Elastic data nodes not sharing load equally

hi,

I have 3 master and 4 data nodes as part of my elk setup.

We have a load balancer infront of the data nodes as well and it seems that the load is still not being divided evenly. One of the data nodes would have 80% of the load and the other 3 would share the rest. I checked the yaml files and they are all the same.
Can anyone provide any recommendations?

Look at the shard allocation and check Kibana to see if any shards on that node have a high ingest/search rate. If you had daily indices, no replicas, and a decent ingest rate, then you would end up with one node being busy on any given day.