I have a cluster with three elasticsearch nodes, and I'm running a query that returns a lot of hits, via Kibana. The indexes hit by the search are using the default settings of 5 shards, 1 replica; the shards are distributed more or less evenly across the three nodes.
Now due to the large amount of data, the search takes long to execute. Out of curiosity, I checked the three nodes, and I noticed that two of them have a noticeable increase in CPU utilization while executing the search, while the third does not. (Update: I see the same pattern with IO activity.) Could it be the case that the query is being distributed to shards residing only on the two nodes, while the third is omitted for some reason?