[Security Solution][Alerts] Don't use maxSignals for topHits agg size (…

…elastic#146564) ## Summary Addresses elastic#146494 We only need the first document from the bucket to create the alert, not `maxSignals` documents. If `maxSignals` was greater than 100, this caused an error in the search.
kibanamachine · Nov 30, 2022 · d659ee6 · d659ee6
1 parent 9ad78b2
commit d659ee6
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/...ine/signals/alert_suppression/__snapshots__/build_group_by_field_aggregation.test.ts.snap b/...ine/signals/alert_suppression/__snapshots__/build_group_by_field_aggregation.test.ts.snap
diff --git a/...server/lib/detection_engine/signals/alert_suppression/build_group_by_field_aggregation.ts b/...server/lib/detection_engine/signals/alert_suppression/build_group_by_field_aggregation.ts
@@ -31,7 +31,7 @@ export const buildGroupByFieldAggregation = ({
     aggs: {
       topHits: {
         top_hits: {
-          size: maxSignals,
+          size: 1,
           sort: [
             {
               [aggregatableTimestampField]: {