From b0584a4dc5358b75ce7c50564328a7a280fe2059 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Sat, 11 Apr 2026 15:22:50 -0500
Subject: [PATCH] only append "-mappings" to component template names as needed

---
 .../tools/sbin/so-elasticsearch-templates-load    | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/salt/elasticsearch/tools/sbin/so-elasticsearch-templates-load b/salt/elasticsearch/tools/sbin/so-elasticsearch-templates-load
index f44225ac6..3b5aa3707 100755
--- a/salt/elasticsearch/tools/sbin/so-elasticsearch-templates-load
+++ b/salt/elasticsearch/tools/sbin/so-elasticsearch-templates-load
@@ -98,6 +98,7 @@ check_heavynode_compatiable_index_template() {
 load_component_templates() {
     local printed_name="$1"
     local pattern="${ELASTICSEARCH_TEMPLATES_DIR}/component/$2"
+    local append_mappings="${3:-"false"}"
 
     # current state of nullglob shell option
     shopt -q nullglob && nullglob_set=1 || nullglob_set=0
@@ -106,7 +107,13 @@ load_component_templates() {
     echo -e "\nLoading $printed_name component templates...\n"
     for component in "$pattern"/*.json; do
         tmpl_name=$(basename "${component%.json}")
-        if ! load_template "_component_template/${tmpl_name}-mappings" "$component"; then
+
+        if [[ "$append_mappings" == "true" ]]; then
+            # avoid duplicating "-mappings" if it already exists in the component template filename
+            tmpl_name="${tmpl_name%-mappings}-mappings"
+        fi
+
+        if ! load_template "_component_template/${tmpl_name}" "$component"; then
             LOAD_FAILURES=$((LOAD_FAILURES + 1))
             LOAD_FAILURES_NAMES+=("$component")
         fi
@@ -138,9 +145,9 @@ if [[ "$FORCE" == "true" || ! -f "$SO_STATE_FILE_SUCCESS" ]]; then
         fi
     fi
 
-    load_component_templates "ECS" "ecs"
+    load_component_templates "ECS" "ecs" "true"
     load_component_templates "Elastic Agent" "elastic-agent"
-    load_component_templates "Security Onion" "securityonion"
+    load_component_templates "Security Onion" "so"
 
     component_templates=$(so-elasticsearch-component-templates-list)
     echo -e "Loading Security Onion index templates...\n"
@@ -187,4 +194,4 @@ else
 
     echo "Templates already loaded"
 
-fi
\ No newline at end of file
+fi