Timestamp fixes

elastic · Nov 25, 2020 · 2c61c26 · 2c61c26
1 parent fe956ad
commit 2c61c26
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_signal.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_signal.ts
@@ -96,7 +96,7 @@ export const buildSignal = (docs: BaseSignalHit[], rule: RulesSchema): Signal =>
 export const additionalSignalFields = (doc: BaseSignalHit) => {
   return {
     parent: buildParent(removeClashes(doc)),
-    original_time: doc._source['@timestamp'],
+    original_time: doc._source['@timestamp'], // This field has already been replaced with timestampOverride, if provided.
     original_event: doc._source.event ?? undefined,
     threshold_result: doc._source.threshold_result,
     original_signal:

diff --git a/...k/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/...k/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -331,7 +331,7 @@ export const signalRulesAlertType = ({
                       },
                       {
                         range: {
-                          '@timestamp': {
+                          [timestampOverride ?? '@timestamp']: {
                             lte: bucket.lastSignalTimestamp.value_as_string,
                           },
                         },