refactor: enhance construct_query to include sorting and clean up commented code
taylorwalton committed
Dec 4, 2025 at 09:34 UTC
db608aace584dcf4e8ac62aa04f747f790387372
1 file changed
+9
-2
backend/app/incidents/services/alert_collection.py
+9
-2
@@ -26,11 +26,18 @@ async def get_graylog_event_indices() -> IndexNamesResponse:
26
return IndexNamesResponse(index_names=await return_graylog_events_index_names(), success=True, message="Success")
27
28
29
+# async def construct_query():
30
+# """
31
+# Constructs the query to find alerts where `fields.COPILOT_ALERT_ID` is NONE.
32
+# """
33
+# return {"query": {"bool": {"must": [{"term": {"fields.COPILOT_ALERT_ID": "NONE"}}]}}}
34
+
35
+
36
async def construct_query():
37
"""
38
Constructs the query to find alerts where `fields.COPILOT_ALERT_ID` is NONE.
39
"""
33
- return {"query": {"bool": {"must": [{"term": {"fields.COPILOT_ALERT_ID": "NONE"}}]}}}
40
+ return {"query": {"bool": {"must": [{"term": {"fields.COPILOT_ALERT_ID": "NONE"}}]}}, "sort": [{"@timestamp": {"order": "asc"}}]}
41
42
43
async def fetch_alerts_for_index(es_client, index, query):
@@ -78,7 +85,7 @@ async def fetch_alerts_batch(es_client, index: str, query: dict, batch_size: int
85
index=index,
86
body=query,
87
size=batch_size,
81
- sort=[{"@timestamp": {"order": "asc"}}], # Process oldest first
88
+ # sort=[{"@timestamp": {"order": "asc"}}], # Process oldest first
89
)
90
91
hits = response["hits"]["hits"]