# How to run cross cluster search across local and remote indices **URL:** \ **Category:** Elasticsearch\ **Created:** [February 1, 2018, 10:43am UTC](https://discuss.elastic.co/t/how-to-run-cross-cluster-search-across-local-and-remote-indices/117997 "2018-02-01T10:43:05Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![bbailey](https://avatars.discourse-cdn.com/v4/letter/b/ebca7d/32.png) [@bbailey](https://discuss.elastic.co/u/bbailey)\ **Post date:** [February 1, 2018, 10:43am UTC](https://discuss.elastic.co/t/how-to-run-cross-cluster-search-across-local-and-remote-indices/117997/1 "2018-02-01T10:43:05Z")
I am trying to setup my environment so that I can switch from using tribe nodes to use cross cluster search and running in to a few problems After some useful feedback in this forum I have configured my system with kibana pointing to a coordinating node in **cluster\_1** with cross cluster search configured so I can also search indices in **cluster\_2** and **cluster\_3**. I can configure index patterns in Kibana to search for logs as follows:- logstash-\* returns all local logs in cluster\_1 successfully cluster\_2:logstash-\* returns all logs in remote cluster\_2 successfully cluster\_3:logstash-\* returns all logs in remote cluster\_3 successfully \*:logstash-\* returns all logs in remote cluster\_2 and cluster\_3 successfully Question1. Is there a way to set up an index pattern to query all logs in all 3 clusters i.e. local and remote clusters ? Question 2. Is there a way to search specific remote clusters ? I have tried the documented syntax of **cluster\_2,cluster\_3:logstash-** \* and in Kibana 5.6.2 it does not work ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [February 14, 2018, 4:16am UTC](https://discuss.elastic.co/t/how-to-run-cross-cluster-search-across-local-and-remote-indices/117997/2 "2018-02-14T04:16:31Z")
> Is there a way to set up an index pattern to query all logs in all 3 clusters i.e. local and remote clusters There's 2 options, that may (or may not) suit you. 1. `logstash-*,*:logstash-*` should do what you want. That will search locally and on all remote clusters. 2. You can set up a cross-cluster prefix that points to the local cluster. So you can define `cluster_1` with a seed of `localhost:9300` then `*:logstash-*` would search all 3 clusters. It would use the cross-cluster-search mechanism, but cross cluster search is fairly low overhead so that shouldn't cause a problem. > I have tried the documented syntax of cluster\_2,cluster\_3:logstash-\* and in Kibana 5.6.2 it does not work Which document has that? As far as _Elasticsearch_ is concerned, that pattern is - the index named "cluster\_2" in the local cluster - the indices named "logstash-\*" in the "cluster\_3" cluster It's possible that Kibana has some feature that handles it differently, but once it gets to Elasticsearch we split the names by comma and then treat each part independently. ---
**Author:** ![bbailey](https://avatars.discourse-cdn.com/v4/letter/b/ebca7d/32.png) [@bbailey](https://discuss.elastic.co/u/bbailey)\ **Post date:** [February 14, 2018, 9:08am UTC](https://discuss.elastic.co/t/how-to-run-cross-cluster-search-across-local-and-remote-indices/117997/3 "2018-02-14T09:08:07Z")
Regarding the incorrect Kibana documentation It's in [https://www.elastic.co/guide/en/kibana/current/management-cross-cluster-search.html](https://www.elastic.co/guide/en/kibana/current/management-cross-cluster-search.html) ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a932993d9f96ec25a45236da1cc0d43d3a9f8ab3.png) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 14, 2018, 10:30pm UTC](https://discuss.elastic.co/t/how-to-run-cross-cluster-search-across-local-and-remote-indices/117997/4 "2018-02-14T22:30:02Z")
Thanks for pointing that out, I've raised [https://github.com/elastic/kibana/pull/16751](https://github.com/elastic/kibana/pull/16751) to update it. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 14, 2018, 10:30pm UTC](https://discuss.elastic.co/t/how-to-run-cross-cluster-search-across-local-and-remote-indices/117997/5 "2018-03-14T22:30:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.