Primary and replica shard is very different

Elastic Stack Elasticsearch
1

When I check shard size through /_cat/shards, primary shard size and replica shard size is very different

index shard prirep state docs store ip node
result-search-ip-9 0 p STARTED 4418 2mb 192.168.41.47 threat-inside-es-node-3
result-search-ip-9 0 r STARTED 4418 3.5mb 192.168.41.77 threat-inside-es-node-2
result-search-ip-9 1 p STARTED 4392 1.4mb 192.168.41.77 threat-inside-es-node-2
result-search-ip-9 1 r STARTED 4392 2mb 192.168.41.47 threat-inside-es-node-3
result-search-ip-9 2 p STARTED 4360 38.7mb 192.168.41.47 threat-inside-es-node-3
result-search-ip-9 2 r STARTED 4360 407.8mb 192.168.41.77 threat-inside-es-node-2
result-search-ip-9 3 p STARTED 4399 1.3mb 192.168.41.77 threat-inside-es-node-2
result-search-ip-9 3 r STARTED 4400 1.4mb 192.168.41.47 threat-inside-es-node-3

Shard number 2 has primary and replica shard and size is 38.7mb and 407.8mb.
I think shard size between primary and replica shard should be similar.
Replica shard of result-search-ip-2 is 10 times bigger than primary shard.
I want to know why shard size is very different.

2

It looks as if the number of documents are the same though. You can use the cat segments endpoint to check if the segments are the same.

Also, which elasticsearch version is this?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.