在 kibana 的 Dev Tools > Console 里运行：

PUT /_cluster/settings
{
  "transient": {
    "cluster.routing.allocation.exclude._name": "node-04"
  }
}

#! [xpack.monitoring.collection.enabled] setting was deprecated in Elasticsearch and will be removed in a future release.
{
  "acknowledged": true,
  "persistent": {},
  "transient": {
    "cluster": {
      "routing": {
        "allocation": {
          "exclude": {
            "_name": "node-04"
          }
        }
      }
    }
  }
}

在 Stack Monitoring > Elasticsearch overview 的 Shard Activity 面板下查看节点状态，等待分片迁移完毕即可安全移除 ES 节点。