Search Actions
Cancel search
Smart Monitor provides a mechanism for canceling a search query. It can be used if an error is encountered after running a search query, or the search query takes too long to complete.
Cancel the current search via the web interface
To cancel a search query, you need to click the Stop button, which appears instead of the Refreafh button while executing a search query.
Cancel search by id via API
To cancel a search by its id, you must go to Settings - Dev Console and run a request in which {id} must be replaced with the id of the search query:
POST _sme/searchActions/cancel/{id}
As a result of executing the request, the system will cancel the search if it has not yet completed and display the message Search added to cancel list.
The id of the search query can be obtained from the logs or using active search query. The id of the search query will be in the searchId field.
View active searches on a cluster
To view active search queries on the cluster, you can use the rest command, which allows you to query the internal SM API.
To get a list of active searches, you need to perform a search query:
| rest "_sme/searchActions/activeSearches?asArray"
As a result, a list of events will be obtained, each containing information about an active search query on the cluster.
View active searches on a site
To get a list of running search queries on a specific cluster node, you need to run a search query in which {node_id} must be replaced with the id of the node of interest.
| rest "_sme/searchActions/activeSearches/{node_id}?asArray"
The final search query may look as follows:
| rest "_sme/searchActions/activeSearches/zSFdnxwVT8SB-5Tw_CoSUw?asArray"
As a result, a list of events will be obtained, containing information about active searches on the specified node.
