We may have issues with the master being able to keep up with it's duties while handling both roles. This has been brought up in the past and could do with more investigation.
https://wikitech.wikimedia.org/wiki/Incident_documentation/20150615-Elasticsearch
Status: In progress Improve ES reliability with an architecture change? Related commit: https://gerrit.wikimedia.org/r/218421
If we're going to have master only nodes lets not use our huge data nodes for that. I hope this helps with stability shit. Query nodes probably won't help us - the kinds of issues we're hitting probably won't be hit on the query nodes - only the data nodes will fail and the query nodes will do nothing. So I'm not against doing the three way split - I just think we should do the right thing by hardware for it.