diff --git a/x-pack/plugins/security_solution/server/usage/queries/get_alerts.ts b/x-pack/plugins/security_solution/server/usage/queries/get_alerts.ts index 1514760b0b251..4c0946242b005 100644 --- a/x-pack/plugins/security_solution/server/usage/queries/get_alerts.ts +++ b/x-pack/plugins/security_solution/server/usage/queries/get_alerts.ts @@ -11,6 +11,7 @@ import type { SearchRequest, } from '@elastic/elasticsearch/lib/api/types'; import type { ElasticsearchClient, Logger } from 'kibana/server'; +import { ALERT_RULE_UUID } from '@kbn/rule-data-utils'; import type { AlertBucket, AlertAggs } from '../types'; export interface GetAlertsOptions { @@ -37,7 +38,7 @@ export const getAlerts = async ({ index: signalsIndex, keep_alive: keepAlive, }) - ).body.id; + ).id; let after: AggregationsCompositeAggregation['after']; let buckets: AlertBucket[] = []; @@ -52,7 +53,7 @@ export const getAlerts = async ({ { detectionAlerts: { terms: { - field: 'kibana.alert.rule.uuid', + field: ALERT_RULE_UUID, }, }, }, @@ -83,7 +84,7 @@ export const getAlerts = async ({ logger.debug( `Getting alerts with point in time (PIT) query: ${JSON.stringify(ruleSearchOptions)}` ); - const { body } = await esClient.search(ruleSearchOptions); + const body = await esClient.search(ruleSearchOptions); if (body.aggregations?.buckets?.buckets != null) { buckets = [...buckets, ...body.aggregations.buckets.buckets]; } diff --git a/x-pack/plugins/security_solution/server/usage/queries/utils/fetch_hits_with_pit.ts b/x-pack/plugins/security_solution/server/usage/queries/utils/fetch_hits_with_pit.ts index cc4d8d98df799..2d84cfe21179d 100644 --- a/x-pack/plugins/security_solution/server/usage/queries/utils/fetch_hits_with_pit.ts +++ b/x-pack/plugins/security_solution/server/usage/queries/utils/fetch_hits_with_pit.ts @@ -39,7 +39,7 @@ export const fetchHitsWithPit = async ({ index, keep_alive: '5m', }) - ).body.id; + ).id; let searchAfter: SortResults | undefined; let hits: Array> = []; @@ -56,7 +56,7 @@ export const fetchHitsWithPit = async ({ logger.debug( `Getting hits with point in time (PIT) query of: ${JSON.stringify(ruleSearchOptions)}` ); - const { body } = await esClient.search(ruleSearchOptions); + const body = await esClient.search(ruleSearchOptions); hits = [...hits, ...body.hits.hits]; searchAfter = body.hits.hits.length !== 0 ? body.hits.hits[body.hits.hits.length - 1].sort : undefined;