elastic · FrankHassanabad · Feb 11, 2021 · Feb 11, 2021
diff --git a/x-pack/plugins/security_solution/server/lib/hosts/query.detail_host.dsl.ts b/x-pack/plugins/security_solution/server/lib/hosts/query.detail_host.dsl.ts
@@ -39,13 +39,13 @@ export const buildHostOverviewQuery = ({
     allowNoIndices: true,
     index: defaultIndex,
     ignoreUnavailable: true,
+    track_total_hits: false,
     body: {
       aggregations: {
         ...buildFieldsTermAggregation(esFields.filter((field) => !['@timestamp'].includes(field))),
       },
       query: { bool: { filter } },
       size: 0,
-      track_total_hits: false,
     },
   };
 

diff --git a/x-pack/plugins/security_solution/server/lib/hosts/query.hosts.dsl.ts b/x-pack/plugins/security_solution/server/lib/hosts/query.hosts.dsl.ts
@@ -44,6 +44,7 @@ export const buildHostsQuery = ({
     allowNoIndices: true,
     index: defaultIndex,
     ignoreUnavailable: true,
+    track_total_hits: false,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
       aggregations: {
@@ -72,7 +73,6 @@ export const buildHostsQuery = ({
       },
       query: { bool: { filter } },
       size: 0,
-      track_total_hits: false,
     },
   };
 

diff --git a/x-pack/plugins/security_solution/server/lib/hosts/query.last_first_seen_host.dsl.ts b/x-pack/plugins/security_solution/server/lib/hosts/query.last_first_seen_host.dsl.ts
@@ -19,6 +19,7 @@ export const buildLastFirstSeenHostQuery = ({
     allowNoIndices: true,
     index: defaultIndex,
     ignoreUnavailable: true,
+    track_total_hits: false,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
       aggregations: {
@@ -27,7 +28,6 @@ export const buildLastFirstSeenHostQuery = ({
       },
       query: { bool: { filter } },
       size: 0,
-      track_total_hits: false,
     },
   };
 

diff --git a/...ty_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts b/...ty_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts
@@ -621,6 +621,7 @@ export const formattedSearchStrategyResponse = {
             'winlogbeat-*',
           ],
           ignoreUnavailable: true,
+          track_total_hits: false,
           body: {
             docvalue_fields: mockOptions.docValueFields,
             aggregations: {
@@ -656,7 +657,6 @@ export const formattedSearchStrategyResponse = {
               },
             },
             size: 0,
-            track_total_hits: false,
           },
         },
         null,
@@ -782,6 +782,7 @@ export const mockBuckets: HostAggEsItem = {
 
 export const expectedDsl = {
   allowNoIndices: true,
+  track_total_hits: false,
   body: {
     aggregations: {
       host_count: { cardinality: { field: 'host.name' } },
@@ -817,7 +818,6 @@ export const expectedDsl = {
     },
     docvalue_fields: mockOptions.docValueFields,
     size: 0,
-    track_total_hits: false,
   },
   ignoreUnavailable: true,
   index: [

diff --git a/...olution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts b/...olution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts
@@ -43,6 +43,7 @@ export const buildHostsQuery = ({
     allowNoIndices: true,
     index: defaultIndex,
     ignoreUnavailable: true,
+    track_total_hits: false,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
       aggregations: {
@@ -71,7 +72,6 @@ export const buildHostsQuery = ({
       },
       query: { bool: { filter } },
       size: 0,
-      track_total_hits: false,
     },
   };
 

diff --git a/...olution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts b/...olution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts
@@ -1311,6 +1311,7 @@ export const formattedSearchStrategyResponse = {
             'winlogbeat-*',
           ],
           ignoreUnavailable: true,
+          track_total_hits: false,
           body: {
             aggregations: {
               host_architecture: {
@@ -1387,7 +1388,6 @@ export const formattedSearchStrategyResponse = {
               },
             },
             size: 0,
-            track_total_hits: false,
           },
         },
         null,
@@ -1410,6 +1410,7 @@ export const expectedDsl = {
     'winlogbeat-*',
   ],
   ignoreUnavailable: true,
+  track_total_hits: false,
   body: {
     aggregations: {
       host_architecture: {
@@ -1645,6 +1646,5 @@ export const expectedDsl = {
       },
     },
     size: 0,
-    track_total_hits: false,
   },
 };
diff --git a/.../server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts b/.../server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts
@@ -36,13 +36,13 @@ export const buildHostDetailsQuery = ({
     allowNoIndices: true,
     index: defaultIndex,
     ignoreUnavailable: true,
+    track_total_hits: false,
     body: {
       aggregations: {
         ...buildFieldsTermAggregation(esFields.filter((field) => !['@timestamp'].includes(field))),
       },
       query: { bool: { filter } },
       size: 0,
-      track_total_hits: false,
     },
   };
 

