diff --git a/flink-cyber/flink-alert-scoring-api/src/main/java/com/cloudera/cyber/scoring/ScoredMessage.java b/flink-cyber/flink-alert-scoring-api/src/main/java/com/cloudera/cyber/scoring/ScoredMessage.java
index b2ce2b6a2..f38eaab00 100644
--- a/flink-cyber/flink-alert-scoring-api/src/main/java/com/cloudera/cyber/scoring/ScoredMessage.java
+++ b/flink-cyber/flink-alert-scoring-api/src/main/java/com/cloudera/cyber/scoring/ScoredMessage.java
@@ -14,6 +14,7 @@
 
 import com.cloudera.cyber.IdentifiedMessage;
 import com.cloudera.cyber.Message;
+import com.cloudera.cyber.avro.AvroSchemas;
 import lombok.AllArgsConstructor;
 import lombok.Builder;
 import lombok.Data;
@@ -22,7 +23,6 @@
 import lombok.ToString;
 import org.apache.avro.AvroRuntimeException;
 import org.apache.avro.Schema;
-import org.apache.avro.SchemaBuilder;
 import org.apache.avro.specific.SpecificRecord;
 import org.apache.avro.specific.SpecificRecordBase;
 import org.apache.flink.api.common.typeinfo.TypeInformation;
@@ -54,8 +54,7 @@ public long getTs() {
         return message.getTs();
     }
 
-    public static final Schema SCHEMA$ = SchemaBuilder.record(ScoredMessage.class.getName())
-            .namespace(ScoredMessage.class.getPackage().getName())
+    public static final Schema SCHEMA$ = AvroSchemas.createRecordBuilder(ScoredMessage.class.getPackage().getName(), ScoredMessage.class.getName())
             .fields()
             .name("message").type(Message.SCHEMA$).noDefault()
             .name("cyberScoresDetails").type(Schema.createArray(Scores.SCHEMA$)).noDefault()
diff --git a/flink-cyber/flink-cyber-api/src/main/java/com/cloudera/cyber/Message.java b/flink-cyber/flink-cyber-api/src/main/java/com/cloudera/cyber/Message.java
index e871a85bb..44e5dc8c1 100644
--- a/flink-cyber/flink-cyber-api/src/main/java/com/cloudera/cyber/Message.java
+++ b/flink-cyber/flink-cyber-api/src/main/java/com/cloudera/cyber/Message.java
@@ -12,6 +12,7 @@
 
 package com.cloudera.cyber;
 
+import com.cloudera.cyber.avro.AvroSchemas;
 import lombok.AllArgsConstructor;
 import lombok.Builder;
 import lombok.Data;
@@ -52,7 +53,7 @@ public class Message extends SpecificRecordBase implements SpecificRecord, Ident
     @NonNull private String source;
     private List<DataQualityMessage> dataQualityMessages;
 
