[Security Solution] Preview results limit not respected for Last hour

[MadameSheema]

Describe the bug:

• When previewing the results during the creation of a rule, in the histogram legend it can be read Note: This preview excludes effects of rule exceptions and timestamp overrides, and is limited to 100 results.

Kibana/Elasticsearch Stack version:

• 8.2.0 (8bd714d)

Initial precondition:

• I had ingested auditbeat and packetbeat data, both with more than 100 events ingested.

Steps to reproduce:

1. Navigate to Rules
2. Click on Create new rule
3. On index patterns just leave packetbeat-*
4. Enter a valid custom query i.e. *:*
5. Click on Preview reuslts

Current behavior:

Expected behavior:

• Just 100 hits are displayed

Additional information:

• Same when auditbeat index pattern is added, the number of hits returned, gets increased:

• When you have just auditbeat as index pattern, the number of hits returned is also above 100

• This is just happening for Last hour, Last day and Last month limits the number of hits to 100

Preview results response

{
   "previewId":"383e1f37-8ecd-4d2d-842d-ea7a7f7ba0d7",
   "logs":[
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T08:10:53.751Z",
         "duration":14
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T08:15:53.751Z",
         "duration":9
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T08:20:53.751Z",
         "duration":9
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T08:25:53.751Z",
         "duration":10
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T08:30:53.751Z",
         "duration":8
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T08:35:53.751Z",
         "duration":9
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T08:40:53.751Z",
         "duration":9
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T08:45:53.751Z",
         "duration":8
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T08:50:53.751Z",
         "duration":8
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T08:55:53.751Z",
         "duration":8
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T09:00:53.751Z",
         "duration":9
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T09:05:53.751Z",
         "duration":9
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T09:10:53.751Z",
         "duration":10
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T09:15:53.751Z",
         "duration":10
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T09:20:53.751Z",
         "duration":263
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T09:25:53.751Z",
         "duration":252
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T09:30:53.751Z",
         "duration":311
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T09:35:53.751Z",
         "duration":206
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T09:40:53.751Z",
         "duration":227
      },
      {
         "errors":[
            
         ],
         "warnings":[
            
         ],
         "startedAt":"2022-03-31T09:45:53.751Z",
         "duration":161
      }
   ],
   "isAborted":false
}

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[ghost]

Hi Team,

We have validated above issue on 8.2.0 BC3 and it's working fine. 🟢

Build Details:
Version : 8.2.0 BC3
Build : 51885
Commit : 2ea6dc82752506d6f7aa34bda747f99c6fbfd152

Screenshots:

Thanks !