Where can I see ES content searches performance in terms of avg time?

[deodeshm]

Where can I see ES content searches performance in terms of avg. time taken to run a particular correlation rule or saved search?

[richgalloway · Accepted solution]

You should be able to get that information from the scheduler log.

index=_internal source=*scheduler.log run_time=* 
| stats avg(run_time) by savedsearch_name