Github user ottobackwards commented on a diff in the pull request:
https://github.com/apache/metron/pull/817#discussion_r147670198
--- Diff: metron-platform/metron-elasticsearch/README.md ---
@@ -81,3 +81,13 @@ curl -XPUT
"http://${ELASTICSEARCH}:9200/${SENSOR}_index*/_mapping/${SENSOR}_doc
'
rm ${SENSOR}.template
```
+
+## Installing Elasticsearch Templates
+
+The stock set of Elasticsearch templates for bro, snort, yaf, error index
and meta index are installed automatically during the first time install and
startup of Metron Indexing service.
+
--- End diff --
Instead of saying 'in the rare case', it might be better to say:
"It is possible that Elasticsearch is not available when the Metron
Indexing Service starts the Elasticsearch topology, in that case the
Elasticsearch templates will not be installed."
Also, this doesn't document the scenarios you have been describing fully.
---
