I have 2 roles: longstash and elasticsearch.
The logstash role is dependant on elasticsearch.
In each role, all tasks are flagged with the name of the role.
In addition, in elasticsearch role I have tasks that open ports in iptables - which are signaling a handler that restarts the iptables service if they make a change.
Now, I run an ansible-playbook that has these roles, with a --flags "elasticsearch" to install it first alone. What happens, is that the elasticsearch tasks all run, and then they all run again becaus ansible's mechanism figured out that the logstash role depends on elasticsearch and thus ansible collected these tasks twice.
But it gets worst - because the second run does not change the iptables setting from what happened after the first run, then ansible thinks there was no change, and thus does not trigger the handler that would have supposed to restart iptables.
The moment I remove the elasticsearch-role from the dependancy-list of logstash, everything works correctly.