> Is there a way to set up an index pattern to query all logs in all 3 clusters i.e. local and remote clusters

There's 2 options, that may (or may not) suit you.

1. `logstash-*,*:logstash-*` should do what you want. That will search locally and on all remote clusters.
2. You can set up a cross-cluster prefix that points to the local cluster. So you can define `cluster_1` with a seed of `localhost:9300` then `*:logstash-*` would search all 3 clusters. It would use the cross-cluster-search mechanism, but cross cluster search is fairly low overhead so that shouldn't cause a problem.
> I have tried the documented syntax of cluster_2,cluster_3:logstash-* and in Kibana 5.6.2 it does not work

Which document has that?
As far as _Elasticsearch_ is concerned, that pattern is

- the index named "cluster_2" in the local cluster
- the indices named "logstash-*" in the "cluster_3" cluster

It's possible that Kibana has some feature that handles it differently, but once it gets to Elasticsearch we split the names by comma and then treat each part independently.

NEW: Monitor These Apps!
elasticsearch, apache solr, apache hbase, hadoop, redis, casssandra, amazon cloudwatch, mysql, memcached, apache kafka, apache zookeeper, apache storm, ubuntu, centOS, red hat, debian, puppet labs, java, senseiDB