fix 400 error on initial signals search

elastic · Jul 2, 2020 · e15a263 · e15a263
1 parent 335c9bb
commit e15a263
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/x-pack/plugins/security_solution/public/alerts/components/alerts_info/query.dsl.ts b/x-pack/plugins/security_solution/public/alerts/components/alerts_info/query.dsl.ts
@@ -10,6 +10,7 @@ export const buildLastAlertsQuery = (ruleId: string | undefined | null) => {
       bool: { should: [{ match: { 'signal.status': 'open' } }], minimum_should_match: 1 },
     },
   ];
+
   return {
     aggs: {
       lastSeen: { max: { field: '@timestamp' } },
@@ -30,7 +31,7 @@ export const buildLastAlertsQuery = (ruleId: string | undefined | null) => {
             : queryFilter,
       },
     },
-    size: 0,
+    size: 1,
     track_total_hits: true,
   };
 };