Elasticearch: Load balanced 2 master nodes

[Schoof]

@Christian_Dahlqvist

In order to avoid split-brain scenarios and resulting data loss, Elasticsearch requires a majority of master eligible nodes to be available in order to elect a master node. With only 2 master eligible nodes the majority is 2 nodes. This means that you can not elect a master if one of the nodes is missing.

Once you have 3 master eligible nodes in the cluster, the size of the majority is still 2, which means you can lose one node and still be able to elect a master.

Does the third (master only) node need to be on a separate server? To be certain that when one server is down, everything is still consistent?

So if I get this right we should set up:
Server one:

node.data: true
node.ingest: true
node.master: true
discovery.zen.ping.unicast.hosts: ["node1", "node2", "node3"]
discovery.zen.minimum_master_nodes: 2

Server two:

node.data: true
node.ingest: true
node.master: true
discovery.zen.ping.unicast.hosts: ["node1", "node2", "node3"]
discovery.zen.minimum_master_nodes: 2

Server three:

node.data: false
node.ingest: false
node.master: true
discovery.zen.ping.unicast.hosts: ["node1", "node2", "node3"]
discovery.zen.minimum_master_nodes: 2

Then we should be safe if any of the servers are down?