Collapse on sha256 field instead of common_name.

elastic · Apr 10, 2020 · fe01cf7 · fe01cf7
1 parent dd262be
commit fe01cf7
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/x-pack/plugins/uptime/server/lib/requests/get_certs.ts b/x-pack/plugins/uptime/server/lib/requests/get_certs.ts
@@ -36,18 +36,25 @@ export const getCerts: UMElasticsearchQueryFn<GetCertsParams, Cert[]> = async ({
                 field: 'tls',
               },
             },
+            {
+              range: {
+                '@timestamp': {
+                  gte: 'now-1d',
+                },
+              },
+            },
           ],
         },
       },
       _source: [
         'tls.common_name',
-        'tls.sh256',
+        'tls.sha256',
         'tls.issued_by',
         'tls.certificate_not_valid_before',
         'tls.certificate_not_valid_after',
       ],
       collapse: {
-        field: 'tls.common_name',
+        field: 'tls.sha256',
         inner_hits: {
           _source: {
             includes: ['monitor.id', 'monitor.name'],