@Jon Zeolla Hi, You can bypass enrichment for bro by following the below steps :- 1.Establish SSH connection to the node where metron service(s) is installed. 2.On the specified node navigate to the following path :- /usr/metron/0.2.0BETA/config/zookeeper/enrichments 3.Create a backup of the existing bro.json file in some directory so that you can use it later. 4.Now edit the bro.json file and change the content to the following :- { "index": "bro", "batchSize": 5 } 5.Now execute the following command to push the config to the zookeeper :- /usr/metron/0.2.0BETA/bin/zk_load_configs.sh -z ZOOKEEPER_HOST:2181 -m PUSH -i /usr/metron/0.2.0BETA/config/zookeeper/ Please replace the ZOOKEEPER_HOST text with your zookeeper node hostname. 6.Perform the following command to make sure the config got pushed all good to zookeeper and no errors are seen. /usr/metron/0.2.0BETA/bin/zk_load_configs.sh -z ZOOKEEPER_HOST:2181 -m DUMP Since the current bro.json file @/usr/metron/0.2.0BETA/config/zookeeper/enrichments/bro.json does not contain any mention of enrichment so enrichment should be by passed for the the Bro logs. Please let me know if the above steps solves the issue you are facing. Regards, neha ... View more

@Neeraj Sabharwal Hi Neeraj, Do you see any response when you put the following url in your browser :- http://node1:9200/_cat/health For example you should see some output like this :- 1467897265 13:14:25 metron yellow 1 1 5 5 0 0 5 0 - 50.0% it might be a case where the system is slow and it's taking more time than expected. If it's due to slowness then you might have to increase the timeout in the following file and rerun the deployment :- metron-deployment/roles/metron_elasticsearch_templates/tasks/load_templates.yml Regards, Neha ... View more

@Neeraj Sabharwal Hi Neeraj, Could you please check ansible version you are running the code with?(ansible --version) For metron deployment, ansible 2.0.0.2 is required. Note :- If you perform a "pip install ansible"...It installs ansible-2.1.0.0 and we happen to come across the issue you mentioned. Incase you have a different version of ansible installed than 2.0.0.2,please perform the following steps and rerun the metron deployment :- pip uninstall ansible pip install ansible==2.0.0.2 Regards, Neha ... View more