diff --git a/...ecurity_solution/factory/hosts/kpi/authentications/query.hosts_kpi_authentications.dsl.ts b/...ecurity_solution/factory/hosts/kpi/authentications/query.hosts_kpi_authentications.dsl.ts
@@ -41,6 +41,7 @@ export const buildHostsKpiAuthenticationsQuery = ({
     index: defaultIndex,
     allowNoIndices: true,
     ignoreUnavailable: true,
+    track_total_hits: false,
     body: {
       aggs: {
         authentication_success: {
@@ -94,7 +95,6 @@ export const buildHostsKpiAuthenticationsQuery = ({
         },
       },
       size: 0,
-      track_total_hits: false,
     },
   };
 

diff --git a/...er/search_strategy/security_solution/factory/hosts/kpi/hosts/query.hosts_kpi_hosts.dsl.ts b/...er/search_strategy/security_solution/factory/hosts/kpi/hosts/query.hosts_kpi_hosts.dsl.ts
@@ -30,6 +30,7 @@ export const buildHostsKpiHostsQuery = ({
     index: defaultIndex,
     allowNoIndices: true,
     ignoreUnavailable: true,
+    track_total_hits: false,
     body: {
       aggregations: {
         hosts: {
@@ -57,7 +58,6 @@ export const buildHostsKpiHostsQuery = ({
         },
       },
       size: 0,
-      track_total_hits: false,
     },
   };
 

diff --git a/...strategy/security_solution/factory/hosts/kpi/unique_ips/query.hosts_kpi_unique_ips.dsl.ts b/...strategy/security_solution/factory/hosts/kpi/unique_ips/query.hosts_kpi_unique_ips.dsl.ts
@@ -30,6 +30,7 @@ export const buildHostsKpiUniqueIpsQuery = ({
     index: defaultIndex,
     allowNoIndices: true,
     ignoreUnavailable: true,
+    track_total_hits: false,
     body: {
       aggregations: {
         unique_source_ips: {
@@ -75,7 +76,6 @@ export const buildHostsKpiUniqueIpsQuery = ({
         },
       },
       size: 0,
-      track_total_hits: false,
     },
   };
 

diff --git a/...server/search_strategy/security_solution/factory/hosts/last_first_seen/__mocks__/index.ts b/...server/search_strategy/security_solution/factory/hosts/last_first_seen/__mocks__/index.ts
@@ -69,14 +69,14 @@ export const formattedSearchStrategyResponse = {
             'winlogbeat-*',
           ],
           ignoreUnavailable: true,
+          track_total_hits: false,
           body: {
             aggregations: {
               firstSeen: { min: { field: '@timestamp' } },
               lastSeen: { max: { field: '@timestamp' } },
             },
             query: { bool: { filter: [{ term: { 'host.name': 'siem-kibana' } }] } },
             size: 0,
-            track_total_hits: false,
           },
         },
         null,
@@ -100,13 +100,13 @@ export const expectedDsl = {
     'winlogbeat-*',
   ],
   ignoreUnavailable: true,
+  track_total_hits: false,
   body: {
     aggregations: {
       firstSeen: { min: { field: '@timestamp' } },
       lastSeen: { max: { field: '@timestamp' } },
     },
     query: { bool: { filter: [{ term: { 'host.name': 'siem-kibana' } }] } },
     size: 0,
-    track_total_hits: false,
   },
 };
diff --git a/...trategy/security_solution/factory/hosts/last_first_seen/query.last_first_seen_host.dsl.ts b/...trategy/security_solution/factory/hosts/last_first_seen/query.last_first_seen_host.dsl.ts
@@ -20,6 +20,7 @@ export const buildFirstLastSeenHostQuery = ({
     allowNoIndices: true,
     index: defaultIndex,
     ignoreUnavailable: true,
+    track_total_hits: false,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
       aggregations: {
@@ -28,7 +29,6 @@ export const buildFirstLastSeenHostQuery = ({
       },
       query: { bool: { filter } },
       size: 0,
-      track_total_hits: false,
     },
   };
 

