diff --git a/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts b/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts index 2cc886a422132b..29564ad4b38633 100644 --- a/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts +++ b/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts @@ -112,18 +112,17 @@ export function updateSearchSource( alertLimit?: number ): { searchSource: ISearchSource; filterToExcludeHitsFromPreviousRun: Filter | null } { const isGroupAgg = isGroupAggregation(params.termField); - const timeFieldName = params.timeField || index.timeFieldName; + const timeField = index.getTimeField(); - if (!timeFieldName) { - throw new Error('Invalid data view without timeFieldName.'); + if (!timeField) { + throw new Error(`Data view with ID ${index.id} no longer contains a time field.`); } searchSource.setField('size', isGroupAgg ? 0 : params.size); - const field = index.getTimeField(); const filters = [ buildRangeFilter( - field!, + timeField, { lte: dateEnd, gte: dateStart, format: 'strict_date_optional_time' }, index ), @@ -135,7 +134,7 @@ export function updateSearchSource( // add additional filter for documents with a timestamp greater than // the timestamp of the previous run, so that those documents are not counted twice filterToExcludeHitsFromPreviousRun = buildRangeFilter( - field!, + timeField, { gt: latestTimestamp, format: 'strict_date_optional_time' }, index ); @@ -150,7 +149,7 @@ export function updateSearchSource( searchSourceChild.setField('filter', filters as Filter[]); searchSourceChild.setField('sort', [ { - [timeFieldName]: { + [timeField.name]: { order: SortDirection.desc, format: 'strict_date_optional_time||epoch_millis', },