Probably _count is a bit faster since it doesn’t have to execute a full query with ranking and result fetching and can simply return the size.
It would be interesting to know a bit more about how you manage to get different results though. For that I need more information like what exact queries you are sending and if any indexing is going on on the index.
But suppose that you do the following
- index some documents
- refresh the index
_search and _count (with a match all query) should return the same total. If not, that’d be very weird.