# Configure Kibana for remote cluster search

**URL:** <https://discuss.elastic.co/t/configure-kibana-for-remote-cluster-search/220041>\
**Category:** Kibana\
**Created:** [February 19, 2020, 5:49pm UTC](https://discuss.elastic.co/t/configure-kibana-for-remote-cluster-search/220041 "2020-02-19T17:49:58Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mtudisco](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@mtudisco](https://discuss.elastic.co/u/mtudisco)\
**Post date:** [February 19, 2020, 5:49pm UTC](https://discuss.elastic.co/t/configure-kibana-for-remote-cluster-search/220041/1 "2020-02-19T17:49:58Z")

</div>

Hi,  
I'm using Elastic stack 7.5 and have several data centers. Not all data centers have a good bandwitch, so setting up a cluster distributed between data centers is not a good option according to:

> **[Clustering Across Multiple Data Centers](https://www.elastic.co/blog/clustering_across_multiple_data_centers)**
>
> This post answers the question: Can I run an Elasticsearch cluster across multiple data centers? Includes detailed reasons and alternatives.

  
So i was thinking of having two clusters (one on each data center) and make logs for each data center to be sent to the local cluster. But then i need to analyze the information with Kibana, and here are my doubs:

1. Documentation talks about cross cluster search, but thats an API for ES, is there any way to say to Kibana to search local and remote clusters? documentation is not clear about it.
2. The other option is to set up remote cluster replication, however that will transfer information from remote cluster to local cluster, duplicating information and wasting on disk resources, and also compite with remote cluster bandwitch.

Can anyone tell their experiences and how do you solve this kind of problem?

thanks

---

<div class="post-metadata">

**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\
**Post date:** [February 19, 2020, 5:58pm UTC](https://discuss.elastic.co/t/configure-kibana-for-remote-cluster-search/220041/2 "2020-02-19T17:58:55Z")

</div>

Kibana doesn't do anything for cross-cluster search beyond what Elasticsearch offers. Once you configure remote clusters, you can specify the name of the remote cluster as the name of the index, such as `remote_cluster_1:my_index_name`.

---

<div class="post-metadata">

**Author:** ![mtudisco](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@mtudisco](https://discuss.elastic.co/u/mtudisco)\
**Post date:** [February 19, 2020, 7:51pm UTC](https://discuss.elastic.co/t/configure-kibana-for-remote-cluster-search/220041/3 "2020-02-19T19:51:46Z")

</div>

Thanks Wylie, once i configure the remote cluster, do you mean i have to create a new index pattern for the remote index? Can i create an index pattern to refer to both local and remote indexes? I'd like to create charts on kibana sumarizing the information from local and remote cluster, is that possible?

thanks

---

<div class="post-metadata">

**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\
**Post date:** [February 19, 2020, 7:56pm UTC](https://discuss.elastic.co/t/configure-kibana-for-remote-cluster-search/220041/4 "2020-02-19T19:56:03Z")

</div>

You can combine local and remote indexes into one pattern by using commas, for example `local-index-*,remote-cluster-1:remote-index-*`. As long as they have overlapping mappings, this will work as expected. If you update the mappings on one cluster but not the other, there could be issues.

---

<div class="post-metadata">

**Author:** ![mtudisco](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@mtudisco](https://discuss.elastic.co/u/mtudisco)\
**Post date:** [February 19, 2020, 8:04pm UTC](https://discuss.elastic.co/t/configure-kibana-for-remote-cluster-search/220041/5 "2020-02-19T20:04:09Z")

</div>

But can you create an index-pattern in kibana with that sintax (several sub-index patterns separated by ",")? or that refers only to Elasticsearch search API?

sorry for the questions but i still havent setup a remote cluster to test it, just evaluating.

---

<div class="post-metadata">

**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\
**Post date:** [February 19, 2020, 8:05pm UTC](https://discuss.elastic.co/t/configure-kibana-for-remote-cluster-search/220041/6 "2020-02-19T20:05:16Z")

</div>

Yes, none of the features I have just shared are specific to Kibana. Kibana takes the same patterns as Elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2020, 8:05pm UTC](https://discuss.elastic.co/t/configure-kibana-for-remote-cluster-search/220041/7 "2020-03-18T20:05:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
