IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elasticsearch Guide [6.5] » Modules » Cross-cluster search
« Remote clusters
Index Modules »
Cross-cluster search
The cross-cluster search feature allows any node to act as a federated client across multiple clusters. In contrast to the tribe node feature, a cross-cluster search node won’t join the remote cluster, instead it connects to a remote cluster in a light fashion in order to execute federated search requests.
Using cross-cluster search
Cross-cluster search requires configuring remote clusters.
PUT _cluster/settings{ "persistent": { "cluster": { "remote": { "cluster_one": { "seeds": [ "127.0.0.1:9300" ] }, "cluster_two": { "seeds": [ "127.0.0.1:9301" ] }, "cluster_three": { "seeds": [ "127.0.0.1:9302" ] } } } }}
Copy as curlView in Console

 
To search the twitter index on remote cluster cluster_one the index name must be prefixed with the cluster alias separated by a : character:
GET /​cluster_one:twitter​/​_search​{ "query": { "match": { "user": "kimchy" } }}
Copy as curlView in Console

 
{ "took": 150, "timed_out": false, "_shards": { "total": 1, "successful": 1, "failed": 0, "skipped": 0 }, "_clusters": { "total": 1, "successful": 1, "skipped": 0 }, "hits": { "total": 1, "max_score": 1, "hits": [ { "_index": "cluster_one:twitter", "_type": "_doc", "_id": "0", "_score": 1, "_source": { "user": "kimchy", "date": "2009-11-15T14:12:12"​, "message": "trying out Elasticsearch", "likes": 0 } } ] }}
In contrast to the tribe feature cross cluster search can also search indices with the same name on different clusters:
GET /​cluster_one:twitter,twitter​/​_search​{ "query": { "match": { "user": "kimchy" } }}
Copy as curlView in Console

 
Search results are disambiguated the same way as the indices are disambiguated in the request. Even if index names are identical these indices will be treated as different indices when results are merged. All results retrieved from a remote index will be prefixed with their remote cluster name:
{ "took": 150, "timed_out": false, "_shards": { "total": 2, "successful": 2, "failed": 0, "skipped": 0 }, "_clusters": { "total": 2, "successful": 2, "skipped": 0 }, "hits": { "total": 2, "max_score": 1, "hits": [ { "_index": "cluster_one:twitter", "_type": "_doc", "_id": "0", "_score": 1, "_source": { "user": "kimchy", "date": "2009-11-15T14:12:12"​, "message": "trying out Elasticsearch", "likes": 0 } }, { "_index": "twitter", "_type": "_doc", "_id": "0", "_score": 2, "_source": { "user": "kimchy", "date": "2009-11-15T14:12:12"​, "message": "trying out Elasticsearch", "likes": 0 } } ] }}
Skipping disconnected clusters
By default all remote clusters that are searched via cross-cluster search need to be available when the search request is executed, otherwise the whole request fails and no search results are returned despite some of the clusters are available. Remote clusters can be made optional through the boolean skip_unavailable setting, set to false by default.
PUT _cluster/settings{ "persistent": { "cluster.remote.cluster_two.skip_unavailable"​: true}}
Copy as curlView in Console

 
cluster_two is made optional
GET /​cluster_one:twitter,cluster_two:twitter,twitter​/​_search { "query": { "match": { "user": "kimchy" } }}
Copy as curlView in Console

 
Search against the twitter index in cluster_one, cluster_two and also locally
{ "took": 150, "timed_out": false, "_shards": { "total": 2, "successful": 2, "failed": 0, "skipped": 0 }, "_clusters": {"total": 3, "successful": 2, "skipped": 1 }, "hits": { "total": 2, "max_score": 1, "hits": [ { "_index": "cluster_one:twitter", "_type": "_doc", "_id": "0", "_score": 1, "_source": { "user": "kimchy", "date": "2009-11-15T14:12:12"​, "message": "trying out Elasticsearch", "likes": 0 } }, { "_index": "twitter", "_type": "_doc", "_id": "0", "_score": 2, "_source": { "user": "kimchy", "date": "2009-11-15T14:12:12"​, "message": "trying out Elasticsearch", "likes": 0 } } ] }}
The clusters section indicates that one cluster was unavailable and got skipped
« Remote clusters
Index Modules »
On this page
Using cross-cluster search
Skipping disconnected clusters
We're hiring

Work for a global, distributed team where finding someone like you is just a Zoom meeting away. Flexible work with impact? Development opportunities from the start?
Discover your career
Recommended for you
Elastic 7.15: Create powerful, personalized search experiences in seconds
Distributed Elastic Architectures
Twilio
Elasticsearch: Getting Started
Elastic 7.14.0 introduces the industry’s first free and open Limitless XDR
Elasticsearch Guide:
Getting Started
Set up Elasticsearch
Upgrade Elasticsearch
API Conventions
Document APIs
Search APIs
Aggregations
Indices APIs
cat APIs
Cluster APIs
Query DSL
Mapping
Analysis
Modules
Cluster
Discovery
Local Gateway
HTTP
Indices
Network Settings
Node
Plugins
Scripting
Snapshot And Restore
Thread Pool
Transport
Tribe node
Remote clusters
Cross-cluster search
Index Modules
Ingest Node
SQL Access
Monitor a cluster
Rolling up historical data
Set up a cluster for high availability
Secure a cluster
Alerting on Cluster and Index Events
Command line tools
How To
Testing
Glossary of terms
X-Pack APIs
Release Highlights
Breaking changes
Release Notes
Subscribe to our newsletter

PRODUCTS & SOLUTIONS
Enterprise Search
Observability
Security
Elastic Stack
Elasticsearch
Kibana
Logstash
Beats
Elastic Agent
Subscriptions
Pricing
COMPANY
Careers
WE'RE HIRING
Board of Directors
Contact
RESOURCES
ElasticON Global
Documentation
What is the ELK Stack?
What is Elasticsearch?
Migrating from Splunk
Compare AWS Elasticsearch
US Public Sector
Follow Us
TrademarksTerms of UsePrivacyBrandSitemap
Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.
© 2021. Elasticsearch B.V. All Rights Reserved