I'm using Elasticsearch, Logstash, Kibana (ELK) Docker image (elk-docker) and while accessing Kibana "hits" count shows less of the number then docs.count via (http://127.0.0.1:9200/_cat/indices?v). I selected "Last 5 years")
Please advise.
There are all sorts of things that could be happening, but I'm not sure based on the context. The number kibana reports is the number that elasticsearch sends back, so if it's incorrect it might be a strange elasticsearch behavior.
Unless indexing was stopped while doing the two queries the difference could be in the docs that came in in the last moments since the Kibana query.
Also make sure Kibana does not subtract a small fixed delta to what it considers now by inspecting the query sent to ES.
Any ideas how to pinpoint records that are not shown by Kibana?
this is reproducible on my end... it's off by a lot not a little..