Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[RAM] Fix rule log aggregations when filtering >1k logs (elastic#172228)
## Summary Fixes elastic#171409 This fixes weird behavior when attempting to filter more than 1000 rule execution logs. The execution log aggregator had two problems: - It had a max bucket limit of 1000, while the KPI agg had a max bucket limit of 10000, leading to inconsistent results - For pagination, it reported the total number of logs by using a cardinality aggregator, which wasn't subject to any bucket limit at all The endpoint responds with a `total` (the cardinality) and an array of `data` (a paginated slice of the aggregated logs). The way the data table UI works is that it takes the `total` value, caps it at 1000, and then generates that many blank rows to fill with whatever's in the `data` array. So as seen in the issue, we could easily run into a situation where: 1. User enters a filter query that last appeared more than 1000 logs ago 2. The cardinality agg accurately reports the number of logs that should be fetched, and generates enough blank rows for these logs 3. The actual execution log agg hits the 1000 bucket limit, and returns an empty `data` array This PR fixes this by using a bucket sum aggregation to determine the data table's `total` instead of a cardinality aggregation. It also ups the bucket limit from 1000 to 10000, to match the bucket limit from the summary KPI endpoint. This prevents a situation where: 1. User enters a filter query that last appeared in <1000 logs, but more than 1000 logs ago 2. Summary KPI widget, with a bucket limit of 10000, accurately displays a count of the <1000 logs this query matches 3. The data table is empty because the execution log bucket limit tops out at 1000 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Xavier Mouligneau <xavier.mouligneau@elastic.co>
- Loading branch information