---
title: Find and cancel long-running queries
description: Find, inspect, and cancel long-running Elasticsearch queries with the task management APIs, including Query DSL, ES|QL, EQL, and SQL queries.
url: https://www.elastic.co/elastic/docs-builder/docs/4547/reference/query-languages/query-task-management
products:
  - Elasticsearch
applies_to:
  - Elastic Cloud Serverless: Unavailable
  - Elastic Stack: Generally available
---

# Find and cancel long-running queries
Use the [task management APIs](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-tasks) to find queries that are still running, inspect their source and elapsed time, and cancel a query when needed. You can inspect Query DSL, ES|QL, EQL, and SQL queries, as well as multi-search and async search requests.
<applies-to>Elastic Stack: Preview since 9.4</applies-to> For a visual interface, use [Query activity](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4547/deploy-manage/monitor/query-activity) in Kibana. Query activity is also available in Serverless, where the task management APIs aren't available for direct use.

## Before you begin

When Elasticsearch security features are enabled, you need the following [cluster privileges](/elastic/docs-builder/docs/4547/reference/elasticsearch/security-privileges#privileges-list-cluster):
- `monitor` to list and inspect tasks.
- `cancel_task` to cancel tasks.

The task list is a snapshot of running work, not a query history. A query that finishes between requests might no longer appear in the list.

## Find a running query

1. Use the [list tasks API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-tasks-list) with `detailed=true` to include task descriptions. Filter by the query actions you're investigating:
   ```json
   ```
   `group_by=none` returns a flat `tasks` array. To narrow the request to one query family, replace `actions` with a filter from this table:
   | Query or request | Action filter                     |
   |------------------|-----------------------------------|
   | Query DSL search | `indices:data/read/search*`       |
   | ES|QL            | `indices:data/read/esql*`         |
   | EQL              | `indices:data/read/eql*`          |
   | SQL              | `indices:data/read/sql*`          |
   | Multi-search     | `indices:data/read/msearch*`      |
   | Async search     | `indices:data/read/async_search*` |
   These wildcard filters include related work, such as child tasks, asynchronous query execution, and requests to retrieve async results. A query can create multiple tasks, so the number of tasks isn't a count of user queries. Use `group_by=parents` to view matching child tasks grouped under their matching parent tasks.
2. Inspect the response for tasks with a high `running_time_in_nanos`. For example, the following response contains an ES|QL task that has been running for about 42 seconds:
   ```json
   {
     "tasks": [
       {
         "node": "2j8UKw1bRO283PMwDugNNg",
         "id": 5326,
         "type": "transport",
         "action": "indices:data/read/esql",
         "description": "FROM test | STATS MAX(d) BY a, b",
         "start_time": "2026-04-01T10:00:00.000Z",
         "start_time_in_millis": 1775037600000,
         "running_time": "41.7s",
         "running_time_in_nanos": 41700000000,
         "cancellable": true,
         "cancelled": false,
         "headers": {}
       }
     ]
   }
   ```
   Use these fields to identify the query:
   - `action`: The operation the task is performing.
- `description`: Details of the request. For ES|QL, this contains the query text. For a Query DSL search, it includes the indices, search type, and search source.
- `running_time_in_nanos`: Elapsed runtime, not CPU time. With `human=true`, `running_time` also shows a readable duration.
- `parent_task_id`, when present: The task that started this work. Use it to distinguish a query request from its child tasks.
- `headers`: Request identifiers, such as `X-Opaque-Id`, when supplied. Refer to [API conventions](/elastic/docs-builder/docs/4547/reference/elasticsearch/rest-apis/api-conventions#x-opaque-id) and [Trace an Elasticsearch query to its origin in Kibana](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4547/troubleshoot/kibana/trace-elasticsearch-query-to-the-origin-in-kibana).
   Combine `node` and `id` with a colon to form the task ID. In this example, the task ID is `2j8UKw1bRO283PMwDugNNg:5326`.


## Cancel the query

1. Confirm that the task belongs to the query you want to stop and that `cancellable` is `true`. When the query has child tasks, identify the parent query task so you can cancel the query rather than one part of its work.
2. Use the [cancel task API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-tasks-cancel) with that task ID. Replace the example ID with the ID from your response:
   ```json
   ```
   Cancellation can take time. A task with `cancelled: true` has received the cancellation request but might still be stopping its work.
3. Repeat the list request and check whether the task is still present. When it no longer appears in a successful response, it is no longer running. Check for node or task failures in the response before concluding that the task has stopped.
   If a canceled task continues running, use the [nodes hot threads API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-nodes-hot-threads) and the [task queue backlog](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4547/troubleshoot/elasticsearch/task-queue-backlog) guidance to investigate what is delaying it.


## Investigate recurring slow queries

- For ES|QL queries, refer to [Optimize ES|QL query performance](https://www.elastic.co/elastic/docs-builder/docs/4547/reference/query-languages/esql/esql-query-performance).
- For search requests, refer to [Tune for search speed](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4547/deploy-manage/production-guidance/optimize-performance/search-speed).
- <applies-to>Elastic Stack: Preview since 9.4</applies-to> For historical query data, configure [query logging](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4547/deploy-manage/monitor/logging-configuration/query-logs). Query logs let you investigate queries after they finish.
- For clusters without query logging, use [search slow logs](https://www.elastic.co/elastic/docs-builder/docs/4547/reference/elasticsearch/index-settings/slow-log) or the [ES|QL query log](https://www.elastic.co/elastic/docs-builder/docs/4547/reference/query-languages/esql/esql-query-log), according to the query type and version.