From 7971b15cece00730a4babb8e427d8ee792c5b2e7 Mon Sep 17 00:00:00 2001
From: Walter Rafelsberger <walter@rafelsberger.at>
Date: Fri, 21 Dec 2018 10:59:52 +0100
Subject: [PATCH] [ML] Fix audit messages. (#27575)

---
 .../server/models/job_audit_messages/job_audit_messages.js | 7 ++++++-
 x-pack/plugins/ml/server/models/job_service/jobs.js        | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/ml/server/models/job_audit_messages/job_audit_messages.js b/x-pack/plugins/ml/server/models/job_audit_messages/job_audit_messages.js
index f6bab3c7a137..79f63666da41 100644
--- a/x-pack/plugins/ml/server/models/job_audit_messages/job_audit_messages.js
+++ b/x-pack/plugins/ml/server/models/job_audit_messages/job_audit_messages.js
@@ -103,7 +103,11 @@ export function jobAuditMessagesProvider(callWithRequest) {
   }
 
   // search highest, most recent audit messages for all jobs for the last 24hrs.
-  async function getAuditMessagesSummary() {
+  async function getAuditMessagesSummary(jobAggregationSize = 10) {
+    // TODO This is the current default value of the cluster setting `search.max_buckets`.
+    // This should possibly consider the real settings in a future update.
+    const maxBuckets = 10000;
+
     try {
       const resp = await callWithRequest('search', {
         index: ML_NOTIFICATION_INDEX_PATTERN,
@@ -126,6 +130,7 @@ export function jobAuditMessagesProvider(callWithRequest) {
             levelsPerJob: {
               terms: {
                 field: 'job_id',
+                size: Math.min(maxBuckets, jobAggregationSize)
               },
               aggs: {
                 levels: {
diff --git a/x-pack/plugins/ml/server/models/job_service/jobs.js b/x-pack/plugins/ml/server/models/job_service/jobs.js
index 6a07bcef8716..e121096e3e15 100644
--- a/x-pack/plugins/ml/server/models/job_service/jobs.js
+++ b/x-pack/plugins/ml/server/models/job_service/jobs.js
@@ -89,7 +89,7 @@ export function jobsProvider(callWithRequest) {
 
   async function jobsSummary(jobIds = []) {
     const fullJobsList = await createFullJobsList();
-    const auditMessages = await getAuditMessagesSummary();
+    const auditMessages = await getAuditMessagesSummary(fullJobsList.length);
     const auditMessagesByJob = auditMessages.reduce((p, c) => {
       p[c.job_id] = c;
       return p;