diff --git a/alerting/src/main/kotlin/org/opensearch/alerting/transport/TransportDocLevelMonitorFanOutAction.kt b/alerting/src/main/kotlin/org/opensearch/alerting/transport/TransportDocLevelMonitorFanOutAction.kt index 4f24fe2d1..bb0d694ca 100644 --- a/alerting/src/main/kotlin/org/opensearch/alerting/transport/TransportDocLevelMonitorFanOutAction.kt +++ b/alerting/src/main/kotlin/org/opensearch/alerting/transport/TransportDocLevelMonitorFanOutAction.kt @@ -51,6 +51,7 @@ import org.opensearch.alerting.settings.AlertingSettings.Companion.MAX_ACTIONABL import org.opensearch.alerting.settings.AlertingSettings.Companion.PERCOLATE_QUERY_DOCS_SIZE_MEMORY_PERCENTAGE_LIMIT import org.opensearch.alerting.settings.AlertingSettings.Companion.PERCOLATE_QUERY_MAX_NUM_DOCS_IN_MEMORY import org.opensearch.alerting.settings.DestinationSettings +import org.opensearch.alerting.util.MAX_SEARCH_SIZE import org.opensearch.alerting.util.defaultToPerExecutionAction import org.opensearch.alerting.util.destinationmigration.NotificationActionConfigs import org.opensearch.alerting.util.destinationmigration.NotificationApiUtils @@ -823,6 +824,7 @@ class TransportDocLevelMonitorFanOutAction SearchRequest().indices(*queryIndices.toTypedArray()).preference(Preference.PRIMARY_FIRST.type()) val searchSourceBuilder = SearchSourceBuilder() searchSourceBuilder.query(boolQueryBuilder) + searchSourceBuilder.size(MAX_SEARCH_SIZE) searchRequest.source(searchSourceBuilder) log.debug( "Monitor ${monitor.id}: " + diff --git a/alerting/src/test/kotlin/org/opensearch/alerting/MonitorDataSourcesIT.kt b/alerting/src/test/kotlin/org/opensearch/alerting/MonitorDataSourcesIT.kt index 1bef411bd..711cba7ac 100644 --- a/alerting/src/test/kotlin/org/opensearch/alerting/MonitorDataSourcesIT.kt +++ b/alerting/src/test/kotlin/org/opensearch/alerting/MonitorDataSourcesIT.kt @@ -412,8 +412,37 @@ class MonitorDataSourcesIT : AlertingSingleNodeTestCase() { fields = listOf(), queryFieldNames = listOf("alias.some.fff", "source.ip.v6.v1") ) + val docQuery8 = DocLevelQuery( + query = "message:error", + name = "10", + fields = listOf() + ) + val docQuery9 = DocLevelQuery( + query = "message:IAD", + name = "11", + fields = listOf() + ) + val docQuery10 = DocLevelQuery( + query = "source.ip.v6.v1:[10000 TO 20000]", + name = "12", + fields = listOf() + ) + val docQuery11 = DocLevelQuery( + query = "type.subtype:some", + name = "13", + fields = listOf() + ) + val docQuery12 = DocLevelQuery( + query = "supertype.type:some", + name = "14", + fields = listOf() + ) val docLevelInput = DocLevelMonitorInput( - "description", listOf(index), listOf(docQuery1, docQuery2, docQuery3, docQuery4, docQuery5, docQuery6, docQuery7) + "description", listOf(index), + listOf( + docQuery1, docQuery2, docQuery3, docQuery4, docQuery5, docQuery6, docQuery7, + docQuery8, docQuery9, docQuery10, docQuery11, docQuery12 + ) ) val trigger = randomDocumentLevelTrigger(condition = ALWAYS_RUN) val customFindingsIndex = "custom_findings_index" @@ -462,7 +491,7 @@ class MonitorDataSourcesIT : AlertingSingleNodeTestCase() { val findings = searchFindings(id, customFindingsIndex) assertEquals("Findings saved for test monitor", 1, findings.size) assertTrue("Findings saved for test monitor", findings[0].relatedDocIds.contains("1")) - assertEquals("Didn't match all 7 queries", 7, findings[0].docLevelQueries.size) + assertEquals("Didn't match all 12 queries", 12, findings[0].docLevelQueries.size) } fun `test percolate query failure when queryFieldNames has alias`() {