Find and cancel long-running queries

Use the task management APIs to find queries that are still running, inspect their source and elapsed time, and cancel a query when needed. You can inspect Query DSL, ES|QL, EQL, and SQL queries, as well as multi-search and async search requests.

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.4 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. For a visual interface, use Query activity in Kibana. Query activity is also available in Serverless, where the task management APIs aren't available for direct use.

Before you begin

When Elasticsearch security features are enabled, you need the following cluster privileges:

monitor to list and inspect tasks.
cancel_task to cancel tasks.

The task list is a snapshot of running work, not a query history. A query that finishes between requests might no longer appear in the list.

Find a running query

Use the list tasks API with detailed=true to include task descriptions. Filter by the query actions you're investigating:

GET /_tasks?detailed=true&human=true&group_by=none&actions=indices:data/read/search*,indices:data/read/esql*,indices:data/read/eql*,indices:data/read/sql*,indices:data/read/msearch*,indices:data/read/async_search*

group_by=none returns a flat tasks array. To narrow the request to one query family, replace actions with a filter from this table:

Query or request	Action filter
Query DSL search	`indices:data/read/search*`
ES\|QL	`indices:data/read/esql*`
EQL	`indices:data/read/eql*`
SQL	`indices:data/read/sql*`
Multi-search	`indices:data/read/msearch*`
Async search	`indices:data/read/async_search*`

These wildcard filters include related work, such as child tasks, asynchronous query execution, and requests to retrieve async results. A query can create multiple tasks, so the number of tasks isn't a count of user queries. Use group_by=parents to view matching child tasks grouped under their matching parent tasks.

Inspect the response for tasks with a high running_time_in_nanos. For example, the following response contains an ES|QL task that has been running for about 42 seconds:
JSON
```
{
  "tasks": [
    {
      "node": "2j8UKw1bRO283PMwDugNNg",
      "id": 5326,
      "type": "transport",
      "action": "indices:data/read/esql",
      "description": "FROM test | STATS MAX(d) BY a, b",
      "start_time": "2026-04-01T10:00:00.000Z",
      "start_time_in_millis": 1775037600000,
      "running_time": "41.7s",
      "running_time_in_nanos": 41700000000,
      "cancellable": true,
      "cancelled": false,
      "headers": {}
    }
  ]
}
```
Use these fields to identify the query:
- action: The operation the task is performing.
- description: Details of the request. For ES|QL, this contains the query text. For a Query DSL search, it includes the indices, search type, and search source.
- running_time_in_nanos: Elapsed runtime, not CPU time. With human=true, running_time also shows a readable duration.
- parent_task_id, when present: The task that started this work. Use it to distinguish a query request from its child tasks.
- headers: Request identifiers, such as X-Opaque-Id, when supplied. Refer to API conventions and Trace an Elasticsearch query to its origin in Kibana.
Combine node and id with a colon to form the task ID. In this example, the task ID is 2j8UKw1bRO283PMwDugNNg:5326.

Cancel the query

Confirm that the task belongs to the query you want to stop and that cancellable is true. When the query has child tasks, identify the parent query task so you can cancel the query rather than one part of its work.
Use the cancel task API with that task ID. Replace the example ID with the ID from your response:
JSON
```
POST /_tasks/2j8UKw1bRO283PMwDugNNg:5326/_cancel
```
Cancellation can take time. A task with cancelled: true has received the cancellation request but might still be stopping its work.
Repeat the list request and check whether the task is still present. When it no longer appears in a successful response, it is no longer running. Check for node or task failures in the response before concluding that the task has stopped.

If a canceled task continues running, use the nodes hot threads API and the task queue backlog guidance to investigate what is delaying it.

Investigate recurring slow queries

For ES|QL queries, refer to Optimize ES|QL query performance.
For search requests, refer to Tune for search speed.
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.4 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. For historical query data, configure query logging. Query logs let you investigate queries after they finish.
For clusters without query logging, use search slow logs or the ES|QL query log, according to the query type and version.