[Security Solution] Fix timelineEventsAll field expansion for heterogeneous document schemas (#105452)
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
parent
e383b57ba1
commit
a09fcf017d
|
@ -42,7 +42,8 @@ export const timelineEventsAll: TimelineFactory<TimelineEventsQueries.all> = {
|
|||
const hits = response.rawResponse.hits.hits;
|
||||
|
||||
if (fieldRequested.includes('*') && hits.length > 0) {
|
||||
fieldRequested = Object.keys(hits[0]?.fields ?? {}).reduce((acc, f) => {
|
||||
const fieldsReturned = hits.flatMap((hit) => Object.keys(hit.fields ?? {}));
|
||||
fieldRequested = fieldsReturned.reduce((acc, f) => {
|
||||
if (!acc.includes(f)) {
|
||||
return [...acc, f];
|
||||
}
|
||||
|
@ -59,6 +60,7 @@ export const timelineEventsAll: TimelineFactory<TimelineEventsQueries.all> = {
|
|||
)
|
||||
)
|
||||
);
|
||||
|
||||
const inspect = {
|
||||
dsl: [inspectStringifyObject(buildTimelineEventsAllQuery(queryOptions))],
|
||||
};
|
||||
|
|
Loading…
Reference in a new issue