Working with Cross-Cluster Search

1. Understanding Cross-Cluster Search

Feature	Description	Notes
Cross-Cluster Search	Allows searching data across multiple Elasticsearch clusters	Requires cross-cluster discovery to be enabled
Remote Cluster	A cluster that is connected to the local cluster for search purposes	Can be configured with different security settings
Search Scope	Can search across all or specific remote clusters	Uses cluster aliases for organization

Note: Cross-cluster search is a powerful feature for distributed data analysis but requires proper configuration and security setup.

2. Configuring Remote Clusters

Configuration	Values	Description
cluster.remote.alias.seeds	`["host:port"]`	List of seed nodes for the remote cluster
cluster.remote.alias.mode	`"proxy"` or `"connection"`	Connection mode for remote cluster
cluster.remote.alias.skip_unavailable	`true` or `false`	Whether to skip unavailable clusters during search

Example: Configuring Remote Cluster

cluster.remote.prod_cluster.seeds: ["prod-elasticsearch-1:9200", "prod-elasticsearch-2:9200"]
cluster.remote.prod_cluster.mode: proxy
cluster.remote.prod_cluster.skip_unavailable: true

3. Searching Remote Clusters

Query Syntax	Example	Description
Remote Cluster Search	`GET /prod_cluster:my_index/_search`	Searches across a remote cluster using alias
Multi-Cluster Search	`GET /prod_cluster:my_index,dev_cluster:my_index/_search`	Searches across multiple remote clusters
Index Wildcards	`GET /prod_cluster:my_index//_search`	Searches across index patterns in remote clusters

Example: Searching Remote Cluster

curl -X GET "localhost:9200/prod_cluster:logs-*/_search" \
-H "Content-Type: application/json" \
-d '{
  "query": {
    "match": {
      "status": "error"
    }
  }
}'

4. Setting Up Cluster Privileges

Privilege	Required Permissions	Description
cluster:monitor/main	Read access to cluster state	Required for cross-cluster search operations
indices:monitor/stats	Read access to index stats	Allows monitoring of remote cluster indices
indices:data/read/search	Search access to indices	Required for querying remote cluster data

Note: Ensure proper role mapping and user permissions are set up for cross-cluster access.

5. Monitoring Cross-Cluster Connections

Monitoring Endpoint	Description	Status
/_cluster/remote_info	Lists all configured remote clusters	Available in Elasticsearch 7.0+
/_cluster/health	Shows health status of local and remote clusters	Includes cross-cluster connection health
/_nodes/stats	Node-level stats including remote cluster connections	Shows connection and latency metrics

Example: Monitoring Remote Clusters

curl -X GET "localhost:9200/_cluster/remote_info"

6. Using Skip Unavailable

Setting	Values	Description
skip_unavailable	`true`, `false`	Controls behavior when remote cluster is unreachable
Default Value	`false`	Search will fail if remote cluster is unavailable
Use Case	High availability scenarios	Allows search to continue with available clusters

Example: Skip Unavailable Configuration

cluster.remote.prod_cluster.skip_unavailable: true

7. Optimizing Cross-Cluster Queries

Optimization	Description	Impact
Query Size Limiting	Limit results per shard to prevent large result sets	Improves query performance and memory usage
Shard Allocation	Ensure shards are distributed across nodes	Reduces query latency and improves parallelism
Index Refresh Interval	Reduce refresh interval for near real-time search	Improves search freshness but increases resource usage

Note: Cross-cluster queries can be resource-intensive; optimize query size and shard distribution for best performance.

8. Configuring Proxy Mode

Mode	Description	Use Case
Proxy Mode	Remote cluster is accessed through a proxy node	Reduces direct client connections to remote clusters
Connection Mode	Direct connection to remote cluster nodes	Higher performance but more client connections
Configuration	`cluster.remote.<em>alias</em>.mode: proxy`	Used for centralized cluster management

Example: Proxy Mode Configuration

cluster.remote.prod_cluster.mode: proxy

9. Using Seed Nodes

Configuration	Values	Description
Seed Nodes	`["host:port"]`	List of nodes to connect to for cluster discovery
Number of Nodes	Minimum 1, recommended 3+	Ensures redundancy and availability
Host Format	`host:port`	Must be reachable from the local cluster

Example: Seed Node Configuration

cluster.remote.prod_cluster.seeds: ["elasticsearch-prod-1:9200", "elasticsearch-prod-2:9200", "elasticsearch-prod-3:9200"]

10. Testing Connectivity

Test Method	Description	Output
/_cluster/remote_info	Lists all remote clusters and their status	Shows connection state and node details
/_cluster/health	Checks overall cluster health including remote connections	Reports status of local and remote clusters
/_nodes/stats	Node statistics including remote connection metrics	Shows latency and connection details

Example: Testing Connectivity

curl -X GET "localhost:9200/_cluster/remote_info" | jq '.remote_clusters'