The cross-cluster search feature allows any node to act as a federated client across multiple clusters. In contrast to the tribe node feature, a cross-cluster search node won’t join the remote cluster, instead it connects to a remote cluster in a light fashion in order to execute federated search requests.

Cross-cluster search works by configuring a remote cluster in the cluster state and connecting only to a limited number of nodes in the remote cluster. Each remote cluster is referenced by a name and a list of seed nodes. When a remote cluster is registered, its cluster state is retrieved from one of the seed nodes so that up to 3 gateway nodes are selected to be connected to as part of upcoming cross-cluster search requests. Cross-cluster search requests consist of uni-directional connections from the coordinating node to the previously selected remote nodes only. It is possible to tag which nodes should be selected through node attributes (see Cross-cluster search settings).

Each node in a cluster that has remote clusters configured connects to one or more gateway nodes and uses them to federate search requests to the remote cluster.

Configuring cross-cluster searchedit

Remote clusters can be specified globally using cluster settings (which can be updated dynamically), or local to individual nodes using the elasticsearch.yml file.

If a remote cluster is configured via elasticsearch.yml only the nodes with that configuration will be able to connect to the remote cluster. In other words, federated search requests will have to be sent specifically to those nodes. Remote clusters set via the cluster settings API will be available on every node in the cluster.

The elasticsearch.yml config file for a cross-cluster search node just needs to list the remote clusters that should be connected to, for instance:

search:
    remote:
        cluster_one: 
            seeds: 127.0.0.1:9300
        cluster_two: 
            seeds: 127.0.0.1:9301

The equivalent example using the cluster settings API to add remote clusters to all nodes in the cluster would look like the following:

PUT _cluster/settings
{
  "persistent": {
    "search": {
      "remote": {
        "cluster_one": {
          "seeds": [
            "127.0.0.1:9300"
          ]
        },
        "cluster_two": {
          "seeds": [
            "127.0.0.1:9301"
          ]
        },
        "cluster_three": {
          "seeds": [
            "127.0.0.1:9302"
          ]
        }
      }
    }
  }
}

A remote cluster can be deleted from the cluster settings by setting its seeds to null:

PUT _cluster/settings
{
  "persistent": {
    "search": {
      "remote": {
        "cluster_three": {
          "seeds": null 
        }
      }
    }
  }
}

Using cross-cluster searchedit

To search the twitter index on remote cluster cluster_one the index name must be prefixed with the cluster alias separated by a : character:

GET /cluster_one:twitter/_search
{
  "query": {
    "match": {
      "user": "kimchy"
    }
  }
}

{
  "took": 150,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "failed": 0,
    "skipped": 0
  },
  "_clusters": {
    "total": 1,
    "successful": 1,
    "skipped": 0
  },
  "hits": {
    "total": 1,
    "max_score": 1,
    "hits": [
      {
        "_index": "cluster_one:twitter",
        "_type": "_doc",
        "_id": "0",
        "_score": 1,
        "_source": {
          "user": "kimchy",
          "date": "2009-11-15T14:12:12",
          "message": "trying out Elasticsearch",
          "likes": 0
        }
      }
    ]
  }
}

In contrast to the tribe feature cross-cluster search can also search indices with the same name on different clusters:

GET /cluster_one:twitter,twitter/_search
{
  "query": {
    "match": {
      "user": "kimchy"
    }
  }
}

Search results are disambiguated the same way as the indices are disambiguated in the request. Even if index names are identical these indices will be treated as different indices when results are merged. All results retrieved from a remote index will be prefixed with their remote cluster name:

{
  "took": 150,
  "timed_out": false,
  "_shards": {
    "total": 2,
    "successful": 2,
    "failed": 0,
    "skipped": 0
  },
  "_clusters": {
    "total": 2,
    "successful": 2,
    "skipped": 0
  },
  "hits": {
    "total": 2,
    "max_score": 1,
    "hits": [
      {
        "_index": "cluster_one:twitter",
        "_type": "_doc",
        "_id": "0",
        "_score": 1,
        "_source": {
          "user": "kimchy",
          "date": "2009-11-15T14:12:12",
          "message": "trying out Elasticsearch",
          "likes": 0
        }
      },
      {
        "_index": "twitter",
        "_type": "_doc",
        "_id": "0",
        "_score": 2,
        "_source": {
          "user": "kimchy",
          "date": "2009-11-15T14:12:12",
          "message": "trying out Elasticsearch",
          "likes": 0
        }
      }
    ]
  }
}

Skipping disconnected clustersedit

By default all remote clusters that are searched via cross-cluster search need to be available when the search request is executed, otherwise the whole request fails and no search results are returned despite some of the clusters are available. Remote clusters can be made optional through the boolean skip_unavailable setting, set to false by default.

PUT _cluster/settings
{
  "persistent": {
    "search.remote.cluster_two.skip_unavailable": true 
  }
}

GET /cluster_one:twitter,cluster_two:twitter,twitter/_search 
{
  "query": {
    "match": {
      "user": "kimchy"
    }
  }
}

{
  "took": 150,
  "timed_out": false,
  "_shards": {
    "total": 2,
    "successful": 2,
    "failed": 0,
    "skipped": 0
  },
  "_clusters": { 
    "total": 3,
    "successful": 2,
    "skipped": 1
  },
  "hits": {
    "total": 2,
    "max_score": 1,
    "hits": [
      {
        "_index": "cluster_one:twitter",
        "_type": "_doc",
        "_id": "0",
        "_score": 1,
        "_source": {
          "user": "kimchy",
          "date": "2009-11-15T14:12:12",
          "message": "trying out Elasticsearch",
          "likes": 0
        }
      },
      {
        "_index": "twitter",
        "_type": "_doc",
        "_id": "0",
        "_score": 2,
        "_source": {
          "user": "kimchy",
          "date": "2009-11-15T14:12:12",
          "message": "trying out Elasticsearch",
          "likes": 0
        }
      }
    ]
  }
}

Cross-cluster search settingsedit

Retrieving remote clusters infoedit

The Remote Cluster Info API allows to retrieve information about the configured remote clusters, as well as the remote nodes that the cross-cluster search node is connected to.