This is recommended by Elastic
https://www.elastic.co/guide/en/elasticsearch/guide/current/_important_configuration_changes.html
Elasticsearch is configured to use multicast discovery out of the box. Multicast works by sending UDP pings across your local network to discover nodes. Other Elasticsearch nodes will receive these pings and respond. A cluster is formed shortly after. Multicast is excellent for development, since you don’t need to do anything. Turn a few nodes on, and they automatically find each other and form a cluster. This ease of use is the exact reason you should disable it in production. The last thing you want is for nodes to accidentally join your production network, simply because they received an errant multicast ping. There is nothing wrong with multicast per se. Multicast simply leads to silly problems, and can be a bit more fragile (for example, a network engineer fiddles with the network without telling you—and all of a sudden nodes can’t find each other anymore).```
This recommended by a lot of scaling blogs and white papers
https://www.loggly.com/blog/nine-tips-configuring-elasticsearch-for-high-performance/
we are having some host discovery issues at the moment and dynamic node discovery in our setup that does not out-scale is an extra layer of complication we don't require.