Serverless project settings

Project settings are configurations that apply to your entire project, managed from the Elastic Cloud console. While Elastic manages many things for you, you can customize the following aspects of your project:

  • Search AI Lake settings: Configure search performance, cache behavior, and data retention. The available settings depend on your project type.
  • Project features and add-ons: Select feature tiers and enable add-ons for your project type.
  • Project tags: Add custom tags to categorize and organize your projects alongside predefined tags.
  • Connection aliases: Use predictable, human-readable URLs for your projects that you can share easily.

To manage these settings:

  1. Navigate to cloud.elastic.co.
  2. Log in to your Elastic Cloud account.
  3. Select your project from the Serverless projects panel and click Manage.

To edit a project's settings, you must be granted the Admin or Editor role on the project.

Once ingested, your data is stored in cost-efficient, general storage. A cache layer is available on top of the general storage for recent and frequently queried data that provides faster search speed. Data in this cache layer is considered search-ready.

Together, these data storage layers form your project's Search AI Lake.

The total volume of search-ready data is the sum of the following:

  1. The volume of non-time series project data
  2. The volume of time series project data included in the Search Boost Window
Important

Time series data refers to any document in standard indices or data streams that includes a concrete @timestamp field. The @timestamp field must be an actual mapped field for data to be subject to the Search Boost Window setting. A field alias named @timestamp that points to another field does not qualify the data as time series data. Such data is always treated as search-ready and is not governed by the Search Boost Window.

Each project type offers different settings that let you adjust the performance and volume of search-ready data available in your projects.

Search Power controls the search resources that are provisioned for your project. How it works, and the values you can choose from, depend on your project type.

In Elasticsearch Serverless projects, Search Power controls the amount of baseline resources kept ready for your data and the maximum amount of resources the system can allocate to your project under high search load.

Increase Search Power to add resources for improved query throughput and performance as load increases. Decrease it to reduce the amount of provisioned resources, which lowers both active search costs and the reduced rate billed during idle periods, at the cost of more variable query latency. The On-demand setting provides the lowest baseline and idle cost.

The following Search Power settings are available:

On-demand
Low cost option. Query latency is variable and maximum throughput is limited, particularly during demand spikes.
Performant
Delivers low average query latency with no practical query throughput limits to meet varying demand.
High availability
Maintains consistent low query latency across most search workloads, from steady baseline to peak demand.

During a trial, some limits apply to Elasticsearch Serverless projects. Refer to Trial limitations.

In Elasticsearch Vector Database projects, Search Power reserves search capacity for your project. Unlike Elasticsearch Serverless projects, capacity is not scaled automatically based on query load.

The default value is 100, which reserves enough capacity to keep the project's entire data set available for low-latency search. You can increase Search Power in increments of 100 to reserve additional capacity for the same data set, which can improve performance for higher query concurrency or more demanding search loads. Higher values reserve proportionally more capacity: for example, 200 reserves about twice the capacity of 100. You can increase Search Power up to 1900.

In Elastic Observability Serverless and Elastic Security Serverless projects, search capacity is sized automatically based on the volume of search-ready data in your project. Search capacity does not scale automatically based on query load. If your workload requires additional search capacity, contact Elastic Support.

In Elasticsearch Serverless projects, non-time series data is always considered search-ready. The Search Boost Window determines the volume of time series project data that will be considered search-ready.

The default Search Boost Window is 7 days. You can set it to any value from 1 day to 180 days. Increasing the window results in a bigger portion of time series project data included in the total search-ready data volume.

During a trial, some limits apply to Elasticsearch Serverless projects. Refer to Trial limitations.

Elasticsearch Vector Database projects don't have a Search Boost Window setting.

In Elastic Observability Serverless and Elastic Security Serverless projects, search is optimized for fast, responsive performance on data from the most recent day, while historical data remains available for broader analysis. If your workload would benefit from extending this window, contact Elastic Support.

Data retention policies determine how long your project data is retained.

In Elastic Cloud Serverless, data retention policies are configured through data streams, and you can specify different retention periods for specific data streams in your project.

In addition to the retention period you set for each data stream, Elastic Security Serverless projects have two project-wide settings that you can use to manage data retention.

Maximum data retention period

When enabled, this setting determines the maximum length of time that data can be retained in any data stream of the project.

Editing this setting replaces the data retention set for all data streams of the project that have a longer data retention defined. Data older than the new maximum retention period that you set is permanently deleted.

Default data retention period
When enabled, this setting determines the default retention period that is automatically applied to all data streams in your project that do not have a custom retention period already set.

Elasticsearch Serverless, Elastic Observability Serverless, and Elasticsearch Vector Database projects rely on data stream settings to configure data retention. You can define a different retention period for each data stream from the Data Streams tab on the Index Management page. To open the Index Management page, use the global search field.

Elasticsearch Serverless and Elastic Observability Serverless projects also provide a shortcut: the Data Retention option in the Search AI Lake settings tab opens the Data Streams tab directly. Elasticsearch Vector Database projects don't include this option in the Search AI Lake settings tab.

Project features and add-ons control which capabilities are available in your serverless project and how they are billed. What you can configure depends on your project type:

There are no additional project features or on-demand add-ons for Elasticsearch Serverless or Elasticsearch Vector Database projects.

