Elastic data nodes not sharing load equally

Elastic Stack Elasticsearch
1

hi,

I have 3 master and 4 data nodes as part of my elk setup.

We have a load balancer infront of the data nodes as well and it seems that the load is still not being divided evenly. One of the data nodes would have 80% of the load and the other 3 would share the rest. I checked the yaml files and they are all the same.
Can anyone provide any recommendations?

2

Look at the shard allocation and check Kibana to see if any shards on that node have a high ingest/search rate. If you had daily indices, no replicas, and a decent ingest rate, then you would end up with one node being busy on any given day.