Install Elastic Stack using Relativity Server CLI

Elasticsearch data and log directories must not be located on the OS drive (C:) or on temporary storage.
Use dedicated, persistent, high-performance storage (SSD or NVMe).
The Elasticsearch data disk must not be shared with the operating system.
Before extracting any downloaded files on the target machine, see How to Unblock Downloaded Files.

Choose the installation option that matches your environment:

Option	Topology	Package source
Online	Single node / Multi-node	Downloaded directly from `https://artifacts.elastic.co/downloads`
Offline	Single node / Multi-node	Read from a local directory or BCP network share

Supported Elastic Stack versions

The Relativity Server CLI lists officially supported versions in its interactive menu. As of the current release, the supported versions are:

Version	Series
`8.19.8`	8.x (latest supported 8.x build)
`9.1.3`	9.x
`9.3.0`	9.x
`9.4.3`	9.x (latest supported 9.x build)

See Supported Elastic Stack Versions for the definitive, up-to-date supported version list for your Relativity build.

To use a version not in the menu, select Enter custom version in interactive mode or pass --elastic-stack-version "X.Y.Z" (alias: -v "X.Y.Z") in non-interactive mode.

In multi-node deployments, every node in the cluster must run the same Elastic Stack version. Mixing versions within a cluster is not supported.

Node role definitions

Role (`--node-role`)	Components installed	Description
`all-in-one`	Elasticsearch, Kibana, APM Server	Single-node role. Installs all components on one machine. Use for single-node deployments only.
`master-data-kibana`	Elasticsearch, Kibana, APM Server	Combines master, data, and ingest roles. Also installs Kibana and APM Server.
`master-data`	Elasticsearch only	Combines master-eligible and data roles. Stores shard data and participates in master elections. Does not install Kibana or APM Server.
`dedicated-master`	Elasticsearch only	Manages cluster state and master election. Does not store shard data.
`data`	Elasticsearch only	Stores shard data and handles indexing and search workloads.

Seed hosts format: The --seed-hosts value is written directly to discovery.seed_hosts in elasticsearch.yml. You can use short hostnames (node1:9300), fully qualified domain names (node1.contoso.local:9300), or IP addresses (192.168.1.10:9300) - use whichever form resolves reliably between all cluster nodes. Always include the transport port :9300.

**--initial-master-nodesvs.--seed-hosts:** --initial-master-nodes takes plain hostnames with no port (node1,node2,node3), unlike --seed-hosts, which requires :9300on each entry.--initial-master-nodes` is only required on the bootstrap node at install time - do not specify it on non-bootstrap nodes.

Online

Single-Node

Installation Steps

Run all commands in an elevated PowerShell window using the relservice or admin account. To skip all interactive prompts, run a single non-interactive command. The --quiet flag suppresses all interactive prompts; the command exits with an error if any required flag is missing.

Copy

.\relsvr.exe install --quiet --cert-option 1 --cert-output-path "<cert-output-path>" --es-nodes "<hostname>" --kibana-host "<hostname>" --apm-host "<hostname>" --elastic-stack-version "<version>" --node-role "all-in-one" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Or follow the interactive prompts:

Open an elevated PowerShell window and run the following command:
Copy
```
.\relsvr.exe install
```
When prompted with What would you like to setup?, press Enter to select Elastic Stack.
When prompted with Install the Elastic Stack?, enter y.
When prompted to Select certificate option, select 1 to create a new self-signed CA and certificates.
When prompted for Elasticsearch node hostnames or IPs, enter the hostname of this machine.
When prompted for Kibana hostname or IP, enter the hostname of this machine.
When prompted for APM Server hostname or IP, enter the hostname of this machine.
When prompted for Output directory for generated cert files, press Enter to use the current directory, or enter a custom path.
When prompted Which Elastic Stack version do you want to use?, select a version from the list, or select Enter custom version to type a specific version (for example, 9.4.0).
When prompted with Use a custom Elastic package source?, enter n to download packages from the internet.
When prompted Which node role should this machine have?, select all-in-one.
When prompted with Use custom storage paths for Elasticsearch data and logs?, enter y and provide the path, or n to use the defaults.

The installer creates the specified directories automatically if they do not already exist.
The installation proceeds automatically.

Sample interactive session

Copy

PS C:\elastic\Relativity.Server.Cli.102.1.19\tools> .\relsvr.exe install

Relativity Server CLI - 102.1.19
Copyright (c) 2026, Relativity ODA LLC


What would you like to setup?

> Elastic Stack

Install the Elastic Stack? [y/n] (y): y

All options will archive the resulting certificates and stage them to the target path.
Select certificate option:

> [1] Create a new self-signed CA and all required certificates
  [2] Use existing CA to generate all required certificates
  [3] Use existing certificates from provided path

Selected certificate option: 1
Elasticsearch node hostnames or IPs (comma-separated): (): emttest
Kibana hostname or IP: (): emttest
APM Server hostname or IP: (): emttest
Output directory for generated cert files (leave blank for current directory): ():
WARNING: --cert-output-path was not specified. Certificates will be written to: C:\elastic\Relativity.Server.Cli.102.1.19\tools
Certificates written to C:\elastic\Relativity.Server.Cli.102.1.19\tools and zipped as elastic-certs.zip. Before running the EW MSI installer on any node, copy elastic-certs.zip to the BCP share:
\\{sql-primary}\BCPPath\EnvironmentWatch\ (replace {sql-primary} with your SQL primary hostname). The MSI installer will verify this file is present before proceeding.
The "Open and Free" Elasticsearch product can be installed to support features like Datagrid/Audit and Environment Watch that search billions of unstructured JSON documents in seconds.

Which Elastic Stack version do you want to use for this installation?

> 8.19.8
  9.1.3
  9.3.0
  Enter custom version...

Enter the Elastic Stack version to install (format: X.Y.Z, e.g., 9.4.0): (): 9.4.0
Selected Elastic Stack version: 9.4.0
Recommended distribution source path: \\{server}\BCPPath\EnvironmentWatch\ElasticPackages
Use a custom Elastic package source? [y/n] (n): n
Which node role should this machine have in the Elastic Stack cluster?

