diff --git a/src/main/java/org/opensearch/securityanalytics/transport/TransportCorrelateFindingAction.java b/src/main/java/org/opensearch/securityanalytics/transport/TransportCorrelateFindingAction.java index b7a906159..e79af28d3 100644 --- a/src/main/java/org/opensearch/securityanalytics/transport/TransportCorrelateFindingAction.java +++ b/src/main/java/org/opensearch/securityanalytics/transport/TransportCorrelateFindingAction.java @@ -261,7 +261,8 @@ public void onResponse(SearchResponse response) { } SearchHits hits = response.getHits(); - if (hits.getTotalHits().value == 1) { + // Detectors Index hits count could be more even if we fetch one + if (hits.getTotalHits().value >= 1 && hits.getHits().length > 0) { try { SearchHit hit = hits.getAt(0); @@ -272,6 +273,7 @@ public void onResponse(SearchResponse response) { Detector detector = Detector.docParse(xcp, hit.getId(), hit.getVersion()); joinEngine.onSearchDetectorResponse(detector, finding); } catch (IOException e) { + log.error("IOException for request {}", searchRequest.toString(), e); onFailures(e); } } else {