","_id":"lUbTGpcBvVNdArQQWE4t","_score":1.0,"_source":{"@timestamp":"2025-05-29T14:55:47.499+0800","message":"Connection created [addr=redis://127.0.0.1:6379]","host":"127.0.0.1","time":"2025-05-29T14:55:47.499+08:00","severity":"DEBUG","thread":"redisson-netty-2-1","logger":"org.redisson.client.RedisConnection"}},{"_index":"nl_lms","_type":"sever","_id":"lkbTGpcBvVNdArQQWE4t","_score":1.0,"_source":{"@timestamp":"2025-05-29T14:55:47.499+0800","message":"Connection created [addr=redis://127.0.0.1:6379]","host":"127.0.0.1","time":"2025-05-29T14:55:47.499+08:00","severity":"DEBUG","thread":"redisson-netty-2-3","logger":"org.redisson.client.RedisConnection"}},{"_index":"nl_lms","_type":"sever","_id":"l0bTGpcBvVNdArQQWE4t","_score":1.0,"_source":{"@timestamp":"2025-05-29T14:55:47.503+0800","message":"Connection created [addr=redis://127.0.0.1:6379]","host":"127.0.0.1","time":"2025-05-29T14:55:47.503+08:00","severity":"DEBUG","thread":"redisson-netty-2-2","logger":"org.redisson.client.RedisConnection"}},{"_index":"nl_lms","_type":"sever","_id":"mEbTGpcBvVNdArQQWE4t","_score":1.0,"_source":{"@timestamp":"2025-05-29T14:55:47.544+0800","message":"8 connections initialized for 127.0.0.1/127.0.0.1:6379","host":"127.0.0.1","time":"2025-05-29T14:55:47.544+08:00","severity":"INFO","thread":"redisson-netty-2-1","logger":"org.redisson.connection.pool.MasterConnectionPool"}}]}}
+```
+### 根据索引查看映射
+使用 http://127.0.0.1:9200/nl_lms/_mapping
+```json
+{
+  "nl_lms": {
+    "mappings": {
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "apiPath": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "api_path": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "currIp": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "host": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "logger": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "message": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "preIp": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "preIvkApp": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "preIvkHost": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "severity": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "stacktrace": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "tag": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "thread": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "time": {
+          "type": "date"
+        },
+        "tl": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "tlogSpanId": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "tlogTraceId": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+更多查看：https://elasticsearch.bookhub.tech/rest_apis/