> all-in-one
  dedicated-master
  master-data
  master-data-kibana
  data

Selected node role: all-in-one
Selected Elastic Stack components to install: Elasticsearch,Kibana,APM Server
Use custom storage paths for Elasticsearch data and logs? [y/n] (n): y
Enter the Elasticsearch data storage path (e.g. D:\elastic-data): (D:\elastic-data): D:\elastic-data
Enter the Elasticsearch logs storage path (e.g. D:\elastic-logs): (D:\elastic-logs): D:\elastic-logs

Multi-Node

Prerequisites

Before installing any node, ensure the following are in place on all cluster machines:

Elevated account: Run all commands in an elevated PowerShell window using the relservice or admin account.
Firewall: TCP port 9300 must be open between all Elasticsearch nodes (transport layer). TCP port 9200 must be reachable from Relativity servers. TCP 5601 (Kibana) and 8200 (APM Server) must be reachable from clients.
DNS: Every node must be able to resolve the hostnames of all other nodes. Test with Resolve-DnsName <other-node-hostname> from each machine before starting the install.

Cluster topology (example)

Copy

  bootstrap node              non-bootstrap node(s)
  ┌─────────────────────┐     ┌────────────────────┐
  │  master-data-       │     │  master-data       │
  │  kibana             │◄───►│                    │
  │                     │     │  Elasticsearch     │
  │  Elasticsearch      │     │  [master + data]   │
  │  [master+data+      │     └────────────────────┘
  │   ingest]           │
  │  Kibana             │     ┌────────────────────┐
  │  APM Server         │◄───►│  data / dedicated- │
  └─────────────────────┘     │  master (optional) │
                              └────────────────────┘

           :9300
  (transport, all nodes)
        :9200 :5601 :8200
  (HTTP / Kibana / APM - bootstrap node)

Recommended topology: Use 3 master-eligible nodes in production (an odd number, so the cluster can still hold a master-election quorum if one node is unreachable - a 2-node master-eligible layout has no quorum tolerance). The diagram above shows the minimum viable 2-node layout for illustration; for a 3-node cluster, add a third master-eligible role (dedicated-master or master-data) as a non-bootstrap node. Non-master-eligible data nodes can be added independently on top of this to scale storage and search capacity without affecting quorum.

Any master-eligible role (master-data-kibana, master-data, dedicated-master) can be the bootstrap node. The bootstrap role installs first and generates TLS certificates for the cluster. Install order: bootstrap node | non-bootstrap nodes.

Bootstrap Node

The bootstrap node initializes the cluster and generates TLS certificates for all nodes. Install it first. Any master-eligible role (master-data-kibana, master-data, or dedicated-master) can serve as the bootstrap node.

The walkthroughs below use master-data-kibana as the bootstrap role. To install a different role, replace --node-role in any command with one of: master-data-kibana, master-data, dedicated-master. See the Sample commands section for full examples per role.

After the bootstrap node installs - extract and share the cert archive:

The installer writes elastic-certs.zip to the CLI directory (or to the path given by --cert-output-path).

Extract the archive (adjust the source path if you used --cert-output-path):

Copy

Expand-Archive -Path "C:\elastic\publish-cli\elastic-certs.zip" -DestinationPath "C:\elastic\publish-cli\elastic-certs"

Share the extracted folder as an SMB share accessible from all other nodes:

Copy

New-SmbShare -Name "elastic-certs" -Path "C:\elastic\publish-cli\elastic-certs" -FullAccess "Domain Users"

When installing each non-bootstrap node, reference the share with --cert-package (must point to the directory, not the zip):
Copy
```
--cert-package "\\<bootstrap-node>\elastic-certs"
```
After every non-bootstrap node has joined the cluster, remove the share and delete the extracted cert directory - it was granted full access and is no longer needed once all nodes have their certificates:
Copy
```
Remove-SmbShare -Name "elastic-certs" -Force
Remove-Item -Path "C:\elastic\publish-cli\elastic-certs" -Recurse -Force
```

Flags that vary by node role on the bootstrap node:

data is not master-eligible and cannot serve as the bootstrap node - see the Node role definitions table above. It is omitted from this table.

Flag	`master-data-kibana`	`master-data`	`dedicated-master`
`--kibana-host`	Required	-	-
`--apm-host`	Required	-	-
`--es-nodes`	Required	Required	Required
`--bootstrap-cluster`	Bootstrap node only	Bootstrap node only	Bootstrap node only

Master-data-Kibana node

The master-data-kibana role installs Elasticsearch (with master, data, and ingest roles), Kibana, and APM Server.

Non-interactive command:

Copy

.\relsvr.exe install --quiet --cert-option 1 --cert-output-path "<cert-output-path>" --elastic-stack-version "<version>" --node-role "master-data-kibana" --bootstrap-cluster --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --initial-master-nodes "<node1>,<node2>,<node3>" --es-nodes "<node1>,<node2>,<node3>" --kibana-host "<node1>" --apm-host "<node1>" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Cert flags explained:

--cert-option 1 - generates a new Root CA and per-host TLS certificates on this node.
--cert-output-path - directory to write the generated certificate archive (elastic-certs.zip); if omitted, the archive is written to the CLI's working directory.
--es-nodes - comma-separated list of all Elasticsearch node hostnames; a cert is generated for each.
--kibana-host / --apm-host - hostnames of the nodes that will run Kibana and APM Server; certs are pre-generated for them here.

After installation, make the bootstrap node's cert directory available as a network share. Reference that share path with --cert-package on all non-bootstrap nodes (the path must point to a directory, not a zip file).

