> Is there a way to set up an index pattern to query all logs in all 3 clusters i.e. local and remote clusters
There's 2 options, that may (or may not) suit you.
1. `logstash-*,*:logstash-*` should do what you want. That will search locally and on all remote clusters.
2. You can set up a cross-cluster prefix that points to the local cluster. So you can define `cluster_1` with a seed of `localhost:9300` then `*:logstash-*` would search all 3 clusters. It would use the cross-cluster-search mechanism, but cross cluster search is fairly low overhead so that shouldn't cause a problem.
> I have tried the documented syntax of cluster_2,cluster_3:logstash-* and in Kibana 5.6.2 it does not work
Which document has that?
As far as _Elasticsearch_ is concerned, that pattern is
- the index named "cluster_2" in the local cluster
- the indices named "logstash-*" in the "cluster_3" cluster
It's possible that Kibana has some feature that handles it differently, but once it gets to Elasticsearch we split the names by comma and then treat each part independently.