2021-03-22 17:35:08 +01:00
[[search-sessions]]
2021-04-21 20:02:00 +02:00
== Run a search session in the background
2021-03-22 17:35:08 +01:00
Sometimes you might need to search through large amounts of data no matter
how long the search takes. While this might not happen often,
there are times that long-running queries are required.
Consider a threat hunting scenario, where you need to search through years of data.
If your query is running long, you can save your search session, which
allows {kib} to continue processing your request in the
background. Save your search session from *Discover* or *Dashboard*,
and when your session is complete, view and manage it in *Stack Management*.
[role="screenshot"]
image::images/search-session.png[Search Session indicator displaying the current state of the search, which you can click to stop or save a running Search Session ]
2021-05-03 11:22:07 +02:00
Search sessions are <<search-session-settings-kb,enabled by default>>.
2021-03-22 17:35:08 +01:00
[float]
==== Requirements
* To save a session, you must have permissions for *Discover* and *Dashboard*,
and the <<kibana-feature-privileges, search sessions subfeature>>.
* To view and restore a saved session, you must have access to *Stack Management*.
[float]
==== Example: Save a search session
You’ re trying to understand a trend you see on a dashboard. You
need to look at several years of data, currently in
{ref}/data-tiers.html#cold-tier[cold storage],
but you don’ t have time to wait. You want {kib} to
continue working in the background, so tomorrow you can
open your browser and pick up where you left off.
. Load your dashboard.
+
Your search session begins automatically. The icon after the dashboard title
displays the current state of the search session. A clock indicates the search session is in progress.
A checkmark indicates that the search session is complete.
. To instruct {kib} to continue a search in the background, click the clock icon,
and then click *Save session*. Once you save a search session, you can start a new search,
navigate to a different application, or close the browser.
+
[role="screenshot"]
2021-07-19 17:41:19 +02:00
image::images/search-session-awhile.png[Search Session indicator displaying the current state of the search, which you can click to stop or save a running Search Session, width=75% ]
2021-03-22 17:35:08 +01:00
. To view your saved searches, open the main menu, and then click
*Stack Management > Search Sessions*. You can also open this view from the search sessions popup for a saved or completed session.
+
[role="screenshot"]
image::images/search-sessions-menu.png[Search Sessions management view with actions for inspecting, extending, and deleting a session. ]
. Use the edit menu in *Search Sessions* to:
* *Inspect* the queries and filters that makeup the session.
2021-05-03 11:22:07 +02:00
* *Edit the name* of a session.
2021-03-22 17:35:08 +01:00
* *Extend* the expiration of a completed session.
* *Delete* a session.
. To restore a search session, click its name in the *Search Sessions* view.
+
You're returned to the place from where you started the search session. The data is the same, but
behaves differently:
+
* Relative dates are converted to absolute dates.
* Panning and zooming is disabled for maps.
* Changing a filter, query, or drilldown starts a new search session, which can be slow.
2021-06-15 14:33:29 +02:00
[float]
==== Limitations
2021-07-09 18:34:27 +02:00
Certain visualization features do not fully support background search sessions. If a dashboard
using these features is restored,
all panels using unsupported features won't load immediately, but instead send out additional
data requests, which can take a while to complete.
The warning *Your search session is still running* is shown.
2021-06-15 14:33:29 +02:00
2021-07-09 18:34:27 +02:00
You can either wait for these additional requests to complete or come back to the dashboard later
when all data requests have finished.
2021-06-15 14:33:29 +02:00
A panel on a dashboard can behave like this if one of the following features is used:
2021-07-09 18:34:27 +02:00
**Lens**
* A *top values* dimension with an enabled *Group other values as "Other"* setting.
This is configurable in the *Advanced* section of the dimension.
* An *intervals* dimension.
**Aggregation based** visualizations
* A *terms* aggregation with an enabled *Group other values in separate bucket* setting.
* A *histogram* aggregation.
**Maps**
* Layers using joins, blended layers, or tracks layers.