Elasticsearch is a NoSQL database optimized for searching.

A cluster is created by sharing the same cluster.name for every node. Data is distributed automatically and redundantly.

Taking nodes out of the cluster is more challenging. First, make sure that the cluster status is green. Take down a node, wait for the cluster to rebalance and redistribute the data (status yellow), then repeat until only three nodes are left (fewer or more depending on your replication settings). Freeze the cluster by preventing shard rebalancing:

curl -XPUT 'localhost:9200/_cluster/settings' -d '{
    "transient" : {
        "cluster.routing.allocation.enable" : "none"
    }
}'

Data is divided into indexes, which can be compared to database tables, and those are divided into shards which are spread across the cluster. Get the shards for the indexes you want to move:

curl -XGET '192.168.2.35:9200/_cat/shards/yourindex'
yourindex 1 p STARTED 537256 1.9gb 192.168.0.45 anothernode
yourindex 2 p STARTED 537506   2gb 192.168.0.35 laptop
yourindex 4 p STARTED 536696 1.9gb 192.168.0.35 laptop
yourindex 3 p STARTED 537859 1.9gb 192.168.0.35 laptop
yourindex 0 p STARTED 537282 1.9gb 192.168.0.35 laptop

Finally, force the reallocation:

curl -XPOST 'localhost:9200/_cluster/reroute' -d '{ "commands":
  [{ "move" :
      { "index" : "yourindex", "shard" : 1, "from_node": "anothernode", "to_node": "laptop" }
  }]
}'

Take the node down as soon as the cluster status is green again and reactivate balancing. Transient settings are lost after restarting the service.

curl -XPUT 'localhost:9200/_cluster/settings' -d '{
    "transient" : {
        "cluster.routing.allocation.enable" : "all"
    }
}'