# How do you limit how long a search query will run for or how much resources one query can use?

**URL:** <https://discuss.elastic.co/t/how-do-you-limit-how-long-a-search-query-will-run-for-or-how-much-resources-one-query-can-use/330858>\
**Category:** Elasticsearch\
**Created:** [April 26, 2023, 2:29pm UTC](https://discuss.elastic.co/t/how-do-you-limit-how-long-a-search-query-will-run-for-or-how-much-resources-one-query-can-use/330858 "2023-04-26T14:29:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pushshift](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pushshift/32/50408_2.png) [@pushshift](https://discuss.elastic.co/u/pushshift)\
**Post date:** [April 26, 2023, 2:29pm UTC](https://discuss.elastic.co/t/how-do-you-limit-how-long-a-search-query-will-run-for-or-how-much-resources-one-query-can-use/330858/1 "2023-04-26T14:29:36Z")

</div>

My Googlefu must not be strong. When using Elasticsearch 8.x, how does one limit how long a query runs or how many resources a query consumes. We're noticing possible denial of service attacks from certain people running very expensive search queries (or maybe it is just accidental).

If you could point me to the section of the docs that has this info, I'd greatly appreciate it. I tried reading through most of the manual but don't remember seeing this info.

Thanks!

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 26, 2023, 3:06pm UTC](https://discuss.elastic.co/t/how-do-you-limit-how-long-a-search-query-will-run-for-or-how-much-resources-one-query-can-use/330858/2 "2023-04-26T15:06:24Z")

</div>

There is nothing in Elasticsearch that allows you to limit resources or query execution time per user or query, but you can [prevent expensive queries from being run](https://www.elastic.co/guide/en/elasticsearch/reference/8.7/query-dsl.html#query-dsl-allow-expensive-queries) and limit [max buckets for aggregation and the depth of query clauses](https://www.elastic.co/guide/en/elasticsearch/reference/8.7/search-settings.html).

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 26, 2023, 5:04pm UTC](https://discuss.elastic.co/t/how-do-you-limit-how-long-a-search-query-will-run-for-or-how-much-resources-one-query-can-use/330858/3 "2023-04-26T17:04:53Z")

</div>

As mentioned you can use the setting `search.allow_expensive_queries` to disable expensive queries, but keep in mind that if you use the Alerts interface of Kiban, this will break the Alerts, as expensive queries are needed for it to work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 24, 2023, 5:04pm UTC](https://discuss.elastic.co/t/how-do-you-limit-how-long-a-search-query-will-run-for-or-how-much-resources-one-query-can-use/330858/4 "2023-05-24T17:04:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.