diff --git a/...lution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts b/...lution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts
@@ -127,6 +127,7 @@ export const formattedSearchStrategyResponse = {
             'winlogbeat-*',
           ],
           ignoreUnavailable: true,
+          track_total_hits: false,
           body: {
             aggregations: {
               auditd_count: { filter: { term: { 'event.module': 'auditd' } } },
@@ -299,7 +300,6 @@ export const formattedSearchStrategyResponse = {
               },
             },
             size: 0,
-            track_total_hits: false,
           },
         },
         null,
@@ -339,6 +339,7 @@ export const expectedDsl = {
     'winlogbeat-*',
   ],
   ignoreUnavailable: true,
+  track_total_hits: false,
   body: {
     aggregations: {
       auditd_count: { filter: { term: { 'event.module': 'auditd' } } },
@@ -511,6 +512,5 @@ export const expectedDsl = {
       },
     },
     size: 0,
-    track_total_hits: false,
   },
 };
diff --git a/...erver/search_strategy/security_solution/factory/hosts/overview/query.overview_host.dsl.ts b/...erver/search_strategy/security_solution/factory/hosts/overview/query.overview_host.dsl.ts
@@ -31,6 +31,7 @@ export const buildOverviewHostQuery = ({
     allowNoIndices: true,
     index: defaultIndex,
     ignoreUnavailable: true,
+    track_total_hits: false,
     body: {
       aggregations: {
         auditd_count: {
@@ -289,7 +290,6 @@ export const buildOverviewHostQuery = ({
         },
       },
       size: 0,
-      track_total_hits: false,
     },
   };
 

diff --git a/...tion/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts b/...tion/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts
@@ -42,6 +42,7 @@ export const formattedAlertsSearchStrategyResponse: MatrixHistogramStrategyRespo
           ],
           allowNoIndices: true,
           ignoreUnavailable: true,
+          track_total_hits: true,
           body: {
             aggregations: {
               alertsGroup: {
@@ -113,7 +114,6 @@ export const formattedAlertsSearchStrategyResponse: MatrixHistogramStrategyRespo
               },
             },
             size: 0,
-            track_total_hits: true,
           },
         },
         null,
@@ -127,6 +127,7 @@ export const formattedAlertsSearchStrategyResponse: MatrixHistogramStrategyRespo
 
 export const expectedDsl = {
   allowNoIndices: true,
+  track_total_hits: false,
   body: {
     aggregations: {
       host_count: { cardinality: { field: 'host.name' } },
@@ -161,7 +162,6 @@ export const expectedDsl = {
       },
     },
     size: 0,
-    track_total_hits: false,
   },
   ignoreUnavailable: true,
   index: [
@@ -208,6 +208,7 @@ export const formattedAnomaliesSearchStrategyResponse: MatrixHistogramStrategyRe
           ],
           allowNoIndices: true,
           ignoreUnavailable: true,
+          track_total_hits: true,
           body: {
             aggs: {
               anomalyActionGroup: {
@@ -258,7 +259,6 @@ export const formattedAnomaliesSearchStrategyResponse: MatrixHistogramStrategyRe
               },
             },
             size: 0,
-            track_total_hits: true,
           },
         },
         null,
@@ -390,6 +390,7 @@ export const formattedAuthenticationsSearchStrategyResponse: MatrixHistogramStra
           ],
           allowNoIndices: true,
           ignoreUnavailable: true,
+          track_total_hits: true,
           body: {
             aggregations: {
               eventActionGroup: {
@@ -429,7 +430,6 @@ export const formattedAuthenticationsSearchStrategyResponse: MatrixHistogramStra
               },
             },
             size: 0,
-            track_total_hits: true,
           },
         },
         null,
@@ -956,6 +956,7 @@ export const formattedEventsSearchStrategyResponse: MatrixHistogramStrategyRespo
           ],
           allowNoIndices: true,
           ignoreUnavailable: true,
+          track_total_hits: true,
           body: {
             aggregations: {
               eventActionGroup: {
@@ -994,7 +995,6 @@ export const formattedEventsSearchStrategyResponse: MatrixHistogramStrategyRespo
               },
             },
             size: 0,
-            track_total_hits: true,
           },
         },
         null,

diff --git a/...rver/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts b/...rver/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts
@@ -36,6 +36,7 @@ export const expectedDsl = {
   ],
   allowNoIndices: true,
   ignoreUnavailable: true,
+  track_total_hits: true,
   body: {
     aggregations: {
       alertsGroup: {
@@ -104,6 +105,5 @@ export const expectedDsl = {
       },
     },
     size: 0,
-    track_total_hits: true,
   },
 };
diff --git a/..._strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.ts b/..._strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.ts
@@ -85,6 +85,7 @@ export const buildAlertsHistogramQuery = ({
     index: defaultIndex,
     allowNoIndices: true,
     ignoreUnavailable: true,
+    track_total_hits: true,
     body: {
       aggregations: getHistogramAggregation(),
       query: {
@@ -93,7 +94,6 @@ export const buildAlertsHistogramQuery = ({
         },
       },
       size: 0,
-      track_total_hits: true,
     },
   };