diff --git a/x-pack/plugins/apm/common/service_groups.ts b/x-pack/plugins/apm/common/service_groups.ts
index f922126c32e34e5..9a7869fddf8740b 100644
--- a/x-pack/plugins/apm/common/service_groups.ts
+++ b/x-pack/plugins/apm/common/service_groups.ts
@@ -59,7 +59,7 @@ export function validateServiceGroupKuery(kuery: string) {
         isValid: false,
         isParsingError: false,
         message: i18n.translate(
-          'xpack.apm.serviceGroups.selectServicesForm.title',
+          'xpack.apm.serviceGroups.invalidFields.message',
           {
             defaultMessage:
               'Query filter for service group does not support fields [{unsupportedFieldNames}]',
diff --git a/x-pack/plugins/apm/public/components/app/service_groups/service_group_save/select_services.tsx b/x-pack/plugins/apm/public/components/app/service_groups/service_group_save/select_services.tsx
index 9143cd4a9a4ac36..27a8a7e38de5e20 100644
--- a/x-pack/plugins/apm/public/components/app/service_groups/service_group_save/select_services.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_groups/service_group_save/select_services.tsx
@@ -83,9 +83,7 @@ export function SelectServices({
     const { isValid, isParsingError, message } =
       validateServiceGroupKuery(stagedKuery);
     if (isValid || isParsingError) {
-      if (kueryValidationMessage !== '') {
-        setKueryValidationMessage('');
-      }
+      setKueryValidationMessage('');
     } else {
       setKueryValidationMessage(message);
     }
diff --git a/x-pack/plugins/apm/server/routes/alerts/rule_types/anomaly/get_anomalous_event_source_fields.ts b/x-pack/plugins/apm/server/routes/alerts/rule_types/anomaly/get_anomalous_event_source_fields.ts
index 4a81be7381fb43e..b972e9d87a4781e 100644
--- a/x-pack/plugins/apm/server/routes/alerts/rule_types/anomaly/get_anomalous_event_source_fields.ts
+++ b/x-pack/plugins/apm/server/routes/alerts/rule_types/anomaly/get_anomalous_event_source_fields.ts
@@ -35,6 +35,7 @@ export async function getAnomalousEventSourceFields({
     index,
     body: {
       size: 0,
+      track_total_hits: false,
       query: {
         bool: {
           filter: [
diff --git a/x-pack/plugins/apm/server/routes/alerts/rule_types/error_count/register_error_count_rule_type.ts b/x-pack/plugins/apm/server/routes/alerts/rule_types/error_count/register_error_count_rule_type.ts
index 34cdb0d2173722b..56aface32d7fb4a 100644
--- a/x-pack/plugins/apm/server/routes/alerts/rule_types/error_count/register_error_count_rule_type.ts
+++ b/x-pack/plugins/apm/server/routes/alerts/rule_types/error_count/register_error_count_rule_type.ts
@@ -31,6 +31,7 @@ import {
   PROCESSOR_EVENT,
   SERVICE_ENVIRONMENT,
   SERVICE_NAME,
+  TRANSACTION_DURATION,
 } from '../../../../../common/elasticsearch_fieldnames';
 import { environmentQuery } from '../../../../../common/utils/environment_query';
 import { getApmIndices } from '../../../settings/apm_indices/get_apm_indices';
@@ -123,7 +124,8 @@ export function registerErrorCountRuleType({
                       missing: ENVIRONMENT_NOT_DEFINED.value,
                     },
                   ],
-                  size: 10000,
+                  size: 1000,
+                  order: { [TRANSACTION_DURATION]: 'desc' as const },
                 },
                 aggs: getSourceFieldsAgg(),
               },
diff --git a/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.test.ts b/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.test.ts
index 4d8b91636fb6c71..2b159e7acc0d289 100644
--- a/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.test.ts
+++ b/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.test.ts
@@ -24,10 +24,10 @@ describe('registerTransactionDurationRuleType', () => {
         },
       },
       aggregations: {
-        environments: {
+        series: {
           buckets: [
             {
-              key: 'ENVIRONMENT_NOT_DEFINED',
+              key: ['opbeans-java', 'ENVIRONMENT_NOT_DEFINED', 'request'],
               avgLatency: {
                 value: 5500000,
               },
diff --git a/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.ts b/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.ts
index 38bfa9018e31c36..467e842b55c202f 100644
--- a/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.ts
+++ b/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.ts
@@ -31,6 +31,7 @@ import {
   SERVICE_NAME,
   TRANSACTION_TYPE,
   SERVICE_ENVIRONMENT,
+  TRANSACTION_DURATION,
 } from '../../../../../common/elasticsearch_fieldnames';
 import {
   ENVIRONMENT_NOT_DEFINED,
@@ -159,7 +160,8 @@ export function registerTransactionDurationRuleType({
                   },
                   { field: TRANSACTION_TYPE },
                 ],
-                size: 10000,
+                size: 1000,
+                order: { [TRANSACTION_DURATION]: 'desc' as const },
               },
               aggs: {
                 ...averageOrPercentileAgg({
diff --git a/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_error_rate/register_transaction_error_rate_rule_type.ts b/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_error_rate/register_transaction_error_rate_rule_type.ts
index fbc7f7aa31bc7af..5514d160f49b76f 100644
--- a/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_error_rate/register_transaction_error_rate_rule_type.ts
+++ b/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_error_rate/register_transaction_error_rate_rule_type.ts
@@ -34,6 +34,7 @@ import {
   SERVICE_ENVIRONMENT,
   SERVICE_NAME,
   TRANSACTION_TYPE,
+  TRANSACTION_DURATION,
 } from '../../../../../common/elasticsearch_fieldnames';
 import { EventOutcome } from '../../../../../common/event_outcome';
 import { asDecimalOrInteger } from '../../../../../common/utils/formatters';
@@ -154,7 +155,8 @@ export function registerTransactionErrorRateRuleType({
                     },
                     { field: TRANSACTION_TYPE },
                   ],
-                  size: 10000,
+                  size: 1000,
+                  order: { [TRANSACTION_DURATION]: 'desc' as const },
                 },
                 aggs: {
                   outcomes: {