Interactive walkthrough:

Open an elevated PowerShell window and run:
Copy
```
.\relsvr.exe install
```
Select Elastic Stack from the installation menu and confirm.
When prompted to Select certificate option, select 1 to generate a new self-signed CA and all required certificates.
When prompted for Elasticsearch node hostnames or IPs, enter all node hostnames, comma-separated (e.g. node1,node2,node3).
When prompted for Kibana hostname or IP, enter the hostname of the node running Kibana.
When prompted for APM Server hostname or IP, enter the hostname of the node running APM Server.
When prompted for Output directory for generated cert files, press Enter to use the current directory, or enter a custom path.
Select the Elastic Stack version from the list of supported versions.
When prompted with Use a custom Elastic package source?, enter n to download from the internet.
When prompted Which node role should this machine have?, select master-data-kibana.
Enter the cluster name (e.g. my-cluster). Use the same value on every node.
Enter the seed hosts - comma-separated with port :9300 for each node.
When prompted Bootstrap this cluster?, enter y.
When prompted for initial master nodes, press Enter to derive from seed hosts, or provide them explicitly.
When prompted to select components, confirm all three: Elasticsearch, Kibana, and APM Server.
When prompted with Use custom storage paths?, enter y and provide paths, or n to use defaults.

Sample interactive session - master-data-kibana (bootstrap)

Copy

PS C:\elastic\publish-cli> .\relsvr.exe install

Install the Elastic Stack? [y/n] (y): y

All options will archive the resulting certificates and stage them to the target path.
Select certificate option:

> [1] Create a new self-signed CA and all required certificates
  [2] Use existing CA to generate all required certificates
  [3] Use existing certificates from provided path

Selected certificate option: 1
Elasticsearch node hostnames or IPs (comma-separated): (): node1.contoso.local,node2.contoso.local,node3.contoso.local
Kibana hostname or IP: (): node1.contoso.local
APM Server hostname or IP: (): node1.contoso.local
Output directory for generated cert files (leave blank for current directory): ():
WARNING: --cert-output-path was not specified. Certificates will be written to: C:\elastic\publish-cli
Certificates written to C:\elastic\publish-cli and zipped as elastic-certs.zip.

Which Elastic Stack version do you want to use for this installation?

  8.19.8
  9.1.3
> 9.3.0
  Enter custom version...

Selected Elastic Stack version: 9.3.0
Recommended distribution source path: \\{server}\BCPPath\EnvironmentWatch\ElasticPackages
Use a custom Elastic package source? [y/n] (n): n

The cert output path shown above (C:\elastic\publish-cli) is where elastic-certs.zip was written. Before installing any non-bootstrap node, extract this zip and share the resulting directory. See the After the bootstrap node installs note above.

Copy

Which node role should this machine have in the Elastic Stack cluster?
> master-data-kibana

Selected node role: master-data-kibana
Enter the cluster name (must be identical on every node in the cluster): my-cluster
Cluster name: my-cluster
Enter seed hosts - comma-separated hostnames or IPs of all master-eligible nodes on port 9300 (e.g. node1:9300,node2:9300): node1.contoso.local:9300,node2.contoso.local:9300,node3.contoso.local:9300
Seed hosts: node1.contoso.local:9300,node2.contoso.local:9300,node3.contoso.local:9300
Bootstrap this cluster? [y/n] (n): y
Enter initial master nodes - comma-separated hostnames of all master-eligible nodes (leave blank to derive from seed hosts): 
Initial master nodes: (derived from seed hosts)
Select Elastic Stack components to install:
[x] Elasticsearch
[x] Kibana
[x] APM Server
Selected Elastic Stack components to install: Elasticsearch,Kibana,APM Server
Use custom storage paths for Elasticsearch data and logs? [y/n] (n): y
Enter the Elasticsearch data storage path (e.g. D:\elastic-data): (D:\elastic-data): D:\elastic-data
Elasticsearch data path: D:\elastic-data
Enter the Elasticsearch logs storage path (e.g. D:\elastic-logs): (D:\elastic-logs): D:\elastic-logs
Elasticsearch logs path: D:\elastic-logs

Checkpoint - verify bootstrap node before proceeding:

Copy

Get-Service -Name elasticsearch

Wait until the service status is Running. Cluster health shows red at this stage - expected with no data nodes yet. Do not proceed to non-bootstrap nodes until the service is running.

Non-Bootstrap Nodes

After the bootstrap node is running, install the remaining nodes using --cert-option 3 with the path to the bootstrap node's cert directory.

Checkpoint after each node joins: Before installing the next node, verify the new node appears in the cluster:

Copy

curl.exe -sk -u "elastic" https://<any-es-node>:9200/_cat/nodes?v

Enter the elastic password when prompted (C:\elastic\secrets\elastic-user.txt). Confirm the node appears with correct roles (m = master-eligible, d = data, i = ingest). The first data-eligible node generates credentials and uploads them to the Relativity Secret Store; each subsequent node retrieves elastic-user.txt and api-key.txt from the Secret Store automatically during install. Manually copy these files from the first data-eligible node's secrets directory only if the installer warns that the Secret Store is unreachable or the credential wasn't found there.

Master-data node

The master-data role installs Elasticsearch with master-eligible and data roles. Use this role for nodes that participate in master elections and store shard data but do not run Kibana or APM Server.

Non-interactive command:

Copy

.\relsvr.exe install --quiet --cert-option 3 --cert-package "\\<bootstrap-node>\elastic-certs" --elastic-stack-version "<version>" --node-role "master-data" --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Interactive walkthrough:

Open an elevated PowerShell window and run:
Copy
```
.\relsvr.exe install
```
Select Elastic Stack from the installation menu and confirm.
When prompted to Select certificate option, select 3 to use existing certificates from a provided path.
When prompted for the certificate package path, enter the path to the bootstrap node's cert directory (e.g. \\<bootstrap-node>\elastic-certs).
Select the same Elastic Stack version used by the cluster.
When prompted with Use a custom Elastic package source?, enter n.
When prompted Which node role should this machine have?, select master-data.
Enter the cluster name (must match all other nodes).
Enter the seed hosts - comma-separated with port :9300, including the bootstrap node and all previously joined nodes.
When prompted Bootstrap this cluster?, enter n.
When prompted with Use custom storage paths?, enter y and provide paths, or n to use defaults.

