# How to setup a cluster from scratch **URL:** \ **Category:** Elasticsearch\ **Created:** [July 4, 2023, 12:53pm UTC](https://discuss.elastic.co/t/how-to-setup-a-cluster-from-scratch/337564 "2023-07-04T12:53:02Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Dheeraj\_Gupta](https://avatars.discourse-cdn.com/v4/letter/d/49beb7/32.png) [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Post date:** [July 4, 2023, 12:53pm UTC](https://discuss.elastic.co/t/how-to-setup-a-cluster-from-scratch/337564/1 "2023-07-04T12:53:02Z")
Hi, I have been using elasticsearch for a long time. Our initial cluster was setup in 5.x days (installation procedures have been 'lost') and we have performed rolling upgrade ever since. Currently the cluster is 8.8 with no security (It is on an isolated firewalled network segment). Recently I tried to setup a new multi node cluster (3 master + 2 data) from scratch for ES 8.6 and I couldn't figure out the correct order in which nodes should be started/configured/installed The setup I have in mind is 3 masters esmaster[123] (10.0.0.1,2,3) and 2 data esdata[12] (10.0.0.11,12) I tried to do something like - Install elasticsearch on esmaster1. - Set node.roles to `master` and set `cluster.initial_master_nodes` to `[10.0.0.1]`. It started OK but since primary shards are unallocated, I cannot run any query (`_cat/nodes`) or generate enrollment token for other nodes Do I set the role to default (data + master) on this node, then add further nodes (using the generated token) and _then_ take away the data role from esmaster1? Or is there some other ways by which I can go about the cluster building phase? I am really sorry for this basic question but I cannot find the answer in the docs. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 4, 2023, 12:58pm UTC](https://discuss.elastic.co/t/how-to-setup-a-cluster-from-scratch/337564/2 "2023-07-04T12:58:48Z")
> [@Dheeraj\_Gupta](#): > > Or is there some other ways by which I can go about the cluster building phase? You need to configure your 3 master nodes and 1 data node and start them at basically the same time, after that you can add the other data node, but there is no issue if you configure all your nodes and start them at the same time. ---
**Author:** ![Dheeraj\_Gupta](https://avatars.discourse-cdn.com/v4/letter/d/49beb7/32.png) [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Post date:** [July 4, 2023, 1:59pm UTC](https://discuss.elastic.co/t/how-to-setup-a-cluster-from-scratch/337564/3 "2023-07-04T13:59:42Z")
> [@leandrojmp](#): > > You need to configure your 3 master nodes and 1 data node But how to do that without enrollment token? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 4, 2023, 2:09pm UTC](https://discuss.elastic.co/t/how-to-setup-a-cluster-from-scratch/337564/4 "2023-07-04T14:09:19Z")
> [@Dheeraj\_Gupta](#): > > But how to do that without enrollment token? Not sure how to do it using enrollment tokens, never used it, I always spin-up clusters using the traditional way where you configure the `elasticsearch.yml` file and start your cluster. In the traditional way you basically just configure the cluster initial master nodes, the SSL certificates for the transport protocol communication and start your node. If it helps I made a small tutorial on how to spin-up a 3 node cluster on version 8 that you can find [here](https://web.leandrojmp.com/posts/en/2022/10/elasticsearch-security). ---
**Author:** ![Dheeraj\_Gupta](https://avatars.discourse-cdn.com/v4/letter/d/49beb7/32.png) [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Post date:** [July 4, 2023, 2:31pm UTC](https://discuss.elastic.co/t/how-to-setup-a-cluster-from-scratch/337564/5 "2023-07-04T14:31:18Z")
Thanks for the link. It helps in understanding the startup process. I think enrollment tokens are supposed to automate this workflow but not sure how they would be used in this scenario. As a separate question, when certificates (esp CA ones expire) how do we refresh them in entire cluster? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 1, 2023, 2:32pm UTC](https://discuss.elastic.co/t/how-to-setup-a-cluster-from-scratch/337564/6 "2023-08-01T14:32:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.