I have question about how updating information about indicies works.
I processing logs by filebeat to elasticsearch using ingest pipelines and using elastic stack 7.3.0.
And I checked if logs was harvested by looking on endpoint:
When logs appear and filebeat process them, number of documents in indicies not showing that they are proceed, but storage size is increase. And after filebeat close harvesting file, information with suitable number of docs appear.
Coincidentally I found that when I make some interaction with index(
_search endpoint), then number of docs appear correct on
_cat/indicies endpoint .
Why is happens in that way?