From b1753f86f91b8345151f16de7eb9a06d2145fbe9 Mon Sep 17 00:00:00 2001
From: Corey Ogburn <corey.ogburn@securityonionsolutions.com>
Date: Wed, 30 Jul 2025 13:14:09 -0600
Subject: [PATCH] New Message Structure

---
 .../component/so/assistant-mappings.json      | 50 ++++++++++++++++++-
 1 file changed, 49 insertions(+), 1 deletion(-)

diff --git a/salt/elasticsearch/templates/component/so/assistant-mappings.json b/salt/elasticsearch/templates/component/so/assistant-mappings.json
index f6f552465..89a907165 100644
--- a/salt/elasticsearch/templates/component/so/assistant-mappings.json
+++ b/salt/elasticsearch/templates/component/so/assistant-mappings.json
@@ -23,7 +23,7 @@
 							"type": "object",
 							"enabled": false
 						},
-						"conversation_id": {
+						"sessionId": {
 							"ignore_above": 1024,
 							"type": "keyword"
 						},
@@ -37,6 +37,54 @@
 						"userId": {
 							"ignore_above": 1024,
 							"type": "keyword"
+						},
+						"message": {
+							"properties": {
+								"id": {
+									"ignore_above": 1024,
+									"type": "keyword"
+								},
+								"type": {
+									"ignore_above": 1024,
+									"type": "keyword"
+								},
+								"role": {
+									"ignore_above": 1024,
+									"type": "keyword"
+								},
+								"model": {
+									"ignore_above": 1024,
+									"type": "keyword"
+								},
+								"contentStr": {
+									"type": "text"
+								},
+								"contentBlocks": {
+									"type": "nested",
+									"enabled": false
+								},
+								"stopReason": {
+									"ignore_above": 1024,
+									"type": "keyword"
+								},
+								"stopSequence": {
+									"ignore_above": 1024,
+									"type": "keyword"
+								},
+								"usage": {
+									"properties": {
+										"input_tokens": {
+											"type": "long"
+										},
+										"output_tokens": {
+											"type": "long"
+										},
+										"credits": {
+											"type": "long"
+										}
+									}
+								}
+							}
 						}
 					}
 				}