Monitoring data not same with curl count why?

Elastic Stack Elasticsearch
1 
[root@xx.xx.xx config]# curl -XGET http://xx.xx.xx:9200/xx-20171212-1224/_count?pretty
{
  "count" : **467110397**,
  "_shards" : {
    "total" : 36,
    "successful" : 36,
    "skipped" : 0,
    "failed" : 0

use kibana data count the data same with curl..

image
image.png1588×585 31.8 KB

monitoring data not same with this..
image
image.png1375×165 12.2 KB

image
image.png707×223 7.65 KB

2

if i close the index. and open again.
the output is bad..

"_shards" : {
"total" : 108,
"successful" : 108,
"failed" : 0
},
"_all" : {
"primaries" : {
"docs" : {
"count" : 1164334263,
"deleted" : 0
},
"store" : {
"size_in_bytes" : 175744377852,
"throttle_time_in_millis" : 0
},
"indexing" : {
"index_total" : 0,
"index_time_in_millis" : 0,
"index_current" : 0,
"index_failed" : 0,
"delete_total" : 0,
"delete_time_in_millis" : 0,
"delete_current" : 0,
"noop_update_total" : 0,
"is_throttled" : false,
"throttle_time_in_millis" : 0
},

why?

3

It looks ok to me.

4

yes i see some indices in my cluster is the same .
but one type of index is no same...

5

In one case you count all the documents what ever the index is (1.164.334.263) and in the other case you just looked at one index named xx-20171212-1224 (467.110.397).

So everything looks good to me.

6

But in one of the screenshots, it shows 1.2B documents for 1 index alone. It shows "1 of 177" indices.

7

On the second screenshot, the count you see includes the nested documents that are present in top-level documents in your index.

8

Thanks for the clarification @val. Does that mean the curl request doesn't include the nested documents?

9

The _count API does not include the number of nested documents in your index, indeed. Instead you can use the following call to get the correct doc count including the nested ones

curl -XGET http://xx.xx.xx:9200/xx-20171212-1224/_stats/docs?pretty

10

Awesome. It was quite a learning. Thank you Val.

11

Always glad to help :wink:

12

it the all number of docs?

13

I didn't get you @zqc0512

14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.