Find out who is running task

Elastic Stack Elasticsearch
1

I am trying to find out who is running a task in elasticsearch
I did use _task api with different options like

GET /_tasks/oYXgEVBgQoGToxFxhVoA3g:198142212
GET /_tasks/oYXgEVBgQoGToxFxhVoA3g:198143553

GET _cat/tasks?detailed?
GET /_cat/tasks?v&detailed=true


GET _tasks?detailed=true&actions=*

GET _tasks?detailed=true&group_by=parents

None of the output has any user info. headers has only task_id
I have basic authantication enable means anyone who want to run anything needs to provide user/password. this is basic _xpack security feature.

is there way to find out? this installation is free version hence I can't turn on audit log.

2

Hi @elasticforme,

This older thread does share some examples, but the main thing is that you can track the source of requests using the X-Opaque-Id HTTP header if you pass the information to Elasticsearch. That can then be accessed via things like the slow logs.

Hope that helps.

3

hmm this won't help me much. because most all client are using python to connect.
but this is good idea for any rest query

4

@elasticforme it is possible to add headers to the Python connection, as covered here in the Python client documentation:

Screenshot 2025-07-08 at 09.39.49
Screenshot 2025-07-08 at 09.39.491920×2033 261 KB

1 Like
5

just for someone who might be looking this.

I did this in python

script_name = os.path.basename(sys.argv[0])
es = Elasticsearch(elastic_hostnames, http_auth=(elastic_admin_user, elastic_admin_passwd),
                               request_timeout=120, max_retries=3,
                               retry_on_timeout=True,
                               sniff_on_node_failure=True,
                               headers={"X-Opaque-Id": script_name})

and I now has headers show up as python script name.

1 Like