Github user ottobackwards commented on a diff in the pull request:
https://github.com/apache/metron/pull/817#discussion_r147725937
--- Diff: metron-platform/metron-elasticsearch/README.md ---
@@ -86,8 +86,13 @@ rm ${SENSOR}.template
The stock set of Elasticsearch templates for bro, snort, yaf, error index
and meta index are installed automatically during the first time install and
startup of Metron Indexing service.
-It is possible that Elasticsearch service is not available when the Metron
Indexing Service startup, in that case the Elasticsearch template will not be
installed. For such a scenario, an Admin can install the template manually from
the Ambari UI by following the below flow:
+It is possible that Elasticsearch service is not available when the Metron
Indexing Service startup, in that case the Elasticsearch template will not be
installed.
+For such a scenario, an Admin can have the template installed in two ways:
+
+_Method 1_ - Manually from the Ambari UI by following the flow:
Ambari UI -> Services -> Metron -> Service Actions -> Elasticsearch
Template Install
+_Method 2_ - Stop the Metron Indexing service, and start it again from
Ambari UI.
+
--- End diff --
I am not trying to nit, but this should expressly call out that we will
attempt to install the templates each START until successful.
-------
_Method 2_ - Stop the Metron Indexing service, and start it again from
Ambari UI.
> Note: The Metron Indexing service tracks if it has successfully
installed the Elasticsearch templates, and will attempt to do so each time it
is Started until successful.
---
