# Terminate long running queries to protect the system from DoS **URL:** \ **Category:** Elasticsearch\ **Created:** [June 17, 2015, 8:04am UTC](https://discuss.elastic.co/t/terminate-long-running-queries-to-protect-the-system-from-dos/23811 "2015-06-17T08:04:54Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![mama](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mama](https://discuss.elastic.co/u/mama)\ **Post date:** [June 17, 2015, 8:04am UTC](https://discuss.elastic.co/t/terminate-long-running-queries-to-protect-the-system-from-dos/23811/1 "2015-06-17T08:04:55Z")
Is it possible to somehow terminate long running queries in order to protect the system? We have the challenge, that 30+ users use our cluster. If one user sends a request for a 30d search, the system becomes unavailable until the query completes. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 17, 2015, 8:06am UTC](https://discuss.elastic.co/t/terminate-long-running-queries-to-protect-the-system-from-dos/23811/2 "2015-06-17T08:06:06Z")
There's currently no way to do this other than restarting the ES node(s). ---
**Author:** ![mama](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mama](https://discuss.elastic.co/u/mama)\ **Post date:** [June 17, 2015, 8:10am UTC](https://discuss.elastic.co/t/terminate-long-running-queries-to-protect-the-system-from-dos/23811/3 "2015-06-17T08:10:13Z")
Is there a feature on the roadmap to address this issue? From my point of view this is a very basic mechanism (e.g. complex aggs). A user is able to kill a cluster with just a single query and the sysadmins can not do anything but reboot ☹ ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 17, 2015, 8:21am UTC](https://discuss.elastic.co/t/terminate-long-running-queries-to-protect-the-system-from-dos/23811/4 "2015-06-17T08:21:41Z")
There is a management type API that is being worked on to deal with this, I don't have an ETA though. ---
**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\ **Post date:** [June 17, 2015, 8:46am UTC](https://discuss.elastic.co/t/terminate-long-running-queries-to-protect-the-system-from-dos/23811/6 "2015-06-17T08:46:02Z")
Add a timeout setting to your queries. [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-body.html#\_parameters\_5](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-body.html#_parameters_5) ---
**Author:** ![mama](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mama](https://discuss.elastic.co/u/mama)\ **Post date:** [June 17, 2015, 8:49am UTC](https://discuss.elastic.co/t/terminate-long-running-queries-to-protect-the-system-from-dos/23811/7 "2015-06-17T08:49:43Z")
Adding a timeout will only return either when the search is finished or the timeout hit. The queries will bother your system even if you return after the timeout. ---
**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\ **Post date:** [June 17, 2015, 9:59am UTC](https://discuss.elastic.co/t/terminate-long-running-queries-to-protect-the-system-from-dos/23811/8 "2015-06-17T09:59:11Z")
the timeout checks are weaved into various expensive loops including the aggregations document collector loop ---
**Author:** ![mama](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mama](https://discuss.elastic.co/u/mama)\ **Post date:** [June 17, 2015, 10:27am UTC](https://discuss.elastic.co/t/terminate-long-running-queries-to-protect-the-system-from-dos/23811/9 "2015-06-17T10:27:58Z")
Does this mean, setting the timeout will not terminate the search, but will stop expensive operations? And ... how does the timeout affect the scrolling API? ---
**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\ **Post date:** [June 17, 2015, 10:33am UTC](https://discuss.elastic.co/t/terminate-long-running-queries-to-protect-the-system-from-dos/23811/10 "2015-06-17T10:33:50Z")
Aggregations are conducted by tapping off results from the search's collection stream. A timeout will terminate this operation on the shard in question returning any interim results it may have gathered so far along with a flag to indicate the timeout status. This is reported in the final results. ---
**Author:** ![chakrayadavalli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chakrayadavalli/32/6999_2.png) [@chakrayadavalli](https://discuss.elastic.co/u/chakrayadavalli)\ **Post date:** [January 26, 2016, 12:22am UTC](https://discuss.elastic.co/t/terminate-long-running-queries-to-protect-the-system-from-dos/23811/11 "2016-01-26T00:22:32Z")
Hi Mark, Any update on the management API to terminate long running queries? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:21pm UTC](https://discuss.elastic.co/t/terminate-long-running-queries-to-protect-the-system-from-dos/23811/12 "2017-07-05T23:21:49Z")