diff --git a/elasticsearch.rst b/elasticsearch.rst
index 69d47673..6e858a4e 100644
--- a/elasticsearch.rst
+++ b/elasticsearch.rst
@@ -137,7 +137,7 @@ When building a distributed deployment, the Security Onion manager has to start
 
 https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-cluster.html#cluster-shard-allocation-filtering
 
-If you want to set certain search nodes to the ``data_hot``, ``data_warm``, or ``data_cold`` roles, make sure you remove the ``data`` role from them.
+If you want to set certain search nodes to the ``data_hot``, ``data_warm``, or ``data_cold`` roles, make sure you remove the ``data`` role from them. You will also want to ensure that ``data_content`` is assigned to your hot nodes in a full distributed cluster.
 
 .. warning::