Elasticsearch.hosts setting in Kibana.yml with Cross-Cluster Searching

Elastic Stack Kibana
1

In kibana.yml , I have a setting I'm not sure about:

# The URL of the Elasticsearch instance to use for all your queries.
elasticsearch.hosts: "http://localhost:9400"

Which is pointing to a coordinating node running on the same host as Kibana - is this bottlenecking my setup? I have multiple coordinating nodes in this cluster, should I add them to elasticsearch.hosts?
When I have cross-cluster search enabled;

  • is elasticsearch.hosts just ignored in favor of the Seeds?
    • Otherwise, how does the request flow from Kibana to the next cluster?
    • As I'm supposed to only put local-cluster node names in my elasticsearch.hosts, does a request for data from another cluster get routed from the local-cluster coordinating nodes to the remote cluster nodes?
  • Since I've got Kibana running in one cluster, should I still add that as a remote cluster?
    • e.g. index patterns would look like: local_cluster1:logstash-*,remote_cluster2:logstash-*
    • Or should I leave the kibana local cluster out of the Remote Clusters?
      • e.g. index patterns would look like: logstash-*,remote_cluster2:logstash-*
2

Hi @seth.yes,

thanks for your question.

Which is pointing to a coordinating node running on the same host as Kibana - is this bottlenecking my setup? I have multiple coordinating nodes in this cluster, should I add them to elasticsearch.hosts ?

Yes it makes sense to add other coordinating nodes to the setting - then Kibana won't be down when this single elasticsearch host goes down because it can still query other nodes.

is elasticsearch.hosts just ignored in favor of the Seeds?

Cross cluster search always hits the local cluster first, Kibana does not query remote clusters directly. The elasticsearch documentation nicely documents the data flow - Kibana acts as the client in this scenario.

Since I've got Kibana running in one cluster, should I still add that as a remote cluster?

No, you can leave the local cluster out of remote clusters, logstash-*,remote_cluster2:logstash-* is the right configuration here.

3

Thanks! You answered all of my questions perfectly.