[8.13] [Alerts] Fix Elasticsearch query rule with KQL evaluation matc…

…hed doc count (#176620) (#176955)

# Backport

This will backport the following commits from `main` to `8.13`:
- [[Alerts] Fix Elasticsearch query rule with KQL evaluation matched doc
count (#176620)](#176620)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Julia
Rechkunova","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-02-14T21:01:04Z","message":"[Alerts]
Fix Elasticsearch query rule with KQL evaluation matched doc count
(#176620)\n\n- Closes
https://github.com/elastic/kibana/issues/176453\r\n\r\n##
Summary\r\n\r\nThis PR adds `track_total_hits` to the ES request.
Otherwise it's\r\nlimited to 10000.\r\n\r\nTested with index
connector:\r\n<img width=\"500\" alt=\"Screenshot 2024-02-09 at 18 05
51\"\r\nsrc=\"https://github.com/elastic/kibana/assets/1415710/643e504c-91c6-47ae-b2b9-45b132ca5755\">\r\n\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"e2dfb09ed3929c4d0b0df540a6127454e5d6fe88","branchLabelMapping":{"^v8.14.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Feature:Alerting","Team:DataDiscovery","backport:prev-minor","v8.14.0"],"title":"[Alerts]
Fix Elasticsearch query rule with KQL evaluation matched doc
count","number":176620,"url":"https://github.com/elastic/kibana/pull/176620","mergeCommit":{"message":"[Alerts]
Fix Elasticsearch query rule with KQL evaluation matched doc count
(#176620)\n\n- Closes
https://github.com/elastic/kibana/issues/176453\r\n\r\n##
Summary\r\n\r\nThis PR adds `track_total_hits` to the ES request.
Otherwise it's\r\nlimited to 10000.\r\n\r\nTested with index
connector:\r\n<img width=\"500\" alt=\"Screenshot 2024-02-09 at 18 05
51\"\r\nsrc=\"https://github.com/elastic/kibana/assets/1415710/643e504c-91c6-47ae-b2b9-45b132ca5755\">\r\n\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"e2dfb09ed3929c4d0b0df540a6127454e5d6fe88"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.14.0","branchLabelMappingKey":"^v8.14.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/176620","number":176620,"mergeCommit":{"message":"[Alerts]
Fix Elasticsearch query rule with KQL evaluation matched doc count
(#176620)\n\n- Closes
https://github.com/elastic/kibana/issues/176453\r\n\r\n##
Summary\r\n\r\nThis PR adds `track_total_hits` to the ES request.
Otherwise it's\r\nlimited to 10000.\r\n\r\nTested with index
connector:\r\n<img width=\"500\" alt=\"Screenshot 2024-02-09 at 18 05
51\"\r\nsrc=\"https://github.com/elastic/kibana/assets/1415710/643e504c-91c6-47ae-b2b9-45b132ca5755\">\r\n\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"e2dfb09ed3929c4d0b0df540a6127454e5d6fe88"}}]}]
BACKPORT-->

Co-authored-by: Julia Rechkunova <[email protected]>

x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.test.ts

@@ -132,6 +132,7 @@ describe('fetchSearchSourceQuery', () => {
         dateEnd
       );
       const searchRequest = searchSource.getSearchRequestBody();
+      expect(searchRequest.track_total_hits).toBe(true);
       expect(filterToExcludeHitsFromPreviousRun).toMatchInlineSnapshot(`
         Object {
           "meta": Object {
@@ -282,6 +283,7 @@ describe('fetchSearchSourceQuery', () => {
         dateEnd
       );
       const searchRequest = searchSource.getSearchRequestBody();
+      expect(searchRequest.track_total_hits).toBeUndefined();
       expect(searchRequest.size).toMatchInlineSnapshot(`0`);
       expect(searchRequest.query).toMatchInlineSnapshot(`
         Object {

x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts

@@ -144,6 +144,9 @@ export function updateSearchSource(
   }
 
   const searchSourceChild = searchSource.createChild();
+  if (!isGroupAgg) {
+    searchSourceChild.setField('trackTotalHits', true);
+  }
   searchSourceChild.setField('filter', filters as Filter[]);
   searchSourceChild.setField('sort', [
     {