Cloudera Docs

Create a New Elasticsearch Index Template

When you set up a new sensor, you must create a new index template if you are using Elasticsearch.

Add the following to the properties section of the Elasticsearch template: 
"properties": {
  "metron_field": {
    "type": "keyword"
  }
}
Refer to Elastic Index Templates for more information.