Does the indexer cluster have to be http?
Communication to the indexers is over HTTP or HTTPS - there are no other options. If HTTPS is used, Splunk will default to the built-in certificates.
SO I watched a youtube video the other day and the person I watched was able to copy and paste the address and they weren't secure but my questions is why is it saying its 127.0.0.1:8089
The ability to copy-paste to or from a browser's address bar has nothing to do with the security of the connection.
127.0.0.1 is the "loopback" address. It's the standard address used to talk to the local machine. Port 8089 is Splunk's management port.