Description
The following error occurs when deploying Metron with versions other than 2.0.0.2; particularly version 2.0.1. The current work around is to ask users to downgrade Ansible version per https://cwiki.apache.org/confluence/display/METRON/Downgrade+Ansible.
ASK [elasticsearch : Add Elasticsearch templates for topologies] **************
failed: [node1] (item={u'sensor': u'bro', u'file': {'mappings': {'bro_doc': {'_timestamp':
{'enabled': True}, 'properties': {'enrichments:geo:ip_dst_addr:location_point':
{'type': 'geo_point'}, 'timestamp': {'type': 'date', 'format': 'epoch_millis'}}}}, 'template': 'bro_index*'}}) => {"content": "", "content_length": "450", "content_type": "application/json; charset=UTF-8", "failed": true, "item": {"file": {"mappings": {"bro_doc": {"_timestamp":
{"enabled": true}, "properties": {"enrichments:geo:ip_dst_addr:location_point":
{"type": "geo_point"}, "timestamp": {"format": "epoch_millis", "type": "date"}}}}, "template": "bro_index*"}, "sensor": "bro"}, "msg": "Status code was not [200]: HTTP Error 400: Bad Request", "redirected": false, "status": 400, "url": "http://node1:9200/_template/template_bro"}
failed: [node1] (item={u'sensor': u'yaf', u'file': {'mappings': {'yaf_doc': {'_timestamp':
, 'properties': {'uflags':
{'type': 'string'}, 'pkt':
{'type': 'string'}, 'app':
{'type': 'string'}, 'rtt':
{'type': 'string'}, 'tag':
{'type': 'string'}, 'duration':
{'type': 'string'}, 'riflags':
{'type': 'string'}, 'sip':
{'type': 'string'}, 'proto':
{'type': 'string'}, 'rtag':
{'type': 'string'}, 'oct':
{'type': 'string'}, 'risn':
{'type': 'string'}, 'end-time':
{'type': 'string'}, 'end-reason':
{'type': 'string'}, 'timestamp':
{'type': 'date', 'format': 'epoch_millis'}, 'dp':
{'type': 'string'}, 'enrichments:geo:ip_dst_addr:location_point':
{'type': 'geo_point'}, 'roct':
{'type': 'string'}, 'sp':
{'type': 'string'}, 'iflags':
{'type': 'string'}, 'isn':
{'type': 'string'}, 'ruflags':
{'type': 'string'}, 'rpkt':
{'type': 'string'}, 'dip': {'type': 'string'}}}}, 'template': 'yaf_index*'}}) => {"content": "", "content_length": "450", "content_type": "application/json; charset=UTF-8", "failed": true, "item": {"file": {"mappings": {"yaf_doc": {"_timestamp":
{"enabled": true}, "properties": {"app":
{"type": "string"}, "dip":
{"type": "string"}, "dp":
{"type": "string"}, "duration":
{"type": "string"}, "end-reason":
{"type": "string"}, "end-time":
{"type": "string"}, "enrichments:geo:ip_dst_addr:location_point":
{"type": "geo_point"}, "iflags":
{"type": "string"}, "isn":
{"type": "string"}, "oct":
{"type": "string"}, "pkt":
{"type": "string"}, "proto":
{"type": "string"}, "riflags":
{"type": "string"}, "risn":
{"type": "string"}, "roct":
{"type": "string"}, "rpkt":
{"type": "string"}, "rtag":
{"type": "string"}, "rtt":
{"type": "string"}, "ruflags":
{"type": "string"}, "sip":
{"type": "string"}, "sp":
{"type": "string"}, "tag":
{"type": "string"}, "timestamp":
{"format": "epoch_millis", "type": "date"}, "uflags": {"type": "string"}}}}, "template": "yaf_index*"}, "sensor": "yaf"}, "msg": "Status code was not [200]: HTTP Error 400: Bad Request", "redirected": false, "status": 400, "url": "http://node1:9200/_template/template_yaf"}
failed: [node1] (item={u'sensor': u'snort', u'file': {'mappings': {'snort_doc': {'_timestamp':
, 'properties': {'enrichments:geo:ip_dst_addr:location_point':
{'type': 'geo_point'}, 'timestamp': {'type': 'date', 'format': 'epoch_millis'}}}}, 'template': 'snort_index*'}}) => {"content": "", "content_length": "450", "content_type": "application/json; charset=UTF-8", "failed": true, "item": {"file": {"mappings": {"snort_doc": {"_timestamp":
{"enabled": true}, "properties": {"enrichments:geo:ip_dst_addr:location_point":
{"type": "geo_point"}, "timestamp": {"format": "epoch_millis", "type": "date"}}}}, "template": "snort_index*"}, "sensor": "snort"}, "msg": "Status code was not [200]: HTTP Error 400: Bad Request", "redirected": false, "status": 400, "url": "http://node1:9200/_template/template_snort"}
to retry, use: --limit @../../playbooks/metron_full_install.retry
PLAY RECAP *********************************************************************
node1 : ok=70 changed=4 unreachable=0 failed=1