Uploaded image for project: 'Metron (Retired)'
  1. Metron (Retired)
  2. METRON-212

Allow additional Elasticsearch templates to be loaded to the index

    XMLWordPrintableJSON

Details

    • Task
    • Status: Done
    • Major
    • Resolution: Done
    • None
    • None

    Description

      Currently, deployment will only set up templates for Bro, Yaf, and Snort.

      Do the following:
      1) Relocate the template creation to the metron_streaming role to enable re-running as new topologies are deployed.
      2) Glob any *.template files in metron_streaming/files/es_templates and send them to the Elasticsearch index as a PUT _template/basename (i.e. foo.template would be added as PUT _template/foo)

      Is there any value to adding a configurable directory location to add additional templates? Could do as part of this effort, but I don't know if there is any need.

      Attachments

        Issue Links

          Activity

            People

              dlyle David M. Lyle
              dlyle David M. Lyle
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: