# Dec 9th, 2024: \[EN\]: Leveraging AutoOps to detect long-running search queries **URL:** \ **Category:** Advent Calendar\ **Created:** [December 9, 2024, 8:00am UTC](https://discuss.elastic.co/t/dec-9th-2024-en-leveraging-autoops-to-detect-long-running-search-queries/369794 "2024-12-09T08:00:54Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\ **Post date:** [December 9, 2024, 8:00am UTC](https://discuss.elastic.co/t/dec-9th-2024-en-leveraging-autoops-to-detect-long-running-search-queries/369794/1 "2024-12-09T08:00:54Z")
Cet article est aussi disponible [en français](https://discuss.elastic.co/t/371319). [Released](http://elastic.co/blog/autoops-for-elasticsearch) early November on Elastic Cloud Hosted, AutoOps significantly simplifies cluster management with performance recommendations, resource utilization and cost insights, real-time issue detection and resolution paths. Among the hundreds of different analysis that AutoOps runs every minute to check your settings, metrics and health, one of them allows you to be alerted when **long running search queries** are plaguing your cluster. Let's see how it works concretely. The beauty of AutoOps for Elastic Cloud Hosted is that there's nothing for you to do. When you spin up a new deployment in a [supported region](https://www.elastic.co/guide/en/cloud/current/ec-autoops-regions.html), an AutoOps agent will be automatically attached to it, and within minutes, metrics will start shipping, analysis will kick in, and events will be raised as soon as something fishy is detected. There's no need to enable slow logs and set up Filebeat to tail and index them somewhere, it just works out of the box by carefully and regularly monitoring the Task Management API. When opening the [Deployment view](https://www.elastic.co/guide/en/cloud/current/ec-autoops-deployment-view.html) in AutoOps, you're immediately presented with a quick history of the recent events. In the screenshot below, we can see that a **"Long running search task"** event was opened recently. ![events-over-time](https://us1.discourse-cdn.com/elastic/original/3X/6/a/6ae387e592d98ac7053e15c7017c599e6dfee194.png) Clicking on the event opens up a fly out panel showing you the DSL of the slow search query that has been detected along with a whole bunch of information related to the execution context of that query. Let's review all the information we got in the screenshot below. ![long_search](https://us1.discourse-cdn.com/elastic/original/3X/8/b/8bc0bb2bd4defc775fba6b4b03cda0fbcd247e81.png) 1. First, we get a link to the node where the long-running query was detected, i.e. `instance-0000000223`. That link allows you to jump directly to the [Nodes view](https://www.elastic.co/guide/en/cloud/current/ec-autoops-nodes-view.html) where you'll find a wealth of metrics and information about that specific node. 2. Then, you'll also see which indices the query was being run on, i.e. `logs-apache.error-default, logs-nginx.error-default` and two more indices. Clicking on those indices will send you to the [Shards view](https://www.elastic.co/guide/en/cloud/current/ec-autoops-shards-view.html) which will allow you to see the detailed shards breakdown of those indices on the identified node as well as all the shards of other indices also located on that node. That view will help you detect if there are any hotspots that might be responsible for causing the slow query. 3. Digging deeper, we can then see that some query analysis took place and AutoOps surfaced a few potential reasons why the query might be slow. In this case, we can see that: 4. Finally, there's some more information to glean about the context of the search query, such as But wait, there's more!! AutoOps doesn't only detect long-running DSL queries, but also **ES|QL** ones, as can be seen on the screenshot below. ![esql](https://us1.discourse-cdn.com/elastic/original/3X/a/3/a39b068be9a1c295b0ef2dbbccd8729ac1952600.jpeg) As you can see, AutoOps can help you detect long-running search queries and dig out a wealth of information about them. And all that for free for Elastic Cloud users! With Elastic, life is fantastic! ---
**Author:** ![Musab\_Dogan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/musab_dogan/32/70691_2.png) [@Musab\_Dogan](https://discuss.elastic.co/u/Musab_Dogan)\ **Post date:** [December 9, 2024, 11:23am UTC](https://discuss.elastic.co/t/dec-9th-2024-en-leveraging-autoops-to-detect-long-running-search-queries/369794/2 "2024-12-09T11:23:28Z")
It looks amazing. Thanks for sharing! Sometimes even a single expensive query can have a huge impact on performance and stability. It's great to be able to automatically detect `long-running searches` tasks without activating slowlogs thanks to AutoOps! > Note: You can use the explanation in the link below to add headers to a query. In that way, you can find the source of the query. > **[API conventions | Elasticsearch Guide \[8.16\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#x-opaque-id)**