Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[8.12] [Bug][Investigations] - Fix slow timeline queries (elastic#176838
) (elastic#176956) # Backport This will backport the following commits from `main` to `8.12`: - [[Bug][Investigations] - Fix slow timeline queries (elastic#176838)](elastic#176838) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Michael Olorunnisola","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-02-14T21:02:20Z","message":"[Bug][Investigations] - Fix slow timeline queries (elastic#176838)\n\n## Summary\r\n\r\n**Version Affected: 8.11.x, 8.12.0, 8.12.1**\r\n\r\n### Background\r\n\r\nThe ID field necessary to track long running timeline search strategy\r\nqueries was no longer being passed to ES search after work in 8.11. This\r\nled to what looked like long running timeline queries, but in reality\r\nwere queries being repeated due to the ID not being tracked. This pr\r\nre-introduces the ID field necessary for long running timeline search\r\nstrategies in security solution\r\n\r\n**Views Affected:**\r\n - Timeline tabs (query, correlation, pinned)\r\n - Explore events tables (hosts, users, network)\r\n - Rule preview table\r\n \r\n\r\nPre-fix:\r\n\r\nObserver the changing ID's for the `timelineSearchStrategy` `eventsAll`\r\nqueries.\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/17211684/5731d310-d3ed-452d-8c34-783b2cfe76e1\r\n\r\n\r\nPost-fix:\r\n\r\nObserver the same ID for the `timelineSearchStrategy` `eventsAll`\r\nqueries.\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/17211684/a20d4b28-2748-4475-a257-96133bb8efc7\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <[email protected]>","sha":"68bdd7cb275bdcbc41c0b6bba86a56d954fd5496","branchLabelMapping":{"^v8.14.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","Team:Threat Hunting:Investigations","v8.12.2","v8.14.0"],"title":"[Bug][Investigations] - Fix slow timeline queries","number":176838,"url":"https://github.com/elastic/kibana/pull/176838","mergeCommit":{"message":"[Bug][Investigations] - Fix slow timeline queries (elastic#176838)\n\n## Summary\r\n\r\n**Version Affected: 8.11.x, 8.12.0, 8.12.1**\r\n\r\n### Background\r\n\r\nThe ID field necessary to track long running timeline search strategy\r\nqueries was no longer being passed to ES search after work in 8.11. This\r\nled to what looked like long running timeline queries, but in reality\r\nwere queries being repeated due to the ID not being tracked. This pr\r\nre-introduces the ID field necessary for long running timeline search\r\nstrategies in security solution\r\n\r\n**Views Affected:**\r\n - Timeline tabs (query, correlation, pinned)\r\n - Explore events tables (hosts, users, network)\r\n - Rule preview table\r\n \r\n\r\nPre-fix:\r\n\r\nObserver the changing ID's for the `timelineSearchStrategy` `eventsAll`\r\nqueries.\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/17211684/5731d310-d3ed-452d-8c34-783b2cfe76e1\r\n\r\n\r\nPost-fix:\r\n\r\nObserver the same ID for the `timelineSearchStrategy` `eventsAll`\r\nqueries.\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/17211684/a20d4b28-2748-4475-a257-96133bb8efc7\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <[email protected]>","sha":"68bdd7cb275bdcbc41c0b6bba86a56d954fd5496"}},"sourceBranch":"main","suggestedTargetBranches":["8.12"],"targetPullRequestStates":[{"branch":"8.12","label":"v8.12.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.14.0","branchLabelMappingKey":"^v8.14.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/176838","number":176838,"mergeCommit":{"message":"[Bug][Investigations] - Fix slow timeline queries (elastic#176838)\n\n## Summary\r\n\r\n**Version Affected: 8.11.x, 8.12.0, 8.12.1**\r\n\r\n### Background\r\n\r\nThe ID field necessary to track long running timeline search strategy\r\nqueries was no longer being passed to ES search after work in 8.11. This\r\nled to what looked like long running timeline queries, but in reality\r\nwere queries being repeated due to the ID not being tracked. This pr\r\nre-introduces the ID field necessary for long running timeline search\r\nstrategies in security solution\r\n\r\n**Views Affected:**\r\n - Timeline tabs (query, correlation, pinned)\r\n - Explore events tables (hosts, users, network)\r\n - Rule preview table\r\n \r\n\r\nPre-fix:\r\n\r\nObserver the changing ID's for the `timelineSearchStrategy` `eventsAll`\r\nqueries.\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/17211684/5731d310-d3ed-452d-8c34-783b2cfe76e1\r\n\r\n\r\nPost-fix:\r\n\r\nObserver the same ID for the `timelineSearchStrategy` `eventsAll`\r\nqueries.\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/17211684/a20d4b28-2748-4475-a257-96133bb8efc7\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <[email protected]>","sha":"68bdd7cb275bdcbc41c0b6bba86a56d954fd5496"}}]}] BACKPORT--> Co-authored-by: Michael Olorunnisola <[email protected]>
- Loading branch information