@timroes says a lot of things, among them, this:

It seems that you use rest_total_hits_as_int in https://github.com/elastic/kibana/blob/master/x-pack/plugins/actions/server/usage/actions_telemetry.ts#L38 (and further down in that file and the same in the alerts_telemetry file). It seems you never actually use it (since you don't seem to read the hits.total anywhere from that response). Since this parameter is deprecated (#26356) (and potentially slower than withou - though most likely not in your case) would you mind removing it?

Regarding event_log 😄 https://github.com/elastic/kibana/blob/master/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts#L291 There is should be converted into the new track_total_hits >The comment suggest it's done because of the old typings. You can temporarily use https://github.com/elastic/kibana/blob/master/x-pack/typings/elasticsearch/index.d.ts#L57 which supports also the new format until the elasticsearch typings have fixed that

If you set track_total_hits=true it will automatically track all and return you the exact amount, but in the new format { total: { relation: 'eq', value: 12536123 } }