Github user justinleet commented on the issue: https://github.com/apache/metron/pull/780 @cestella @nickwallen Hopefully took care of comments that don't involve migrating wiki docs. Let me know if I looked over anything. Sidenote, does anybody know how to actually link to a head in a different doc? Anything inside the same doc works fine, but across docs would be better. ## Test Plan ### Setup Rather than creating a new parser, let's just break the Bro one. 1. Spin up full dev 1. Stop bro in monit. 1. Pull down the bro template and delete the extra JSON tag we don't need ``` curl -XGET "http://node1:9200/_template/bro_index*?pretty" -o "bro.template" sed -i '' '2d;$d' ./bro.template ``` 1. Open it in an editor and remove the `alert` field under `properties` 1. Push the template back. ``` curl -XPUT "http://node1:9200/_template/bro_index" -d @${SENSOR}.template ``` 1. Ensure the `alert` field does **NOT** show up in the template: ``` curl -XGET 'node1:9200/_template/bro_index*?pretty' | grep '"alert"' ``` 1. Delete any existing bro indices ``` curl -XDELETE 'localhost:9200/bro*?pretty' ``` 1. Turn bro back on in Monit. 1. Wait until new data flows through the system into the bro indexes. 1. Make sure that the mapping has no `alert` field (i.e. Did our updated template apply as expected?). At this point we should have a sensor without the proper template and existing data. ``` curl -XGET 'node1:9200/bro*/_mapping?pretty' | grep '"alert"' ``` 1. Go into the Swagger UI and run the following search. It should fail with a 500: ``` { "fields": [ "*" ], "from": 0, "indices": [ "bro" ], "query": "*", "size": 10 } ``` 1. Run through the commands given in the metron-elasticsearch README to update both the template and the mappings. 1. Ensure the `alert` field shows up in the mappings: ``` curl -XGET 'node1:9200/bro*/_mapping?pretty' | grep '"alert"' ``` 1. Ensure the `alert` field shows up in the template: ``` curl -XGET 'node1:9200/_template/bro_index*?pretty' | grep '"alert"' ``` 1. Rerun the query from the Swagger UI. Results should be returned now with no error.
---