diff --git a/plugin/src/main/java/org/elasticsearch/xpack/ml/job/persistence/ElasticsearchMappings.java b/plugin/src/main/java/org/elasticsearch/xpack/ml/job/persistence/ElasticsearchMappings.java
index 7c39d90e2ec..e423a5c406b 100644
--- a/plugin/src/main/java/org/elasticsearch/xpack/ml/job/persistence/ElasticsearchMappings.java
+++ b/plugin/src/main/java/org/elasticsearch/xpack/ml/job/persistence/ElasticsearchMappings.java
@@ -63,6 +63,7 @@ public class ElasticsearchMappings {
     static final String PROPERTIES = "properties";
     static final String TYPE = "type";
     static final String DYNAMIC = "dynamic";
+    static final String FIELDS = "fields";
 
     /**
      * Name of the custom 'all' field for results
@@ -85,6 +86,8 @@ public class ElasticsearchMappings {
     static final String LONG = "long";
     static final String TEXT = "text";
 
+    static final String RAW = "raw";
+
     private ElasticsearchMappings() {
     }
 
@@ -657,6 +660,11 @@ public class ElasticsearchMappings {
                             .endObject()
                             .startObject(AuditMessage.MESSAGE.getPreferredName())
                                 .field(TYPE, TEXT)
+                                .startObject(FIELDS)
+                                    .startObject(RAW)
+                                        .field(TYPE, KEYWORD)
+                                    .endObject()
+                                .endObject()
                             .endObject()
                             .startObject(AuditMessage.TIMESTAMP.getPreferredName())
                                 .field(TYPE, DATE)