# Mark a as closed an Alert take long time **URL:** \ **Category:** Elastic Security\ **Tags:** elastic-stack-alerting\ **Created:** [May 2, 2022, 9:05pm UTC](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777 "2022-05-02T21:05:13Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![rainierwolf](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@rainierwolf](https://discuss.elastic.co/u/rainierwolf)\ **Post date:** [May 2, 2022, 9:05pm UTC](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777/1 "2022-05-02T21:05:13Z")
Hi team, I'm having a strange problem changing alert states in the security module. When I mark an alert as closed, it takes several minutes waiting until the system displays an error ("Failed to retrieve"). If I change section and come back, I see that the alert was closed. The opposite process also happens the same. All other sections of Elastic are working fine and I don't see any errors in the logs. I have a Kibana and four Elasticsearch nodes on a 7.16.3 cluster version. All servers have the same version. Anyone with this problem? Thanks in advance ---
**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\ **Post date:** [May 5, 2022, 8:23pm UTC](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777/2 "2022-05-05T20:23:23Z")
Hey there @rainierwolf! 👋 So I'm curious if this is this happening when closing a single alert, or only when closing a large number of alerts? Additionally, are these newer alerts you're closing, or alerts from awhile back (month plus perhaps?). Also, could anyone else be modifying the state of these alerts at the same time? (there could be issues with concurrency here). When updating just a few alerts selected on the table we run an `update_by_id` query to update their state, but if you bulk select-all alerts, we'll run an `update_by_query` which can take a bit longer depending on the number of alerts, and any current cluster activity. That said, I'm curious to see what the `Failed to retrieve` error was referencing. Could you please share either a screenshot of the expanded error or perhaps the full failed API response from your browser dev tools? Thanks! Garrett ---
**Author:** ![rainierwolf](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@rainierwolf](https://discuss.elastic.co/u/rainierwolf)\ **Post date:** [May 6, 2022, 12:28pm UTC](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777/3 "2022-05-06T12:28:51Z")
Thanks for replying my post. This problem happening in both cases, closing one or several alerts. I usually manage the SIEM, so we can discard that there were more users modifying these alerts. I have tried with several browsers but the problem persist. We have updated the version from 7.16.3 to 7.17.4 too, but the problem persists. The cluster status is correct and all searches work perfectly. I think the error may be that Kibana does not update the state in the browser, if I change the section, the alert appears closed. I've tried multiple browsers and the problem happens with all of them. Thanks ![Error Devtools Chrome](https://us1.discourse-cdn.com/elastic/original/3X/b/f/bfbf180ef5945c8120c06f97e3a494bc94ef98dd.png) ![Error Kibana](https://us1.discourse-cdn.com/elastic/original/3X/7/6/76e97854eb376ddba83ea6bf0223af7736918a97.png) ![CloseAlert](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d3de2b2fe51b6488156bf0ab135610ca7f3602e9.gif) ---
**Author:** ![marrc.rousseau](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@marrc.rousseau](https://discuss.elastic.co/u/marrc.rousseau)\ **Post date:** [May 13, 2022, 12:49pm UTC](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777/4 "2022-05-13T12:49:41Z")
Exact same issue here. Elastic cluster version 8.1.0 ---
**Author:** ![marrc.rousseau](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@marrc.rousseau](https://discuss.elastic.co/u/marrc.rousseau)\ **Post date:** [May 24, 2022, 12:41pm UTC](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777/5 "2022-05-24T12:41:47Z")
Finally found the issue. If you are in air-gapped environnement, you must disable Kibana telemetry Stack Management \> Kibana \> Advanced Settings \> (at the bottom) Provide Usage data : OFF ---
**Author:** ![rainierwolf](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@rainierwolf](https://discuss.elastic.co/u/rainierwolf)\ **Post date:** [May 30, 2022, 8:47pm UTC](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777/6 "2022-05-30T20:47:07Z")
> [@marrc.rousseau](#): > > If you are in air-gapped environnement, Hi Marc, your solution is working correctly. Thanks for share your solution. ---
**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\ **Post date:** [June 1, 2022, 4:12pm UTC](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777/7 "2022-06-01T16:12:50Z")
Thanks for the additional details @marrc.rousseau! I've went ahead and created [this issue](https://github.com/elastic/kibana/issues/133321) for us to address and resolve the issue. Appreciate it! Garrett ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 29, 2022, 4:13pm UTC](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777/8 "2022-06-29T16:13:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.