diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/index.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/index.ts index 3083e8c191786..bf7220026f59b 100644 --- a/x-pack/plugins/osquery/server/search_strategy/osquery/index.ts +++ b/x-pack/plugins/osquery/server/search_strategy/osquery/index.ts @@ -39,7 +39,20 @@ export const osquerySearchStrategyProvider = ( }) ).pipe( mergeMap((exists) => { - const dsl = queryFactory.buildDsl({ ...request, componentTemplateExists: exists }); + const strictRequest = { + factoryQueryType: request.factoryQueryType, + filterQuery: request.filterQuery, + ...('aggregations' in request ? { aggregations: request.aggregations } : {}), + ...('pagination' in request ? { pagination: request.pagination } : {}), + ...('sort' in request ? { sort: request.sort } : {}), + ...('actionId' in request ? { actionId: request.actionId } : {}), + ...('agentId' in request ? { agentId: request.agentId } : {}), + }; + + const dsl = queryFactory.buildDsl({ + ...strictRequest, + componentTemplateExists: exists, + } as StrategyRequestType); // use internal user for searching .fleet* indices es = dsl.index?.includes('fleet') || dsl.index?.includes('logs-osquery_manager.action') @@ -48,7 +61,7 @@ export const osquerySearchStrategyProvider = ( return es.search( { - ...request, + ...strictRequest, params: dsl, }, options,