METRON-1652 Document X-Pack Common Problem

[nickwallen]

1. Added numbering to the X-Pack instructions to make them read easier. This is contained in the first commit.

2. Added a "Common Problems" section and description of a problem that users might run into. This is contained in the second commit.

Pull Request Checklist

• Is there a JIRA ticket associated with this PR? If not one needs to be created at Metron Jira.
• Does your PR title start with METRON-XXXX where XXXX is the JIRA number you are trying to resolve? Pay particular attention to the hyphen "-" character.
• Has your PR been rebased against the latest commit within the target branch (typically master)?
• Have you ensured that format looks appropriate for the output in which it is rendered by building and verifying the site-book? If not then run the following commands and the verify changes via site-book/target/site/index.html:

  cd site-book
  mvn site
  

[cestella]

I like this a lot. @mmiklavc anything missing here that we've seen in the wild?

[mmiklavc]

There's also a generic ES message that you'll see when the client can't connect to the ES hosts, e.g.

"None of the configured nodes are available: [{#transport#-1}{MUuqzLIvSqSvt_TH6heDoQ}{some.host.namel}{123.44.55.678:9300}]"

This can come from any and all of the following:

1. ES not configured with X-Pack
2. Client not configured with X-Pack
3. Wrong host/ip for connecting to ES master
4. Permissions issue with cert, username, password for X-Pack
5. Wrong TransportClient being used with X-Pack (i.e. if you did NOT correctly specify org.elasticsearch.xpack.client.PreBuiltXPackTransportClient)
6. ES client is intimidated by ElasticsearchUtils.

There are others as well that I would need to spend a bit of time hunting down and consolidating. They're things that are probably more obvious, however. E.g. unable to read a cert.

[nickwallen]

Ok, maybe we can hit any other common problems with a subsequent PR. No need to delay this one getting in.

[cestella]

+1 by inspection

[mmiklavc]

Sounds good @nickwallen, +1 by inspection.

[nickwallen]

@mmiklavc I'd be happy to write-up your feedback as another PR. Its definitely really good info (especially (6) ES client is intimidated by ElasticsearchUtils :) ), but I don't want to steal your thunder. If you don't have time to get to it, just let me know and I'll write it up in a separate PR.