import { ISearchRequestParams } from '../../../../../../../../../src/plugins/data/common' ; import { ActionResultsRequestOptions } from '../../../../../../common/search_strategy' ; import { createQueryFilterClauses } from '../../../../../../common/utils/build_query' ; export const buildActionResultsQuery = ( { actionId , filterQuery , sort , } ) : ISearchRequestParams => { const filter = [ ... createQueryFilterClauses ( filterQuery ) , { match_phrase : { action_id : actionId , } , } , ] ; const dslQuery = { allow_no_indices : true , index : '.fleet-actions-results*' , ignore_unavailable : true , body : { aggs : { aggs : { global : { } , aggs : { responses_by_action_id : { filter : { bool : { must : [ { match : { action_id : actionId , } , } , ] , } , } , aggs : { rows_count : { sum : { field : 'action_response.osquery.count' , } , } , responses : { terms : { script : { lang : 'painless' , source : "if (doc['error.keyword'].size()==0) { return 'success' } else { return 'error' }" , } as const , } , } , } , } , } , } , } , query : { bool : { filter } } , size : 10000 , track_total_hits : true , fields : [ '*' ] , sort : [ { [ sort . field ] : { order : sort . direction , } , } , ] , } , } ; return dslQuery ; } ;