Confused about health information I received

Elastic Stack Elasticsearch
1

I am trying to follow a tutorial and as far as I know there should only be one running Elasticsearch instance and 3 documents added to 1 index. When I asked for health, it told me there are 2 nodes and 11 shards.

{
"cluster_name": "elk1",
"status": "green",
"timed_out": false,
"number_of_nodes": 2,
"number_of_data_nodes": 2,
"active_primary_shards": 11,
"active_shards": 22,
"relocating_shards": 0,
"initializing_shards": 0,
"unassigned_shards": 0,
"delayed_unassigned_shards": 0,
"number_of_pending_tasks": 0,
"number_of_in_flight_fetch": 0,
"task_max_waiting_in_queue_millis": 0,
"active_shards_percent_as_number": 100
}

I'm still reading about shards and data distribution among multiple nodes, but even so the output is confusing. There should only be one node as I'm pretty sure I'm only running one ElasticSearch instance. As a side question, how are documents distributed among shards: vertically or horizontally? In other words if there are 3 documents in one index, is all of doc1 in a shard, or are some fields in doc1 in one shard and the remaining fields in another shard?

2

I'm still reading about shards and data distribution among multiple nodes, but even so the output is confusing. There should only be one node as I'm pretty sure I'm only running one Elasticsearch instance.

Use the nodes info API to get more information about the nodes in the cluster. There are also APIs for listing which indexes you have. I strongly recommend you to install and use a dashboard plugin such as kopf, ElasticHQ, head, or Marvel.

As a side question, how are documents distributed among shards: vertically or horizontally? In other words if there are 3 documents in one index, is all of doc1 in a shard, or are some fields in doc1 in one shard and the remaining fields in another shard?

Documents are never split between shards, i.e. any given document belongs to exactly one shard.

3

I have Marvel, and I printed my current nodes, but it still shows two nodes with the exact same node name and cluster name. I don't recall running two different elasticsearch instances.

4

The cluster name will by definition be the same. Where are those instances running? Which IP address and port?

5

localhost:9300 and localhos:9301

6

But then you are running two ES instances on your machine.