Skip to content

Commit

Permalink
[Security Solution] Fix timeline dynamic batching (#204034)
Browse files Browse the repository at this point in the history
## Summary

Handles :

### Issue with Batches
- #201405
- Timeline had a bug where if users fetched multiple batches and then if
user adds a new column, the value of this new columns will only be
fetched for the latest batch and not old batches.
- This PR fixes that ✅ by cumulatively fetching the data for old batches
till current batch `iff a new column has been added`.
- For example, if user has already fetched the 3rd batch, data for
1st,2nd and 3rd will be fetched together when a column has been added,
otherwise, data will be fetched incrementally.

### Issue with Elastic search limit

- Elastic search has a limit of 10K hits at max but we throw error at
10K which should be allowed.
    - Error should be thrown at anything `>10K`. 10001 for example.
    - ✅  This PR fixes that just for timeline by allowing 10K hits.

### Removal of obsolete code

Below files related to old Timeline code are removed as well:
-
x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.test.tsx
-
x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx

---------

Co-authored-by: Philippe Oberti <[email protected]>
  • Loading branch information
logeekal and PhilippeOberti committed Jan 7, 2025
1 parent ef6e96e commit f2c4f5e
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -184,7 +184,7 @@ export const QueryTabContentComponent: React.FC<Props> = ({
indexNames: selectedPatterns,
language: kqlQuery.language,
limit: sampleSize,
runtimeMappings: sourcererDataView.runtimeFieldMap as RunTimeMappings,
runtimeMappings: sourcererDataView?.runtimeFieldMap as RunTimeMappings,
skip: !canQueryTimeline,
sort: timelineQuerySortField,
startDate: start,
Expand Down

0 comments on commit f2c4f5e

Please sign in to comment.