We have 2 kubernetes clusters each with fluentd/elasticsearch/kibana in it but we would like to pool this data together into a single kibana UI for investigations etc... Am I right in thinking that I would need to have a elasticsearch/kibana configured in a separate cluster and then use cross cluster search to retrieve data from the other two clusters? Would I need to configure this new elasticsearch as the "master" and the other two as just "data" or are they OK being "masters" too?
Sorry if I have got the terminology wrong but I am still getting my head around elasticsearch and how to configure it and I am currently using the basic subscription but I understand that cross cluster search works with this OK.
Many thanks