# How to include field data from multiple documents in \`Create a model response\` API request?

**URL:** <https://discuss.elastic.co/t/how-to-include-field-data-from-multiple-documents-in-create-a-model-response-api-request/382129>\
**Category:** Elastic Security\
**Created:** [September 22, 2025, 6:59pm UTC](https://discuss.elastic.co/t/how-to-include-field-data-from-multiple-documents-in-create-a-model-response-api-request/382129 "2025-09-22T18:59:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![logalicious](https://avatars.discourse-cdn.com/v4/letter/l/dfb087/32.png) [@logalicious](https://discuss.elastic.co/u/logalicious)\
**Post date:** [September 22, 2025, 6:59pm UTC](https://discuss.elastic.co/t/how-to-include-field-data-from-multiple-documents-in-create-a-model-response-api-request/382129/1 "2025-09-22T18:59:47Z")

</div>

I am trying to use the [Create a model response](https://www.elastic.co/docs/api/doc/kibana/operation/operation-chatcomplete) API to create an AI assistant response that summarizes many alerts at once. When I include multiple messages that each contain field data from security alerts, the Security AI assistant only provides a response for the last alert. I am unable to get it to take the other messages into consideration.

Do you know if it is possible for the Security AI assistant to consume multiple messages each with their own event/alert context?

Here is what I tried:

API: **/api/security\_ai\_assistant/chat/complete**

Request example:

```auto
{
    "persist": False,
    "promptId": promptId,
    "messages": [
        { 
            "role": "user",
            "data": {
                "user.name": "Sample User",
                "source.geo.location": "Canada",
                "source.ip": "1.1.1.1",
                "process.name": "hacker.exe"
            },
            "content": """
                Summarize the event 
            """,
            "fields_to_anonymize": [
                "user.name",
                "source.ip"
            ]
        },
        { 
            "role": "user",
            "data": {
                "user.name": "Sample User 2",
                "source.geo.location": "United States",
                "source.ip": "8.8.8.8",
                "process.name": "word.exe"
            },
            "content": """
                Summarize the event 
            """,
            "fields_to_anonymize": [
                "user.name",
                "source.ip"
            ]
        },

    ],
    "connectorId": connectorId,
}

```

The response is something like:

_The event indicates a process named `word.exe` was executed. The source IP associated with this event is `77a49151-a05e-4b93-bb99-7530f8e4a580`, and the user responsible for the action is identified as `7a89258b-9865-49fa-8cfe-0f42ce50244e`. This could potentially be an anomalous or malicious activity, depending on the context and further investigation into the IP and user details._

The response fails to provide any context or details about the first message included.

---

<div class="post-metadata">

**Author:** ![logalicious](https://avatars.discourse-cdn.com/v4/letter/l/dfb087/32.png) [@logalicious](https://discuss.elastic.co/u/logalicious)\
**Post date:** [September 23, 2025, 6:51pm UTC](https://discuss.elastic.co/t/how-to-include-field-data-from-multiple-documents-in-create-a-model-response-api-request/382129/2 "2025-09-23T18:51:21Z")

</div>

So you can just shove everything into the “content” field and format the text into a good prompt. It works, but you have to anonymize the fields and deanonymize them manually before you send the request.

My payload looks like:

```auto
{
	"persist": False,
	"promptId": promptId,
	"messages": [
		{ 
			"role": "user",
			"content": f"{anonymized_alert_list}\n\n\n\nYou are a senior SOC analyst reviewing SIEM alerts. Interpret the alert(s) below using expert-level judgment and explain what it means in natural language.",
		}
	],
	"connectorId": connectorId,
}

```