I tried reading the mapping documentation in the Balabit Latest docs but I'm not connecting these dots, sorry. 

Can I use the templates for creating the ES index as a reference for json mapping in syslog-ng ? 

For example the attached winlogbeat.template.json which created the ES index.