Sample interactive session - master-data (non-bootstrap)

Copy

PS C:\elastic\publish-cli> .\relsvr.exe install

Install the Elastic Stack? [y/n] (y): y

All options will archive the resulting certificates and stage them to the target path.
Select certificate option:

  [1] Create a new self-signed CA and all required certificates
  [2] Use existing CA to generate all required certificates
> [3] Use existing certificates from provided path

Selected certificate option: 3
Certificate package path (): \\node1.contoso.local\elastic-certs

Selected Elastic Stack version: 9.3.0
Recommended distribution source path: \\{server}\BCPPath\EnvironmentWatch\ElasticPackages
Use a custom Elastic package source? [y/n] (n): n

Which node role should this machine have in the Elastic Stack cluster?
> master-data

Selected node role: master-data
Enter the cluster name (must be identical on every node in the cluster): my-cluster
Cluster name: my-cluster
Enter seed hosts - comma-separated hostnames or IPs of all master-eligible nodes on port 9300 (e.g. node1:9300,node2:9300): node1.contoso.local:9300,node2.contoso.local:9300,node3.contoso.local:9300
Seed hosts: node1.contoso.local:9300,node2.contoso.local:9300,node3.contoso.local:9300
Bootstrap this cluster? [y/n] (n): n
Selected Elastic Stack components to install: Elasticsearch
Use custom storage paths for Elasticsearch data and logs? [y/n] (n): y
Enter the Elasticsearch data storage path (e.g. D:\elastic-data): (D:\elastic-data): D:\elastic-data
Elasticsearch data path: D:\elastic-data
Enter the Elasticsearch logs storage path (e.g. D:\elastic-logs): (D:\elastic-logs): D:\elastic-logs
Elasticsearch logs path: D:\elastic-logs

Dedicated-master and data nodes

The dedicated-master and data roles follow the same installation steps as master-data above. Only the --node-role value differs, and neither role installs Kibana or APM Server:

	`master-data`	`dedicated-master`	`data`
`--node-role` value	`master-data`	`dedicated-master`	`data`
Participates in master elections	Yes	Yes	No
Stores shard data	Yes	No	Yes
`--kibana-host` / `--apm-host`	Not used	Not used	Not used

**--elasticsearch-data-pathondedicated-master:** Set this flag even though dedicated-masterdoesn't store shard data - Elasticsearch still writes cluster state metadata topath.dataon every node, including master-only ones. If omitted, Elasticsearch falls back to its own defaultpath.data` under the install directory, which violates the storage requirement at the top of this page (data/log directories must not be on the OS drive or temporary storage). Always point it at dedicated, persistent storage, the same as for data-holding roles.

Non-interactive command (dedicated-master):

Copy

.\relsvr.exe install --quiet --cert-option 3 --cert-package "\\<bootstrap-node>\elastic-certs" --elastic-stack-version "<version>" --node-role "dedicated-master" --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Non-interactive command (data):

Copy

.\relsvr.exe install --quiet --cert-option 3 --cert-package "\\<bootstrap-node>\elastic-certs" --elastic-stack-version "<version>" --node-role "data" --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

At the interactive prompt Which node role should this machine have?, select dedicated-master or data instead of master-data. All other prompts are the same as the master-data walkthrough above.

Sample commands by cert option

The examples below show master-data-kibana as the bootstrap role and master-data as the non-bootstrap role. To install a different role, replace --node-role with one of: master-data-kibana, master-data, dedicated-master, or data. Remove --kibana-host and --apm-host for roles that do not install Kibana or APM Server (master-data, dedicated-master, data).

Cert Option 1 - Generate New CA

Bootstrap node (<node1>):

Copy

.\relsvr.exe install --quiet --cert-option 1 --cert-output-path "<cert-output-path>" --elastic-stack-version "<version>" --node-role "master-data-kibana" --bootstrap-cluster --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --initial-master-nodes "<node1>,<node2>,<node3>" --es-nodes "<node1>,<node2>,<node3>" --kibana-host "<node1>" --apm-host "<node1>" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Non-bootstrap node (<node2>, <node3>):

Copy

.\relsvr.exe install --quiet --cert-option 3 --cert-package "\\<bootstrap-node>\elastic-certs" --elastic-stack-version "<version>" --node-role "master-data" --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Cert Option 2 - Use Existing CA

Copy the CA PFX file to each non-bootstrap node (or place it on a shared path) before running the install command. Every node generates its own per-host certificates from the same CA, so the PFX file and password must be identical on all nodes.

Bootstrap node (<node1>):

Copy

.\relsvr.exe install --quiet --cert-option 2 --ca-pfx "<ca-pfx-path>" --ca-pfx-password "<ca-pfx-password>" --cert-output-path "<cert-output-path>" --elastic-stack-version "<version>" --node-role "master-data-kibana" --bootstrap-cluster --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --initial-master-nodes "<node1>,<node2>,<node3>" --es-nodes "<node1>,<node2>,<node3>" --kibana-host "<node1>" --apm-host "<node1>" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Non-bootstrap node (<node2>, <node3>):

Copy

.\relsvr.exe install --quiet --cert-option 2 --ca-pfx "<ca-pfx-path>" --ca-pfx-password "<ca-pfx-password>" --cert-output-path "<cert-output-path>" --elastic-stack-version "<version>" --node-role "master-data" --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Cert Option 3 - Use Existing Certificates

Cert Option 3 is for non-bootstrap nodes only. The bootstrap node generates the certificates; all subsequent nodes consume them via --cert-package.

Non-bootstrap node (<node2>, <node3>):

Copy

.\relsvr.exe install --quiet --cert-option 3 --cert-package "\\<bootstrap-node>\elastic-certs" --elastic-stack-version "<version>" --node-role "master-data" --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Offline

Prerequisites

On a machine with internet access, download the required packages and organize them in the following directory structure before transferring to the target environment.

