Find, cancel or throttle long-running search and reindex tasks

Command

# Longest running tasks:
GET _cat/tasks?v&detailed&h=action,task_id,parent_task_id,running_time,node,description&s=running_time:desc
# Search, reindex and by-query tasks, grouped by parent:
GET _tasks?actions=*search*,*reindex*,*byquery*&detailed=true&group_by=parents
# Cancel a single task:
POST _tasks/<task_id>/_cancel
# Cancel all search tasks (with care):
POST _tasks/_cancel?actions=*search*
# Slow down a running reindex/update_by_query:
POST _reindex/<task_id>/_rethrottle?requests_per_second=500

What it does

Sorts tasks running in the cluster by duration, shows searches and bulk operations with their query descriptions; cancels a selected task or all searches, and throttles reindex/by-query jobs.

When to use it

When the search thread pool fills, CPU suddenly rises, a dashboard strains the cluster with a heavy aggregation, or an update_by_query affects production.

Caution

Cancellation is cooperative: the task stops at its next checkpoint; some phases (e.g. force merge) cannot be cancelled. Cancelling all searches returns errors to users. A cancelled reindex/by-query does not roll back changes made so far; the target contains partial data. When a parent task is cancelled, its child tasks are cancelled too.