Elasticearch: Load balanced 2 master nodes

Does the third (master only) node need to be on a separate server? To be certain that when one server is down, everything is still consistent?

So if I get this right we should set up:
Server one:

node.data: true
node.ingest: true
node.master: true
discovery.zen.ping.unicast.hosts: ["node1", "node2", "node3"]
discovery.zen.minimum_master_nodes: 2

Server two:

node.data: true
node.ingest: true
node.master: true
discovery.zen.ping.unicast.hosts: ["node1", "node2", "node3"]
discovery.zen.minimum_master_nodes: 2

Server three:

node.data: false
node.ingest: false
node.master: true
discovery.zen.ping.unicast.hosts: ["node1", "node2", "node3"]
discovery.zen.minimum_master_nodes: 2

Then we should be safe if any of the servers are down?