Download locations:

Package	Download URL
Elasticsearch	`https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-{version}-windows-x86_64.zip`
Kibana	`https://artifacts.elastic.co/downloads/kibana/kibana-{version}-windows-x86_64.zip`
APM Server	`https://artifacts.elastic.co/downloads/apm-server/apm-server-{version}-windows-x86_64.zip`
mapper-size plugin	`https://artifacts.elastic.co/downloads/elasticsearch-plugins/mapper-size/mapper-size-{version}.zip`
RWSM NuGet package	`https://relativitypackageseastus.jfrog.io/artifactory/api/nuget/server-nuget-virtual/Download/Relativity.Windows.ServiceManager/2.24.0`

Example: Replace {version} with the target Elastic Stack version. For example, for version <version>:

Copy

https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-<version>-windows-x86_64.zip
https://artifacts.elastic.co/downloads/kibana/kibana-<version>-windows-x86_64.zip
https://artifacts.elastic.co/downloads/apm-server/apm-server-<version>-windows-x86_64.zip
https://artifacts.elastic.co/downloads/elasticsearch-plugins/mapper-size/mapper-size-<version>.zip

Required directory structure (example for Elastic Stack <version> and RWSM 2.24.0):

The folder names shown below are required, as the installation process relies on this structure.

Copy

C:\elastic-packages\
─ elasticsearch\
│   ─ elasticsearch-<version>-windows-x86_64.zip
│   └── plugins\
│       └── mapper-size-<version>.zip
─ kibana\
│   └── kibana-<version>-windows-x86_64.zip
─ apm-server\
│   └── apm-server-<version>-windows-x86_64.zip
└── tools\
    └── relativity.windows.servicemanager.2.24.0.nupkg

Transfer the entire directory structure to the offline machine or a BCP network share accessible from the target machine.

Single-Node

Installation Steps

Run all commands in an elevated PowerShell window using the relservice or admin account. To skip all interactive prompts, run a single non-interactive command:

Copy

.\relsvr.exe install --quiet --cert-option 1 --cert-output-path "<cert-output-path>" --es-nodes "<hostname>" --kibana-host "<hostname>" --apm-host "<hostname>" --elastic-stack-version "<version>" --node-role "all-in-one" --distribution-source "<packages-path>" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Or follow the interactive prompts:

Open an elevated PowerShell window and run the following command:
Copy
```
.\relsvr.exe install
```
When prompted with What would you like to setup?, press Enter to select Elastic Stack.
When prompted with Install the Elastic Stack?, enter y.
When prompted to Select certificate option, select 1 to create a new self-signed CA and certificates.
When prompted for Elasticsearch node hostnames or IPs, enter the hostname of this machine.
When prompted for Kibana hostname or IP, enter the hostname of this machine.
When prompted for APM Server hostname or IP, enter the hostname of this machine.
When prompted for Output directory for generated cert files, press Enter to use the current directory, or enter a custom path.
When prompted Which Elastic Stack version do you want to use?, select a version from the list, or select Enter custom version to type a specific version. Verify that the selected version matches the version of the packages you downloaded.
When prompted with Use a custom Elastic package source?, enter y.
Provide the local path or BCP path to the folder containing the pre-downloaded packages.
When prompted Which node role should this machine have?, select all-in-one.
When prompted with Use custom storage paths for Elasticsearch data and logs?, enter y and provide the path, or n to use the defaults.

The installer creates the specified directories automatically if they do not already exist.
The installation proceeds automatically.

Sample interactive session

Copy

PS C:\elastic\Relativity.Server.Cli.102.1.19\tools> .\relsvr.exe install

Relativity Server CLI - 102.1.19
Copyright (c) 2026, Relativity ODA LLC


What would you like to setup?

> Elastic Stack

Install the Elastic Stack? [y/n] (y): y

All options will archive the resulting certificates and stage them to the target path.
Select certificate option:

> [1] Create a new self-signed CA and all required certificates
  [2] Use existing CA to generate all required certificates
  [3] Use existing certificates from provided path

Selected certificate option: 1
Elasticsearch node hostnames or IPs (comma-separated): (): emttest
Kibana hostname or IP: (): emttest
APM Server hostname or IP: (): emttest
Output directory for generated cert files (leave blank for current directory): ():
WARNING: --cert-output-path was not specified. Certificates will be written to: C:\elastic\Relativity.Server.Cli.102.1.19\tools
Certificates written to C:\elastic\Relativity.Server.Cli.102.1.19\tools and zipped as elastic-certs.zip. Before running the EW MSI installer on any node, copy elastic-certs.zip to the BCP share:
\\{sql-primary}\BCPPath\EnvironmentWatch\ (replace {sql-primary} with your SQL primary hostname). The MSI installer will verify this file is present before proceeding.
The "Open and Free" Elasticsearch product can be installed to support features like Datagrid/Audit and Environment Watch that search billions of unstructured JSON documents in seconds.

Which Elastic Stack version do you want to use for this installation?

> 8.19.8
  9.1.3
  9.3.0
  Enter custom version...

Enter the Elastic Stack version to install (format: X.Y.Z, e.g., 9.4.0): (): 9.4.0
Selected Elastic Stack version: 9.4.0
Recommended distribution source path: \\{server}\BCPPath\EnvironmentWatch\ElasticPackages
Use a custom Elastic package source? [y/n] (n): y
Enter the distribution source path (e.g. \\{server}\BCPPath\EnvironmentWatch\ElasticPackages): (\\{server}\BCPPath\EnvironmentWatch\ElasticPackages): C:\elastic-packages
Distribution source: C:\elastic-packages
Which node role should this machine have in the Elastic Stack cluster?

> all-in-one
  dedicated-master
  master-data
  master-data-kibana
  data

Selected node role: all-in-one
Selected Elastic Stack components to install: Elasticsearch,Kibana,APM Server
Use custom storage paths for Elasticsearch data and logs? [y/n] (n): y
Enter the Elasticsearch data storage path (e.g. D:\elastic-data): (D:\elastic-data): D:\elastic-data
Enter the Elasticsearch logs storage path (e.g. D:\elastic-logs): (D:\elastic-logs): D:\elastic-logs

Multi-Node

Prerequisites

Before installing any node, ensure the following are in place on all cluster machines:

Elevated account: Run all commands in an elevated PowerShell window using the relservice or admin account.
Firewall: TCP port 9300 must be open between all Elasticsearch nodes (transport layer). TCP port 9200 must be reachable from Relativity servers. TCP 5601 (Kibana) and 8200 (APM Server) must be reachable from clients.
DNS: Every node must be able to resolve the hostnames of all other nodes. Test with Resolve-DnsName <other-node-hostname> from each machine before starting the install.
Packages: Ensure the package directory is accessible from all target nodes (local path or BCP share).

