Create a New Elasticsearch Index Template
When you set up a new sensor, you must create a new index template if you are using Elasticsearch.
Add the following to the properties section of the Elasticsearch template:
"properties": {
"metron_field": {
"type": "keyword"
}
}
Refer to Elastic Index Templates for more
information.
