Hello.
I am running two ELK servers, one is running 5.5.3 and my new one is running 6.1.1.
Now I started last week to index all data in my database which is the source for both servers. Eventually I will retire the 5.5.3 server.
This morning is saw a clear mismatch in the indices document count.
examples:
index B1 has 5886 docs, but there should be 6791 docs
index B2 has 2,248,598 docs, but there should be 2,389,518 docs
index B3 has 72,547 docs, but there should be 74.283 docs
and so on. I have about 8 indices synced with my database (MSSQL 2014) so far, all them show way less documents then they should be.
I double checked everything with the synced indices in 5.5.3 and found that is correct in there.
So only 6.1.1 show me a problem.
I use logstash to index the data from my database. The sql-statement in the conf-file is the same.
The logfile doesn't show any error.
Any help is greatly appreciated.