Cert option quick reference (offline): The cert flags are the same as Online - add --distribution-source "<packages-path>" to every command to point to your offline package directory. Full examples per cert option are in the Sample commands by cert option section below.

Bootstrap Node

After the bootstrap node installs - extract and share the cert archive:

The installer writes elastic-certs.zip to the CLI directory (or to the path given by --cert-output-path).

Extract the archive (adjust the source path if you used --cert-output-path):

Copy

Expand-Archive -Path "C:\elastic\publish-cli\elastic-certs.zip" -DestinationPath "C:\elastic\publish-cli\elastic-certs"

Share the extracted folder as an SMB share accessible from all other nodes:

Copy

New-SmbShare -Name "elastic-certs" -Path "C:\elastic\publish-cli\elastic-certs" -FullAccess "Domain Users"

When installing each non-bootstrap node, reference the share with --cert-package (must point to the directory, not the zip):
Copy
```
--cert-package "\\<bootstrap-node>\elastic-certs"
```
After every non-bootstrap node has joined the cluster, remove the share and delete the extracted cert directory - it was granted full access and is no longer needed once all nodes have their certificates:
Copy
```
Remove-SmbShare -Name "elastic-certs" -Force
Remove-Item -Path "C:\elastic\publish-cli\elastic-certs" -Recurse -Force
```

Flags that vary by node role on the bootstrap node:

data is not master-eligible and cannot serve as the bootstrap node - see the Node role definitions table above. It is omitted from this table.

Flag	`master-data-kibana`	`master-data`	`dedicated-master`
`--kibana-host`	Required	-	-
`--apm-host`	Required	-	-
`--es-nodes`	Required	Required	Required
`--bootstrap-cluster`	Bootstrap node only	Bootstrap node only	Bootstrap node only

Master-data-Kibana node

The master-data-kibana role installs Elasticsearch (with master, data, and ingest roles), Kibana, and APM Server.

Non-interactive command:

Copy

.\relsvr.exe install --quiet --cert-option 1 --cert-output-path "<cert-output-path>" --elastic-stack-version "<version>" --distribution-source "<packages-path>" --node-role "master-data-kibana" --bootstrap-cluster --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --initial-master-nodes "<node1>,<node2>,<node3>" --es-nodes "<node1>,<node2>,<node3>" --kibana-host "<node1>" --apm-host "<node1>" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Cert flags explained:

--cert-option 1 - generates a new Root CA and per-host TLS certificates on this node.
--cert-output-path - directory to write the generated certificate archive (elastic-certs.zip); if omitted, the archive is written to the CLI's working directory.
--es-nodes - comma-separated list of all Elasticsearch node hostnames; a cert is generated for each.
--kibana-host / --apm-host - hostnames of the nodes that will run Kibana and APM Server; certs are pre-generated for them here.

Interactive walkthrough:

Open an elevated PowerShell window and run:
Copy
```
.\relsvr.exe install
```
Select Elastic Stack from the installation menu and confirm.
When prompted to Select certificate option, select 1 to generate a new self-signed CA and all required certificates.
When prompted for Elasticsearch node hostnames or IPs, enter all node hostnames, comma-separated (e.g. node1,node2,node3).
When prompted for Kibana hostname or IP, enter the hostname of the node running Kibana.
When prompted for APM Server hostname or IP, enter the hostname of the node running APM Server.
When prompted for Output directory for generated cert files, press Enter to use the current directory, or enter a custom path.
Select the Elastic Stack version matching your offline package set.
When prompted with Use a custom Elastic package source?, enter y, then provide your local folder or BCP path.
When prompted Which node role should this machine have?, select master-data-kibana.
Enter the cluster name (e.g. my-cluster). Use the same value on every node.
Enter the seed hosts - comma-separated with port :9300 for each node.
When prompted Bootstrap this cluster?, enter y.
When prompted for initial master nodes, press Enter to derive from seed hosts, or provide them explicitly.
When prompted to select components, confirm all three: Elasticsearch, Kibana, and APM Server.
When prompted with Use custom storage paths?, enter y and provide paths, or n to use defaults.

Sample interactive session - master-data-kibana (bootstrap, offline)

Copy

PS C:\elastic\publish-cli> .\relsvr.exe install

Install the Elastic Stack? [y/n] (y): y

All options will archive the resulting certificates and stage them to the target path.
Select certificate option:

> [1] Create a new self-signed CA and all required certificates
  [2] Use existing CA to generate all required certificates
  [3] Use existing certificates from provided path

Selected certificate option: 1
Elasticsearch node hostnames or IPs (comma-separated): (): node1.contoso.local,node2.contoso.local,node3.contoso.local
Kibana hostname or IP: (): node1.contoso.local
APM Server hostname or IP: (): node1.contoso.local
Output directory for generated cert files (leave blank for current directory): ():
WARNING: --cert-output-path was not specified. Certificates will be written to: C:\elastic\publish-cli
Certificates written to C:\elastic\publish-cli and zipped as elastic-certs.zip.

Which Elastic Stack version do you want to use for this installation?

  8.19.8
  9.1.3
> 9.3.0
  Enter custom version...

Selected Elastic Stack version: 9.3.0
Recommended distribution source path: \\{server}\BCPPath\EnvironmentWatch\ElasticPackages
Use a custom Elastic package source? [y/n] (n): y
Enter the distribution source path (e.g. \\{server}\BCPPath\EnvironmentWatch\ElasticPackages): C:\elastic-packages
Distribution source: C:\elastic-packages

The cert output path shown after the cert step is where elastic-certs.zip was written. Before installing any non-bootstrap node, extract this zip and share the resulting directory. See the After the bootstrap node installs note above.

