I've noticed I can run fairly complex, dynamic count queries and return an exact count over millions of documents. I would assume if searching is so quick, then the only performance bottlenecks for a scan to return the results would be in the network itself.
However, i'm finding scans are extremely cpu intensive operations. I can see from a query that my search applies to ~5mm documents in sub second time (with no noticeable cpu hit), then when I start pulling the data back through the scrolling api, the cpu hits 100% until the scroll is finished.
Could I get some insights into what Elasticsearch does when a scan is happening? Why are queries so easy to perform where scans are very difficult? If I can determine the bottleneck, I can make changes to mitigate those bottlenecks, but I can't make sense/pinpoint where the cpu would be struggling.