[EDR Workflows] Fix redundant nesting in aggregations

[tomsonpl]

This Elasticsearch aggregation query counts action responses for osquery queries to calculate status (pending/completed). It:

1. Filters documents by action_id (specific query action)
2. Counts total rows returned (action_response.osquery.count)
3. Categorizes responses as "success" or "error" based on error field presence
4. Returns aggregated counts used for status calculation

The Bug: Malformed Nested Structure

Before (Incorrect)

aggs: {
  aggs: {                    // ❌ Extra 'aggs' wrapper
    global: {},              // ❌ Unnecessary global aggregation
    aggs: {                  // ❌ Another 'aggs' wrapper
      responses_by_action_id: {
        filter: { /* ... */ },
        aggs: {
          rows_count: { /* ... */ },
          responses: { /* ... */ }
        }
      }
    }
  }
}

After (Correct)

aggs: {
  responses_by_action_id: {  // ✅ Directly under top-level aggs
    filter: { /* ... */ },
    aggs: {
      rows_count: { /* ... */ },
      responses: { /* ... */ }
    }
  }
}

[tomsonpl]

/ci

[elasticmachine]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!
• Click to trigger kibana-deploy-cloud-from-pr for this PR!

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 3ec7214

Failed CI Steps

• Jest Tests #1
• Jest Tests #1
• Osquery Cypress Tests #1
• Osquery Cypress Tests #1
• Osquery Cypress Tests #2
• Osquery Cypress Tests #3
• Osquery Cypress Tests #4
• Osquery Cypress Tests #6
• Osquery Cypress Tests #6
• Osquery Cypress Tests #7
• Osquery Cypress Tests #8
• Osquery Cypress Tests #8
• Osquery Cypress Tests on Serverless #1
• Osquery Cypress Tests on Serverless #1
• Osquery Cypress Tests on Serverless #2
• Osquery Cypress Tests on Serverless #4
• Osquery Cypress Tests on Serverless #4
• Osquery Cypress Tests on Serverless #6
• Osquery Cypress Tests on Serverless #7

Test Failures

• [job] [logs] Osquery Cypress Tests #4 / Add to Cases observability should add result a case and not have add to timeline in result
• [job] [logs] Osquery Cypress Tests #4 / Add to Cases security should add result a case and have add to timeline in result
• [job] [logs] Osquery Cypress Tests #6 / Alert Test t1_analyst role should be able to run rule investigation guide query
• [job] [logs] Osquery Cypress Tests #7 / ALL - Live Query run custom and saved should open query details by clicking the details icon
• [job] [logs] Osquery Cypress Tests on Serverless #7 / ALL - Live Query run custom and saved should open query details by clicking the details icon
• [job] [logs] Osquery Cypress Tests #7 / ALL - Live Query run custom and saved should run customized saved query
• [job] [logs] Osquery Cypress Tests on Serverless #7 / ALL - Live Query run custom and saved should run customized saved query
• [job] [logs] Osquery Cypress Tests #7 / ALL - Live Query run custom and saved should run query and enable ecs mapping
• [job] [logs] Osquery Cypress Tests on Serverless #7 / ALL - Live Query run custom and saved should run query and enable ecs mapping
• [job] [logs] Osquery Cypress Tests #6 / ALL - Live Query should run multiline query
• [job] [logs] Osquery Cypress Tests on Serverless #6 / ALL - Live Query should run multiline query
• [job] [logs] Osquery Cypress Tests #6 / ALL - Live Query should validate the form
• [job] [logs] Osquery Cypress Tests on Serverless #6 / ALL - Live Query should validate the form
• [job] [logs] Osquery Cypress Tests #2 / ALL - Saved queries should create a new query and verify:

• hidden columns, full screen and sorting
• pagination
• query can viewed (status), edited and deleted

• [job] [logs] Osquery Cypress Tests #3 / ALL - Timelines should substitute osquery parameter on non-alert event take action
• [job] [logs] Jest Tests #1 / buildActionResultsQuery basic functionality should build query with all options combined
• [job] [logs] Jest Tests #1 / buildActionResultsQuery basic functionality should build query with all options combined
• [job] [logs] Jest Tests #1 / buildActionResultsQuery basic functionality should build query with minimal required parameters using agent actions results index
• [job] [logs] Jest Tests #1 / buildActionResultsQuery basic functionality should build query with minimal required parameters using agent actions results index
• [job] [logs] Osquery Cypress Tests #4 / Live query GET getLiveQueryDetailsRoute validates we get successful response
• [job] [logs] Osquery Cypress Tests on Serverless #2 / Live query GET getLiveQueryDetailsRoute validates we get successful response
• [job] [logs] Osquery Cypress Tests #4 / Live query GET getLiveQueryResultsRoute validates we get successful response
• [job] [logs] Osquery Cypress Tests on Serverless #2 / Live query GET getLiveQueryResultsRoute validates we get successful response

Metrics [docs]

✅ unchanged

History