Copy

Which node role should this machine have in the Elastic Stack cluster?
> master-data-kibana

Selected node role: master-data-kibana
Enter the cluster name (must be identical on every node in the cluster): my-cluster
Cluster name: my-cluster
Enter seed hosts - comma-separated hostnames or IPs of all master-eligible nodes on port 9300 (e.g. node1:9300,node2:9300): node1.contoso.local:9300,node2.contoso.local:9300,node3.contoso.local:9300
Seed hosts: node1.contoso.local:9300,node2.contoso.local:9300,node3.contoso.local:9300
Bootstrap this cluster? [y/n] (n): y
Enter initial master nodes - comma-separated hostnames of all master-eligible nodes (leave blank to derive from seed hosts): 
Initial master nodes: (derived from seed hosts)
Select Elastic Stack components to install:
[x] Elasticsearch
[x] Kibana
[x] APM Server
Selected Elastic Stack components to install: Elasticsearch,Kibana,APM Server
Use custom storage paths for Elasticsearch data and logs? [y/n] (n): y
Enter the Elasticsearch data storage path (e.g. D:\elastic-data): (D:\elastic-data): D:\elastic-data
Elasticsearch data path: D:\elastic-data
Enter the Elasticsearch logs storage path (e.g. D:\elastic-logs): (D:\elastic-logs): D:\elastic-logs
Elasticsearch logs path: D:\elastic-logs

Checkpoint - verify bootstrap node before proceeding:

Copy

Get-Service -Name elasticsearch

Wait until the service status is Running. Cluster health shows red at this stage - expected with no data nodes yet. Do not proceed to non-bootstrap nodes until the service is running.

Non-Bootstrap Nodes

After the bootstrap node is running, install the remaining nodes using --cert-option 3 with the path to the bootstrap node's cert directory.

Checkpoint after each node joins: Before installing the next node, verify the new node appears in the cluster:

Copy

curl.exe -sk -u "elastic" https://<any-es-node>:9200/_cat/nodes?v

Master-data node

Non-interactive command:

Copy

.\relsvr.exe install --quiet --cert-option 3 --cert-package "\\<bootstrap-node>\elastic-certs" --elastic-stack-version "<version>" --distribution-source "<packages-path>" --node-role "master-data" --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Interactive walkthrough:

Open an elevated PowerShell window and run:
Copy
```
.\relsvr.exe install
```
Select Elastic Stack from the installation menu and confirm.
When prompted to Select certificate option, select 3 to use existing certificates from a provided path.
When prompted for the certificate package path, enter the path to the bootstrap node's cert directory (e.g. \\<bootstrap-node>\elastic-certs).
Select the same Elastic Stack version used by the cluster.
When prompted with Use a custom Elastic package source?, enter y, then provide your local folder or BCP path.
When prompted Which node role should this machine have?, select master-data.
Enter the cluster name (must match all other nodes).
Enter the seed hosts - comma-separated with port :9300, including the bootstrap node and all previously joined nodes.
When prompted Bootstrap this cluster?, enter n.
When prompted with Use custom storage paths?, enter y and provide paths, or n to use defaults.

Sample interactive session - master-data (non-bootstrap, offline)

Copy

PS C:\elastic\publish-cli> .\relsvr.exe install

Install the Elastic Stack? [y/n] (y): y

All options will archive the resulting certificates and stage them to the target path.
Select certificate option:

  [1] Create a new self-signed CA and all required certificates
  [2] Use existing CA to generate all required certificates
> [3] Use existing certificates from provided path

Selected certificate option: 3
Certificate package path (): \\node1.contoso.local\elastic-certs

Selected Elastic Stack version: 9.3.0
Recommended distribution source path: \\{server}\BCPPath\EnvironmentWatch\ElasticPackages
Use a custom Elastic package source? [y/n] (n): y
Enter the distribution source path (e.g. \\{server}\BCPPath\EnvironmentWatch\ElasticPackages): \\fileserver\elastic-packages
Distribution source: \\fileserver\elastic-packages

Which node role should this machine have in the Elastic Stack cluster?
> master-data

Selected node role: master-data
Enter the cluster name (must be identical on every node in the cluster): my-cluster
Cluster name: my-cluster
Enter seed hosts - comma-separated hostnames or IPs of all master-eligible nodes on port 9300 (e.g. node1:9300,node2:9300): node1.contoso.local:9300,node2.contoso.local:9300,node3.contoso.local:9300
Seed hosts: node1.contoso.local:9300,node2.contoso.local:9300,node3.contoso.local:9300
Bootstrap this cluster? [y/n] (n): n
Selected Elastic Stack components to install: Elasticsearch
Use custom storage paths for Elasticsearch data and logs? [y/n] (n): y
Enter the Elasticsearch data storage path (e.g. D:\elastic-data): (D:\elastic-data): D:\elastic-data
Elasticsearch data path: D:\elastic-data
Enter the Elasticsearch logs storage path (e.g. D:\elastic-logs): (D:\elastic-logs): D:\elastic-logs
Elasticsearch logs path: D:\elastic-logs

Dedicated-master and data nodes

The dedicated-master and data roles follow the same installation steps as master-data above. Only the --node-role value differs, and neither role installs Kibana or APM Server:

	`master-data`	`dedicated-master`	`data`
`--node-role` value	`master-data`	`dedicated-master`	`data`
Participates in master elections	Yes	Yes	No
Stores shard data	Yes	No	Yes
`--kibana-host` / `--apm-host`	Not used	Not used	Not used

Non-interactive command (dedicated-master):

Copy

.\relsvr.exe install --quiet --cert-option 3 --cert-package "\\<bootstrap-node>\elastic-certs" --elastic-stack-version "<version>" --distribution-source "<packages-path>" --node-role "dedicated-master" --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Non-interactive command (data):

Copy

.\relsvr.exe install --quiet --cert-option 3 --cert-package "\\<bootstrap-node>\elastic-certs" --elastic-stack-version "<version>" --distribution-source "<packages-path>" --node-role "data" --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Sample commands by cert option (offline)

Add --distribution-source "<packages-path>" to all commands to point to your offline package directory. Replace <packages-path> with a local path (C:\elastic-packages) or BCP share (\\fileserver\elastic-packages).

