Cross-project search in Observability
Cross-project search (CPS) lets you run a single search request across multiple Serverless projects. When your observability data is split across projects to organize ownership, use cases, or environments, cross-project search lets you query all that data from a single origin project without searching each project individually.
When projects are linked, platform apps like Discover and Dashboards automatically include data from all linked projects. Observability apps have varying levels of CPS support. Some apps show cross-project data automatically; others remain scoped to the origin project. Cross-project search is unavailable for Logs Essentials projects.
For full details on CPS concepts, configuration, and search syntax, refer to:
- Cross-project search overview
- Configure cross-project search
- Manage cross-project search scope in your project apps
The following table shows how each Observability app behaves with CPS at technical preview.
| Observability app | CPS availability |
|---|---|
| APM (Service Inventory, Traces, Dependencies) | Available (scope selector available) |
| Infrastructure (Inventory, Hosts) | Available (scope selector available) |
| Observability Overview (Hosts, Log Events, Service Inventory) | Not available |
| Observability AI Assistant | Not available |
| SLOs | Not available |
| Rules (Custom Threshold, SLO Burn Rate) | Read-only |
| Synthetics (monitors, TLS Certificates) | Not available |
| Streams | Not available |
The CPS scope selector ( ) in the project header lets you search This project or All projects. It is available in platform apps like Discover, Dashboards, and Lens, as well as in APM and Infrastructure apps.
For other Observability-specific apps, the scope selector is not available. This means:
- Those apps operate in their default scope, which varies by app (refer to Observability app compatibility).
- The scope you select in platform apps like Discover does not carry over to Observability apps that don't support it.
- Data volumes might change when switching between Discover (which shows cross-project data by default) and an Observability app (which is scoped to the origin project) for the same index pattern.
For apps where the scope selector is available, refer to Managing cross-project search scope in your project apps.
When CPS is enabled, Discover shows documents from all linked projects by default, unless the space-level default scope has been changed. Observability apps may not have the same scope, which can lead to differences when navigating between them.
Streams remains scoped to the origin project only and does not support CPS. If you open a stream from Discover and the document is from a linked project, Observability shows a warning that the stream is remote. The Streams UI then shows origin project data only, so counts can differ from Discover.
To determine whether a document comes from the origin project or a linked project, refer to Identifying the location of a document.
The following known issues and limitations apply to CPS in Observability apps. For an overview of Observability app compatibility, refer to Observability app compatibility.
SLO burn rate rules query only origin project data, even when the underlying data view (for example, logs-*) returns cross-project data in Discover. This means Discover and rules may show different results for the same data view.
Machine learning rules are not available in CPS.
Only origin SLOs are visible, even when connected to a linked project.
Tracking: kibana#252955
In a CPS origin project, Discover may show no data even when linked projects contain data due to missing data views in the origin project.
Tracking: kibana#260930
Alerts are from the origin project only, even when rules are configured to act on cross-project data.
Synthetics monitors and TLS certificates are bound to saved objects and remain scoped to the origin project. Monitors from linked projects do not appear in the Synthetics UI of the origin project.