Github user ottobackwards commented on a diff in the pull request:
https://github.com/apache/metron/pull/817#discussion_r147711822
--- Diff: metron-platform/metron-elasticsearch/README.md ---
@@ -81,3 +81,13 @@ curl -XPUT
"http://${ELASTICSEARCH}:9200/${SENSOR}_index*/_mapping/${SENSOR}_doc
'
rm ${SENSOR}.template
```
+
+## Installing Elasticsearch Templates
+
+The stock set of Elasticsearch templates for bro, snort, yaf, error index
and meta index are installed automatically during the first time install and
startup of Metron Indexing service.
+
--- End diff --
But, if that is the way it works, and is what will happen, you should
documented it. If it doesn't make sense enough to document, then change the
behavior.
We have people all over the user's list with issues understanding what is
going on with things.
"Oh, the doc doesn't say it but we *do* try to install automatically next
time or if you .... " isn't right.
---
