Hi @ebuildy - this post is explaining what "took" is measuring: Query timing: 'took' value and what I'm measuring
In short it's how long the internals of Elasticsearch spent time on the request - everything outside of the cluster (JSON serializing, transmitting data, ...) is not included.