Cert Option 1 - Generate New CA

Bootstrap node:

Copy

.\relsvr.exe install --quiet --cert-option 1 --cert-output-path "<cert-output-path>" --distribution-source "<packages-path>" --elastic-stack-version "<version>" --node-role "master-data-kibana" --bootstrap-cluster --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --initial-master-nodes "<node1>,<node2>,<node3>" --es-nodes "<node1>,<node2>,<node3>" --kibana-host "<node1>" --apm-host "<node1>" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Non-bootstrap node:

Copy

.\relsvr.exe install --quiet --cert-option 3 --cert-package "\\<bootstrap-node>\elastic-certs" --distribution-source "<packages-path>" --elastic-stack-version "<version>" --node-role "master-data" --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Cert Option 2 - Use Existing CA

Copy the CA PFX file to each node (or place it on a shared path) before running. Every node generates its own per-host certificates from the same CA.

Bootstrap node:

Copy

.\relsvr.exe install --quiet --cert-option 2 --ca-pfx "<ca-pfx-path>" --ca-pfx-password "<ca-pfx-password>" --cert-output-path "<cert-output-path>" --distribution-source "<packages-path>" --elastic-stack-version "<version>" --node-role "master-data-kibana" --bootstrap-cluster --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --initial-master-nodes "<node1>,<node2>,<node3>" --es-nodes "<node1>,<node2>,<node3>" --kibana-host "<node1>" --apm-host "<node1>" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Non-bootstrap node:

Copy

.\relsvr.exe install --quiet --cert-option 2 --ca-pfx "<ca-pfx-path>" --ca-pfx-password "<ca-pfx-password>" --cert-output-path "<cert-output-path>" --distribution-source "<packages-path>" --elastic-stack-version "<version>" --node-role "master-data" --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Cert Option 3 - Use Existing Certificates

Cert Option 3 is for non-bootstrap nodes only. The bootstrap node generates the certificates; all subsequent nodes consume them via --cert-package.

Non-bootstrap node:

Copy

.\relsvr.exe install --quiet --cert-option 3 --cert-package "\\<bootstrap-node>\elastic-certs" --distribution-source "<packages-path>" --elastic-stack-version "<version>" --node-role "master-data" --cluster-name "<cluster-name>" --seed-hosts "<node1>:9300,<node2>:9300,<node3>:9300" --elasticsearch-data-path "<data-path>" --elasticsearch-logs-path "<logs-path>"

Post Install Verification

After installation completes:

The auto-generated elastic superuser password is saved to:
Copy
```
C:\elastic\secrets\elastic-user.txt
```
Record and securely store it immediately according to your organization's credential management policy.
Verify Elasticsearch is running by opening a browser and navigating to:
Copy
```
https://<elasticsearch-node>:9200
```
In single-node deployments use the install host. In multi-node deployments use any data-eligible node (e.g. the master-data-kibana or master-data node). Log in with username elastic and the password from C:\elastic\secrets\elastic-user.txt. A successful response shows basic cluster information in JSON format.
Verify Kibana is running by opening a browser and navigating to:
Copy
```
https://<kibana-node>:5601
```
In single-node deployments use the install host. In multi-node deployments use the master-data-kibana node. Log in with username elastic and the password from C:\elastic\secrets\elastic-user.txt. A successful response loads the Kibana home dashboard.
Verify APM Server is running by opening a browser and navigating to:
Copy
```
https://<apm-node>:8200
```
In single-node deployments use the install host. In multi-node deployments use the master-data-kibana node. A successful response returns a JSON object containing APM Server build information.
In multi-node deployments, verify all expected nodes are joined by running the following command from a host that can access Elasticsearch:
Copy
```
curl.exe -sk -u elastic https://<elasticsearch-node>:9200/_cat/nodes?v
```
Confirm each expected node appears in the response and that node roles align with your design (for example: m for master-eligible, d for data, i for ingest).

Verify cluster health is green:

Copy

curl.exe -sk -u elastic https://<elasticsearch-node>:9200/_cluster/health?pretty

Confirm the status field is green.

Once all services above are verified, delete the password file from disk - it contains the elastic superuser password in plain text:
Copy
```
Remove-Item -Path "C:\elastic\secrets\elastic-user.txt"
```

Troubleshooting

Where to find logs

Component	Location
Relativity Server CLI (`relsvr.exe`)	Console output, plus a daily log file in the directory the CLI was launched from: `rel-svr<YYYYMMDD>.log` (e.g. `rel-svr20260101.log`)
Elasticsearch / Kibana / APM Server	`C:\elastic\logs` by default, or the path you passed to `--elasticsearch-logs-path`
Windows services	`elasticsearch`, `kibana`, `apm-server` - check status with `Get-Service -Name elasticsearch,kibana,apm-server`

Common failure scenarios

A node fails to join the cluster. The installer rolls back the elasticsearch.yml cluster configuration it just wrote and stops the Elasticsearch service. Verify every other cluster node is running and reachable (DNS, firewall - see Prerequisites above), then re-run the installer on this node.
Cluster health doesn't reach yellow/green after bootstrap. This usually means a quorum of master-eligible nodes isn't reachable via discovery.seed_hosts. Confirm --seed-hosts on every node lists all master-eligible nodes with the :9300 transport port, and that TCP 9300 is open between them.
Installer reports the Relativity Secret Store is unreachable, or a credential isn't found there. Follow the on-screen warning and manually copy elastic-user.txt/api-key.txt from the first data-eligible node's secrets directory to the path it names, then re-run.
Re-running with --bootstrap-cluster against a cluster that already formed. Don't do this - it can cause split-brain or an unintended cluster re-formation. --bootstrap-cluster is only for the very first master-eligible node of a brand-new cluster.