github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Security Solution][Alerts] Don't use maxSignals for topHits agg size (#146564)

Browse source 
## Summary

Addresses https://github.com/elastic/kibana/issues/146494

We only need the first document from the bucket to create the alert, not
`maxSignals` documents. If `maxSignals` was greater than 100, this
caused an error in the search.
This commit is contained in:
Marshall Main 2022-11-30 07:50:16 -08:00 • committed by GitHub
parent 9ad78b244a
commit d659ee6f2e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
x-pack/plugins/security_solution/server/lib/detection_engine/signals/alert_suppression/__snapshots__/build_group_by_field_aggregation.test.ts.snap generated
View file

@ -16,7 +16,7 @@ Object {
},
"topHits": Object {
"top_hits": Object {
"size": 100,
"size": 1,
"sort": Array [
Object {
"kibana.combined_timestamp": Object {

2
x-pack/plugins/security_solution/server/lib/detection_engine/signals/alert_suppression/build_group_by_field_aggregation.ts
View file

@ -31,7 +31,7 @@ export const buildGroupByFieldAggregation = ({
aggs: {
topHits: {
top_hits: {
size: maxSignals,
size: 1,
sort: [
{
[aggregatableTimestampField]: {