-    public static final Schema SCHEMA$ = SchemaBuilder.record(Message.class.getName()).namespace(Message.class.getPackage().getName())
+    public static final Schema SCHEMA$ = AvroSchemas.createRecordBuilder(Message.class.getPackage().getName(), Message.class.getName())
             .fields()
             .requiredString("id")
             .requiredLong("ts")
diff --git a/flink-cyber/flink-cyber-api/src/main/java/com/cloudera/cyber/avro/AvroSchemas.java b/flink-cyber/flink-cyber-api/src/main/java/com/cloudera/cyber/avro/AvroSchemas.java
new file mode 100644
index 000000000..9bec6f190
--- /dev/null
+++ b/flink-cyber/flink-cyber-api/src/main/java/com/cloudera/cyber/avro/AvroSchemas.java
@@ -0,0 +1,12 @@
+package com.cloudera.cyber.avro;
+
+import org.apache.avro.SchemaBuilder;
+
+public class AvroSchemas {
+
+    public static SchemaBuilder.RecordBuilder<org.apache.avro.Schema> createRecordBuilder(String namespace, String recordName) {
+        return SchemaBuilder.record(recordName).namespace(namespace)
+                .prop("ssb.rowtimeAttribute", "ts")
+                .prop("ssb.watermarkExpression", "`ts` - INTERVAL '30' SECOND");
+    }
+}
diff --git a/flink-cyber/flink-indexing/flink-indexing-hive/pom.xml b/flink-cyber/flink-indexing/flink-indexing-hive/pom.xml
index d89ea2012..76f345fdf 100644
--- a/flink-cyber/flink-indexing/flink-indexing-hive/pom.xml
+++ b/flink-cyber/flink-indexing/flink-indexing-hive/pom.xml
@@ -104,6 +104,14 @@
             <version>${hive.version}</version>
             <scope>compile</scope>
             <exclusions>
+                <exclusion>
+                    <groupId>org.codehaus.janino</groupId>
+                    <artifactId>commons-compiler</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.codehaus.janino</groupId>
+                    <artifactId>janino</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>org.apache.calcite</groupId>
                     <artifactId>*</artifactId>
@@ -116,6 +124,106 @@
                     <groupId>commons-cli</groupId>
                     <artifactId>commons-cli</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.apache.hive</groupId>
+                    <artifactId>hive-vector-code-gen</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.hive</groupId>
+                    <artifactId>hive-llap-tez</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.hive</groupId>
+                    <artifactId>hive-shims</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>commons-codec</groupId>
+                    <artifactId>commons-codec</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>commons-httpclient</groupId>
+                    <artifactId>commons-httpclient</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.logging.log4j</groupId>
+                    <artifactId>log4j-slf4j-impl</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.antlr</groupId>
+                    <artifactId>antlr-runtime</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.antlr</groupId>
+                    <artifactId>ST4</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.ant</groupId>
+                    <artifactId>ant</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.commons</groupId>
+                    <artifactId>commons-compress</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.ivy</groupId>
+                    <artifactId>ivy</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.zookeeper</groupId>
+                    <artifactId>zookeeper</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.curator</groupId>
+                    <artifactId>apache-curator</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.curator</groupId>
+                    <artifactId>curator-framework</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.codehaus.groovy</groupId>
+                    <artifactId>groovy-all</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.calcite</groupId>
+                    <artifactId>calcite-core</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.calcite</groupId>
+                    <artifactId>calcite-druid</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.calcite.avatica</groupId>
+                    <artifactId>avatica</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.calcite</groupId>
+                    <artifactId>calcite-avatica</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>com.google.code.gson</groupId>
+                    <artifactId>gson</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>stax</groupId>
+                    <artifactId>stax-api</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>com.google.guava</groupId>
+                    <artifactId>guava</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>apache-log4j-extras</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-log4j12</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
diff --git a/flink-cyber/flink-indexing/flink-indexing-hive/src/main/java/com/cloudera/cyber/indexing/hive/tableapi/TableApiAbstractJob.java b/flink-cyber/flink-indexing/flink-indexing-hive/src/main/java/com/cloudera/cyber/indexing/hive/tableapi/TableApiAbstractJob.java
index c2243f0a2..c9e8116d5 100644
--- a/flink-cyber/flink-indexing/flink-indexing-hive/src/main/java/com/cloudera/cyber/indexing/hive/tableapi/TableApiAbstractJob.java
+++ b/flink-cyber/flink-indexing/flink-indexing-hive/src/main/java/com/cloudera/cyber/indexing/hive/tableapi/TableApiAbstractJob.java
@@ -172,7 +172,8 @@ protected TableDescriptor.Builder fillTableOptions(TableDescriptor.Builder build
                 .option("partition.time-extractor.timestamp-pattern", "$dt $hr:00:00")
                 .option("sink.partition-commit.trigger", "process-time")
                 .option("sink.partition-commit.delay", "1 h")
-                .option("sink.partition-commit.policy.kind", "metastore,success-file");
+                .option("sink.partition-commit.policy.kind", "metastore,success-file")
+                .option("hive.storage.file-format", "orc");
     }
 
     private StreamTableEnvironment getTableEnvironment() {
diff --git a/flink-cyber/flink-indexing/flink-indexing-hive/src/main/java/com/cloudera/cyber/indexing/hive/util/AvroSchemaUtil.java b/flink-cyber/flink-indexing/flink-indexing-hive/src/main/java/com/cloudera/cyber/indexing/hive/util/AvroSchemaUtil.java
index 563d92288..413638750 100644
--- a/flink-cyber/flink-indexing/flink-indexing-hive/src/main/java/com/cloudera/cyber/indexing/hive/util/AvroSchemaUtil.java
+++ b/flink-cyber/flink-indexing/flink-indexing-hive/src/main/java/com/cloudera/cyber/indexing/hive/util/AvroSchemaUtil.java
@@ -1,5 +1,6 @@
 package com.cloudera.cyber.indexing.hive.util;
 
+import com.cloudera.cyber.avro.AvroSchemas;
 import com.cloudera.cyber.indexing.TableColumnDto;
 import org.apache.avro.LogicalTypes;
 import org.apache.avro.Schema;
@@ -28,7 +29,8 @@ public static Schema convertToAvro(List<TableColumnDto> tableColumnList) {
 
     //method that converts from flink Schema to avro Schema
     public static Schema convertToAvro(ResolvedSchema schema) {
-        SchemaBuilder.FieldAssembler<Schema> fieldAssembler = SchemaBuilder.record("base").fields();
+        SchemaBuilder.FieldAssembler<Schema> fieldAssembler = AvroSchemas.createRecordBuilder("com.cloudera.cyber","base")
+                .fields();
 
         for (Column col : schema.getColumns()) {
             fieldAssembler = fieldAssembler.name(col.getName()).type().optional().type(AvroSchemaUtil.convertTypeToAvro(col.getName(), col.getDataType().getLogicalType()));
@@ -43,7 +45,11 @@ public static void putRowIntoAvro(Row row, GenericRecord record, String fieldNam
         if (row == null) {
             value = null;
         } else {
+            try {
             value = convertToAvroObject(record.getSchema().getField(avroFieldName).schema(), row.getField(fieldName));
+            } catch (Exception e) {
+                throw new RuntimeException(String.format("Error converting avro field %s", avroFieldName), e);
+            }
         }
         record.put(avroFieldName, value);
         System.out.println("fieldName: " + fieldName + " value: " + value);