I think this is the situation described in this longstanding issue:


Elasticsearch generally prefers to allocate shards to empty nodes, so if you add a node and then create some indices before the cluster has finished rebalancing then it will allocate more shards to the new nodes than you might expect.

For now you can try and use the index-level setting [`index.routing.allocation.total_shards_per_node`](https://www.elastic.co/guide/en/elasticsearch/reference/current/allocation-total-shards.html#allocation-total-shards) to ensure that no node receives more than its fair share of shards of a new index.