diff --git a/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts
index 80531a25e86222..8db06f94f8a215 100644
--- a/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts
@@ -231,7 +231,8 @@ const getGroupedESQuery = (
         filtered_results: {
           filter: {
             bool: {
-              must: mustFilters,
+              // Scope the inner filtering back to the unpadded range
+              must: [rangeFilter, ...mustFilters],
             },
           },
         },