IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elasticsearch Guide [6.5] » Modules » Cross-cluster search
« Remote clusters
Index Modules »
Cross-cluster search
The cross-cluster search feature allows any node to act as a federated client across multiple clusters. In contrast to the tribe node feature, a cross-cluster search node won’t join the remote cluster, instead it connects to a remote cluster in a light fashion in order to execute federated search requests.
Using cross-cluster search
Cross-cluster search requires configuring remote clusters.
PUT _cluster/settings{ "persistent": { "cluster": { "remote": { "cluster_one": { "seeds": [ "" ] }, "cluster_two": { "seeds": [ "" ] }, "cluster_three": { "seeds": [ "" ] } } } }}
Copy as curlView in Console

To search the twitter index on remote cluster cluster_one the index name must be prefixed with the cluster alias separated by a : character:
GET /​cluster_one:twitter​/​_search​{ "query": { "match": { "user": "kimchy" } }}
Copy as curlView in Console

{ "took": 150, "timed_out": false, "_shards": { "total": 1, "successful": 1, "failed": 0, "skipped": 0 }, "_clusters": { "total": 1, "successful": 1, "skipped": 0 }, "hits": { "total": 1, "max_score": 1, "hits": [ { "_index": "cluster_one:twitter", "_type": "_doc", "_id": "0", "_score": 1, "_source": { "user": "kimchy", "date": "2009-11-15T14:12:12"​, "message": "trying out Elasticsearch", "likes": 0 } } ] }}
In contrast to the tribe feature cross cluster search can also search indices with the same name on different clusters:
GET /​cluster_one:twitter,twitter​/​_search​{ "query": { "match": { "user": "kimchy" } }}
Copy as curlView in Console

Search results are disambiguated the same way as the indices are disambiguated in the request. Even if index names are identical these indices will be treated as different indices when results are merged. All results retrieved from a remote index will be prefixed with their remote cluster name:
{ "took": 150, "timed_out": false, "_shards": { "total": 2, "successful": 2, "failed": 0, "skipped": 0 }, "_clusters": { "total": 2, "successful": 2, "skipped": 0 }, "hits": { "total": 2, "max_score": 1, "hits": [ { "_index": "cluster_one:twitter", "_type": "_doc", "_id": "0", "_score": 1, "_source": { "user": "kimchy", "date": "2009-11-15T14:12:12"​, "message": "trying out Elasticsearch", "likes": 0 } }, { "_index": "twitter", "_type": "_doc", "_id": "0", "_score": 2, "_source": { "user": "kimchy", "date": "2009-11-15T14:12:12"​, "message": "trying out Elasticsearch", "likes": 0 } } ] }}
Skipping disconnected clusters
By default all remote clusters that are searched via cross-cluster search need to be available when the search request is executed, otherwise the whole request fails and no search results are returned despite some of the clusters are available. Remote clusters can be made optional through the boolean skip_unavailable setting, set to false by default.
PUT _cluster/settings{ "persistent": { "cluster.remote.cluster_two.skip_unavailable"​: true}}
Copy as curlView in Console

cluster_two is made optional
GET /​cluster_one:twitter,cluster_two:twitter,twitter​/​_search { "query": { "match": { "user": "kimchy" } }}
Copy as curlView in Console

Search against the twitter index in cluster_one, cluster_two and also locally
{ "took": 150, "timed_out": false, "_shards": { "total": 2, "successful": 2, "failed": 0, "skipped": 0 }, "_clusters": {"total": 3, "successful": 2, "skipped": 1 }, "hits": { "total": 2, "max_score": 1, "hits": [ { "_index": "cluster_one:twitter", "_type": "_doc", "_id": "0", "_score": 1, "_source": { "user": "kimchy", "date": "2009-11-15T14:12:12"​, "message": "trying out Elasticsearch", "likes": 0 } }, { "_index": "twitter", "_type": "_doc", "_id": "0", "_score": 2, "_source": { "user": "kimchy", "date": "2009-11-15T14:12:12"​, "message": "trying out Elasticsearch", "likes": 0 } } ] }}
The clusters section indicates that one cluster was unavailable and got skipped
« Remote clusters
Index Modules »
On this page
Using cross-cluster search
Skipping disconnected clusters
We're hiring

Work for a global, distributed team where finding someone like you is just a Zoom meeting away. Flexible work with impact? Development opportunities from the start?
Discover your career
Recommended for you
Elastic 7.15: Create powerful, personalized search experiences in seconds
Distributed Elastic Architectures
Elasticsearch: Getting Started
Elastic 7.14.0 introduces the industry’s first free and open Limitless XDR
Elasticsearch Guide:
Getting Started
Set up Elasticsearch
Upgrade Elasticsearch
API Conventions
Document APIs
Search APIs
Indices APIs
cat APIs
Cluster APIs
Query DSL
Local Gateway
Network Settings
Snapshot And Restore
Thread Pool
Tribe node
Remote clusters
Cross-cluster search
Index Modules
Ingest Node
SQL Access
Monitor a cluster
Rolling up historical data
Set up a cluster for high availability
Secure a cluster
Alerting on Cluster and Index Events
Command line tools
How To
Glossary of terms
X-Pack APIs
Release Highlights
Breaking changes
Release Notes
Subscribe to our newsletter

Enterprise Search
Elastic Stack
Elastic Agent
Board of Directors
ElasticON Global
What is the ELK Stack?
What is Elasticsearch?
Migrating from Splunk
Compare AWS Elasticsearch
US Public Sector
Follow Us
TrademarksTerms of UsePrivacyBrandSitemap
Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.
© 2021. Elasticsearch B.V. All Rights Reserved