Configure Kibana for remote cluster search

mtudisco · February 19, 2020, 5:49pm

Hi,
I'm using Elastic stack 7.5 and have several data centers. Not all data centers have a good bandwitch, so setting up a cluster distributed between data centers is not a good option according to:

So i was thinking of having two clusters (one on each data center) and make logs for each data center to be sent to the local cluster. But then i need to analyze the information with Kibana, and here are my doubs:

Documentation talks about cross cluster search, but thats an API for ES, is there any way to say to Kibana to search local and remote clusters? documentation is not clear about it.
The other option is to set up remote cluster replication, however that will transfer information from remote cluster to local cluster, duplicating information and wasting on disk resources, and also compite with remote cluster bandwitch.

Can anyone tell their experiences and how do you solve this kind of problem?

thanks

wylie · February 19, 2020, 5:58pm

Kibana doesn't do anything for cross-cluster search beyond what Elasticsearch offers. Once you configure remote clusters, you can specify the name of the remote cluster as the name of the index, such as remote_cluster_1:my_index_name.

mtudisco · February 19, 2020, 7:51pm

Thanks Wylie, once i configure the remote cluster, do you mean i have to create a new index pattern for the remote index? Can i create an index pattern to refer to both local and remote indexes? I'd like to create charts on kibana sumarizing the information from local and remote cluster, is that possible?

thanks

wylie · February 19, 2020, 7:56pm

You can combine local and remote indexes into one pattern by using commas, for example local-index-*,remote-cluster-1:remote-index-*. As long as they have overlapping mappings, this will work as expected. If you update the mappings on one cluster but not the other, there could be issues.

mtudisco · February 19, 2020, 8:04pm

But can you create an index-pattern in kibana with that sintax (several sub-index patterns separated by ",")? or that refers only to Elasticsearch search API?

sorry for the questions but i still havent setup a remote cluster to test it, just evaluating.

wylie · February 19, 2020, 8:05pm

Yes, none of the features I have just shared are specific to Kibana. Kibana takes the same patterns as Elasticsearch.

system · March 18, 2020, 8:05pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.