github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[TIP] Use runtime fields in aggregated indicators query (#140178)

Browse source
This commit is contained in:
Luke Gmys 2022-09-08 12:21:51 +02:00 • committed by GitHub
parent 4587bf7fc0
commit a3d39886de
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
x-pack/plugins/threat_intelligence/public/modules/indicators/hooks/use_aggregated_indicators.ts
View file

@ -23,6 +23,7 @@ import { calculateBarchartColumnTimeInterval } from '../../../common/utils/dates
import { useKibana } from '../../../hooks/use_kibana';
import { DEFAULT_TIME_RANGE } from '../../query_bar/hooks/use_filters/utils';
import { useSourcererDataView } from './use_sourcerer_data_view';
import { threatIndicatorNamesOriginScript, threatIndicatorNamesScript } from '../lib/display_name';
export interface UseAggregatedIndicatorsParam {
/**
@ -173,6 +174,20 @@ export const useAggregatedIndicators = ({
fields: [TIMESTAMP_FIELD, field], // limit the response to only the fields we need
size: 0, // we don't need hits, just aggregations
query: queryToExecute,
runtime_mappings: {
'threat.indicator.name': {
type: 'keyword',
script: {
source: threatIndicatorNamesScript(),
},
},
'threat.indicator.name_origin': {
type: 'keyword',
script: {
source: threatIndicatorNamesOriginScript(),
},
},
},
},
},
},