Query Targeting: Scanned Objects / Returned has gone above 1000: alerts

HI Team,
I need your help to tackle this issue. i did enough indexing to avoid unnecessary documents scanning. but still i am getting “Query Targeting: Scanned Objects / Returned has gone above 1000” alerts.
however sometimes document scanned is below 1000 but documents returned is zero. is this also reason for the alert creation? what is correct way to change default value?
most of the time i am facing this issue due to aggregation pipeline.