I find some of nodes were running into max bulk queue. But after I stop all my rsyslog/logstash process, the bulk queue size didn't decease. Some other nodes would even increase its bulk queue size!
I try to get hot_threads of such node, got only two lucene segment merge thread. (old indices)