Skip to content

[8.18] Use msearch to fetch the alerts for maintenance windows with scoped query (#221702)#222490

Merged
ersin-erdal merged 4 commits intoelastic:8.18from
ersin-erdal:backport/8.18/pr-221702
Jun 4, 2025
Merged

[8.18] Use msearch to fetch the alerts for maintenance windows with scoped query (#221702)#222490
ersin-erdal merged 4 commits intoelastic:8.18from
ersin-erdal:backport/8.18/pr-221702

Conversation

@ersin-erdal
Copy link
Contributor

Backport

This will backport the following commits from main to 8.18:

Questions ?

Please refer to the Backport tool documentation

…uery (elastic#221702)

Currently we use a search with a `top_hits` aggregation to get the
alerts filtered with the scoped queries of the active maintenance
windows. But since `top_hits` aggregation has a fixed limit of 100 hits
we cannot use our max alerts limit to get all the alerts an execution
can generate.

This PR replaces `search` with `msearch` and removes the aggregation
from the search query so we can use the maxAlerts limit for the response
size.

(cherry picked from commit 1343bfe)

# Conflicts:
#	x-pack/platform/plugins/shared/alerting/server/alerts_client/alerts_client.test.ts
#	x-pack/platform/plugins/shared/alerting/server/alerts_client/alerts_client.ts
#	x-pack/platform/plugins/shared/alerting/server/alerts_client/lib/get_summarized_alerts_query.ts
@ersin-erdal ersin-erdal added the backport This PR is a backport of another PR label Jun 3, 2025
@ersin-erdal ersin-erdal enabled auto-merge (squash) June 3, 2025 23:45
@elasticmachine
Copy link
Contributor

⏳ Build in-progress, with failures

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #67 / Alerting builtin alertTypes circuit_breakers index threshold rule that hits max alerts circuit breaker persist existing alerts to next execution if circuit breaker is hit
  • [job] [logs] FTR Configs #67 / Alerting builtin alertTypes circuit_breakers index threshold rule that hits max alerts circuit breaker persist existing alerts to next execution if circuit breaker is hit

History

@ersin-erdal ersin-erdal merged commit b1433b8 into elastic:8.18 Jun 4, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

4 participants