We see the following -
The elapsed time for each one of them is high. Is it the expected behavior?
This doesn't mean the alerts are slow it means this is the amount of time the alerts have been activated due to high memory usage, so in this case, 30 - 50 seconds of high memory usage per search head.
I thought that elapsed time is the time it took the search to run. Isn't it?
