get time field from data view

elastic · May 7, 2024 · 88b8267 · 88b8267
1 parent 7536b91
commit 88b8267
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.test.ts b/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.test.ts
@@ -59,7 +59,8 @@ const defaultParams: OnlySearchSourceRuleParams = {
   excludeHitsFromPreviousRun: true,
   aggType: 'count',
   groupBy: 'all',
-  timeField: 'time',
+  // this should be ignored when using a data view
+  timeField: 'timeFieldNotFromDataView',
 };
 
 describe('fetchSearchSourceQuery', () => {

diff --git a/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts b/x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts
@@ -120,7 +120,7 @@ export function updateSearchSource(
 
   searchSource.setField('size', isGroupAgg ? 0 : params.size);
 
-  const field = index.fields.find((f) => f.name === timeFieldName);
+  const field = index.getTimeField();
   const filters = [
     buildRangeFilter(
       field!,