我有弹性搜索和REST API的远程地址的问题（获取搜索结果）

我正在使用由jHispter（logstash Elasticsearch Kibana）创建的ELK堆栈 . 当我使用REST搜索API（通过cURL）和外部服务器地址时，我得到的结果比使用localhost时要少：

$ curl -X GET "http://localhost:9200/logstash-*/_search?q=Method:location"
{"took":993,"timed_out":false,"num_reduce_phases":13,"_shards": 
{"total":6370,"successful":6370,"skipped":0,"failed":0},"hits": 
{"total":8994099,"max_score":5.0447145,"hits":[..]}}

当从不同的服务器执行时，它返回较少数量的分片和命中：

$ curl -X GET "http://SERVER_URL/logstash-*/_search?q=Method:location"
{"took":10,"timed_out":false,"_shards": 
{"total":120,"successful":120,"skipped":0,"failed":0},"hits": 
{"total":43,"max_score":7.5393815,"hits":[..]}}

如果我创建ssh隧道它工作：

ssh -L 9201:SERVER_URL:9200 elk-stack

现在：

$ curl -X GET "localhost:9201/logstash-*/_search?q=Method:location"
{"took":640,"timed_out":false,"num_reduce_phases":13,"_shards": 
{"total":6370,"successful":6370,"skipped":0,"failed":0},"hits": 
{"total":8995082,"max_score":5.0447145,"hits":[..]}}

所以访问localhost之外的数据一定有问题，但我无法在配置中找到如何更改它（可能是某种默认行为，以防止从远程访问时数据泄漏？）

elasticsearch kibana