Skip to main content

Search Actions

SAF provides a mechanism for canceling a search query. It can be used if an error is encountered after running a search query, or the search query takes too long to complete.

Cancel the current search via the web interface​

To cancel a search query, you need to click the Stop button, which appears instead of the Refreafh button while executing a search query.

Cancel search

Cancel search by id via API​

To cancel a search by its id, you must go to Settings - Dev Console and run a request in which {id} must be replaced with the id of the search query:

POST _sme/searchActions/cancel/{id}

As a result of executing the request, the system will cancel the search if it has not yet completed and display the message Search added to cancel list.

tip

The id of the search query can be obtained from the logs or using active search query. The id of the search query will be in the searchId field.

View active searches on a cluster​

To view active search queries on the cluster, you can use the rest command, which allows you to query the internal Smart Monitor API.

To get a list of active searches, you need to perform a search query:

| rest "_sme/searchActions/activeSearches?asArray"

View active searches on a site​

To get a list of running search queries on a specific cluster node, you need to run a search query in which {node_id} must be replaced with the id of the node of interest.

| rest "_sme/searchActions/activeSearches/{node_id}?asArray"

Example:

| rest "_sme/searchActions/activeSearches/zSFdnxwVT8SB-5Tw_CoSUw?asArray"