# ELK query throtteling

**URL:** <https://discuss.elastic.co/t/elk-query-throtteling/28595>\
**Category:** Elasticsearch\
**Created:** [September 3, 2015, 10:26am UTC](https://discuss.elastic.co/t/elk-query-throtteling/28595 "2015-09-03T10:26:16Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Laines](https://avatars.discourse-cdn.com/v4/letter/l/e495f1/32.png) [@Laines](https://discuss.elastic.co/u/Laines)\
**Post date:** [September 3, 2015, 10:26am UTC](https://discuss.elastic.co/t/elk-query-throtteling/28595/1 "2015-09-03T10:26:16Z")

</div>

Hello,

we are using the ELK setup for our log management. The document count is currently around 1.5 Billion.  
We are facing the problem when users making queries by the elasticsearch API or by the Kibana Dashboard it makes the API unresponsive and its just recoverable by restarting the elasticsearch service.

Is there a way to prevent searches on to many documents or skip a search when it takes to long.

Any help appreciated!

Cheers,  
Chris

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 5, 2015, 1:12am UTC](https://discuss.elastic.co/t/elk-query-throtteling/28595/2 "2015-09-05T01:12:55Z")

</div>

There's not. ES doesn't handle process management (in this context) very well. It's something we're going to improve.

---

<div class="post-metadata">

**Author:** ![tarunsapra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tarunsapra/32/3903_2.png) [@tarunsapra](https://discuss.elastic.co/u/tarunsapra)\
**Post date:** [September 8, 2015, 9:02am UTC](https://discuss.elastic.co/t/elk-query-throtteling/28595/3 "2015-09-08T09:02:25Z")

</div>

HI @warkolm - wouldn't circuit breaker feature of ES be helpful in this matter?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 8, 2015, 10:24am UTC](https://discuss.elastic.co/t/elk-query-throtteling/28595/4 "2015-09-08T10:24:42Z")

</div>

Only if the query would cause an OOM.  
It doesn't currently handle (say) a thousand users running a bunch of smaller queries and causing the same issue.

---

<div class="post-metadata">

**Author:** ![otisg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/otisg/32/492_2.png) [@otisg](https://discuss.elastic.co/u/otisg)\
**Post date:** [September 9, 2015, 4:23am UTC](https://discuss.elastic.co/t/elk-query-throtteling/28595/5 "2015-09-09T04:23:52Z")

</div>

Though you could kind of control it by setting appropriate search thread pool queue size...

## Otis

Monitoring \* Alerting \* Anomaly Detection \* Centralized Log Management  
Elasticsearch Consulting & Support \* [http://sematext.com/](http://sematext.com/)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 10, 2015, 4:30am UTC](https://discuss.elastic.co/t/elk-query-throtteling/28595/6 "2015-09-10T04:30:17Z")

</div>

Yeah true 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:51pm UTC](https://discuss.elastic.co/t/elk-query-throtteling/28595/7 "2017-07-05T23:51:25Z")

</div>