# Is Kibana EQL Rule Using Async Search? **URL:** \ **Category:** Elastic Security\ **Tags:** eql-elastic-query-language\ **Created:** [December 7, 2022, 1:34pm UTC](https://discuss.elastic.co/t/is-kibana-eql-rule-using-async-search/320687 "2022-12-07T13:34:34Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![davendu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davendu/32/114351_2.png) [@davendu](https://discuss.elastic.co/u/davendu)\ **Post date:** [December 7, 2022, 1:34pm UTC](https://discuss.elastic.co/t/is-kibana-eql-rule-using-async-search/320687/1 "2022-12-07T13:34:34Z")
Hi everyone, Similar to [this thread](https://discuss.elastic.co/t/eql-correlation-rule-is-timing-out-sometimes/316641), I also was notified by error `Request timed out` like the following debug log says: ```auto { ... "message":"Changing rule status to \"failed\". An error occurred during rule execution: message: \"Request timed out\" ... } ``` There is a load-balancer between my Kibana and Elasticsearch server, which has a ~60s max connection timeout. I'm not sure if this is a probable cause. However, rather than changing this config, I know EQL search can be [async called](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html#eql-search-async), and want to use this feature to solve the root cause. I enabled the debugging log, and seems all EQL queries are not carrying argument `wait_for_completion_timeout`, which means all searches are sync query. I also checked v8.5.0 kibana source, and I'm not sure if my findings are correct. So could anyone check if Kibana is using _sync_ or _async_ mode by default when executing EQL rules? ---
**Author:** ![Venkata\_Raja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkata_raja/32/114264_2.png) [@Venkata\_Raja](https://discuss.elastic.co/u/Venkata_Raja)\ **Post date:** [December 7, 2022, 2:52pm UTC](https://discuss.elastic.co/t/is-kibana-eql-rule-using-async-search/320687/2 "2022-12-07T14:52:09Z")
Hi, By default, EQL search requests are synchronous and wait for complete results before returning a response. However, complete results can take longer for searches across large data sets data. To avoid long waits, run an async EQL search. Set `wait_for_completion_timeout` to a duration you’d like to wait for synchronous results. > **[EQL search | Elasticsearch Guide \[master\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/master/eql.html)** ---
**Author:** ![davendu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davendu/32/114351_2.png) [@davendu](https://discuss.elastic.co/u/davendu)\ **Post date:** [December 7, 2022, 3:23pm UTC](https://discuss.elastic.co/t/is-kibana-eql-rule-using-async-search/320687/3 "2022-12-07T15:23:48Z")
Hi Venkata, Thanks for reply. As I have mentioned, I know `wait_for_completion_timeout` is a feature in Elasticsearch to control if the EQL query should be executed sync or async. However, as I have said in the title, I would like to focus on if a EQL based rule in **Kibana** (or, to be more specifically, Elastic Security) is running in sync mode or not by default. ---
**Author:** ![Venkata\_Raja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkata_raja/32/114264_2.png) [@Venkata\_Raja](https://discuss.elastic.co/u/Venkata_Raja)\ **Post date:** [December 7, 2022, 3:36pm UTC](https://discuss.elastic.co/t/is-kibana-eql-rule-using-async-search/320687/4 "2022-12-07T15:36:19Z")
Hi Davendu, As EQL rules are also based on EQL queries only , i can say they default run in sync as per documentation > By default, EQL search requests are synchronous ---
**Author:** ![davendu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davendu/32/114351_2.png) [@davendu](https://discuss.elastic.co/u/davendu)\ **Post date:** [December 7, 2022, 3:55pm UTC](https://discuss.elastic.co/t/is-kibana-eql-rule-using-async-search/320687/5 "2022-12-07T15:55:05Z")
Hi Venkata, It's not that simple. For instance, if you use the EQL preview function, the query is actually executed in async way, but you have never got a chance to select how it is executed. Search about `EQL_SEARCH_STRATEGY` (case sensitive) to know how the strategy is registered, and then used in `x-pack/plugins/security_solution/public/common/hooks/eql/use_eql_preview.ts` when previewing the rule. I think a more sounding evidence is required if we want to say the EQL rules in Elastic Security is run in the sync/async way. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 4, 2023, 3:55pm UTC](https://discuss.elastic.co/t/is-kibana-eql-rule-using-async-search/320687/6 "2023-01-04T15:55:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.