To change your project features, select your project from the Serverless projects panel and click Manage. On the project Overview page, next to Project features, click Edit.

Note

In Elastic Cloud Serverless, your organization's Elastic Cloud subscription level controls only the support level you receive, and is not related to the features that you use or have access to. Learn more about subscriptions.

For Elastic Security Serverless projects, edit the Project features to select a feature tier and enable add-on options for specific use cases.

Feature tier Description and add-ons
Elastic AI SOC Engine (EASE) A package of AI-powered tools meant to work with and enhance your existing SOC platforms: triage and correlate alerts from any platform using Attack Discovery, get realtime recommendations and assistance from AI Assistant, and share insights with your other tools.
Security Analytics Essentials A suite of security analytics, detections, investigations, and collaboration tools. Does not include AI-powered tools. Allows these add-ons:
• Endpoint Protection Essentials: endpoint protections with Elastic Defend.
• Cloud Protection Essentials: Cloud native security features.
Security Analytics Complete Everything in Security Analytics Essentials and EASE, plus advanced features such as entity analytics, threat intelligence, and more. Allows these add-ons:

• Endpoint Protection Complete: Everything in Endpoint Protection Essentials plus advanced endpoint detection and response features.
• Cloud Protection Complete: Everything in Cloud Protection Essentials plus advanced cloud security features.
Tip

For a full feature comparison, upgrading instructions, downgrading information, and more, refer to Elastic Security Serverless feature tiers.

For Elastic Observability Serverless projects, edit the Project features to select a feature tier.

Feature tier Description
Observability Logs Essentials Includes everything you need to store and analyze logs at scale.
Observability Complete Adds full-stack observability capabilities to monitor cloud-native and hybrid environments.
Tip

For a full feature comparison, upgrading instructions, and more, refer to Elastic Observability Serverless feature tiers.

Project tags are custom metadata key-value pairs that allow you to categorize and organize your projects. If you're using cross-project search in Elastic Cloud Serverless, tags also enable routing searches to specific projects.

  • Predefined tags are attributes that Elastic assigns automatically to each project, such as project type, cloud service provider, and region.
  • Custom tags are key-value pairs that you define in the Elastic Cloud console or using the API to further categorize and organize your projects.

Predefined tags are attributes that Elastic assigns automatically to each project. The following predefined tags are available:

  • _alias: the project alias
  • _csp: the cloud service provider
  • _id: the project identifier
  • _organization: the organization identifier
  • _region: the Cloud region where the project is located
  • _type: the project type (elasticsearch, vectordb, observability, or security)

Predefined tags always start with an underscore _.

You can add custom tags for any piece of metadata that might help you to categorize and organize your projects. For example, you might add custom tags to add the following metadata:

  • The team or department that uses the project: dept:finance, dept:marketing, dept:engineering
  • The environment type: env:dev, env:staging, or env:prod

Project tags must start with a letter, and can contain only lowercase letters, numbers, hyphens, and underscores.

  1. In Elastic Cloud, select your project from the Serverless projects panel and click Manage.
  2. From the Overview page for your project, in the Tags section, click Add tags.
  3. Add a key and value for your custom tag, and then click Add.
  4. When you're finished creating tags, click Save.

To remove a custom tag from a project, reopen the tag management drawer by clicking Add tags.

You can also manage your custom tags through the Elastic Cloud Serverless API.

You can manage custom tags using the POST or PATCH project endpoints for your project type:

Custom tags are passed as key-value pairs in the metadata.tags property of the request body:

				PATCH /api/v1/serverless/projects/elasticsearch/1234
					{
  "metadata": {
    "tags": {
      "dept": "support_eng",
      "env": "staging",
    }
  }
}
		
  1. /api/v1/serverless/projects/{project-type}/{project-id}

To remove a custom tag, pass a null value for that tag:

				PATCH /api/v1/serverless/projects/elasticsearch/1234
					{
  "metadata": {
    "tags": {
      "dept": null,
    }
  }
}
		
  1. /api/v1/serverless/projects/{project-type}/{project-id}

You can query your projects by their predefined or custom tags by adding the desired tags as query parameters:

				GET /api/v1/serverless/projects/{type}?tag[key1]=value1&tag[key2]=value2
		

For example, to query for all Elasticsearch projects that are staging environments belonging to support_eng:

				GET /api/v1/serverless/projects/elasticsearch?tag[env]=staging&tag[dept]=support_eng
		

To query for all Observability projects that are hosted on GCP:

				GET /api/v1/serverless/projects/observability?tag[_csp]=gcp
		

Connection aliases for your projects enable you to have predictable, human-readable URLs that can be shared easily. The connection alias must be unique for each region, across all accounts. New projects are assigned a default alias derived from the project name.

To modify the connection alias for a project:

  1. From the Serverless projects menu, select a project and click Manage.

  2. Locate Connection alias, click Edit.

  3. Define a new alias. Make sure you choose something meaningful to you.

    Tip

    Make the alias as unique as possible to avoid collisions. Aliases might have been already claimed by other users for projects in the region.

  4. Select Update alias.

Important

Renaming connection aliases might cause disruptions to applications and services that rely on these endpoints. Ensure that you update any references to the old alias to prevent issues.