Node Role Imbalance Causing Hotspots
warningImproper distribution of shards or unbalanced node roles can cause resource hotspots where some nodes are overloaded while others are underutilized.
Significant variance in elasticsearch.node.shards.size or elasticsearch.os.cpu.usage across nodes, with some nodes showing >80% CPU while others <30%
Check shard distribution via _cat/shards and _cat/allocation APIs. Review cluster.routing.allocation.balance settings (shard, index, threshold). Common causes: (1) Index-specific shard allocation rules concentrating indices on subset of nodes, (2) Disk watermark causing uneven distribution, (3) Mixed node types (hot/warm/cold) not properly utilized. Use _cluster/reroute to manually rebalance if needed, then adjust allocation settings. Verify node attributes and index-level allocation filtering. For data tiers, ensure proper ILM configuration (elasticsearch.ilm). Monitor elasticsearch.nodes_roles to verify intended role distribution.