Troubleshoot anomaly detection datafeed project scope

The project_routing field decides which linked projects a cross-project search datafeed searches. This page covers routing that matches nothing, routing that matches too many projects, references to projects that no longer exist under an alias, and display counts that do not match the projects you expect.

Common symptoms include no results or origin-only results, slower extraction after linking projects, and job messages that reference a project alias that no longer exists.

Use these sources to gather diagnostic information:

• Anomaly detection job job messages in Kibana: Open Machine Learning → Anomaly Detection, select the job, and review the Job messages tab for audit entries and warnings about linked projects, credentials, or scope changes. On the Datafeed tab, View datafeed counts opens the datafeed chart flyout for extraction timing.

  The same entries are stored in .ml-notifications-*.

• GET _ml/datafeeds/{datafeed_id}: Shows the effective project_routing value and, when an internal cloud API key exists, authorization.cloud_api_key.id.

• GET _ml/datafeeds/{datafeed_id}/_stats: While the datafeed runs, shows remote_cluster_stats with total_clusters, available_clusters, skipped_clusters, availability_ratio, stabilized_cluster_aliases, and per_cluster_consecutive_skips. The object is absent until the first search cycle establishes a baseline.

• .ml-annotations-read: Scope-change annotations for the job. The annotation event field carries search_scope_changed (not the separate type field).

• GET /_project/tags: Lists linked projects and their tags so you can compare them with a routing expression.

• Elastic Cloud console: Review linked projects in Link and manage projects.

If extraction failures are ongoing, check Job messages first. remote_cluster_stats from get datafeed stats only updates after a cycle completes.

Open Machine Learning → Anomaly Detection and review the Project scope column. Each cell shows a parsed count out of the total project count (origin plus linked projects). For example, 2/5 means the expression targets 2 projects out of 5 available.

The parsed count comes from the routing expression text, not from which aliases match at runtime. To view the routing expression, open the job, go to the Datafeed tab, and check Project scope, or call GET _ml/datafeeds/{datafeed_id}.

A single wildcard expression like _alias:production-* shows 1, even if it matches several linked projects at runtime.

When the parsed count is lower than the number of projects named in the expression, your user might lack permission to view one or more linked projects. The column reflects what you can see, not every alias the expression could match.

During create, update, or extraction, job messages or the API can report one of these machine learning-enriched errors.

On create or update:

Create failures use the same Cannot update datafeed wording even though the request is a put.

Cannot update datafeed [my-datafeed]: project_routing [_alias:nonexistent-*] matched no linked project (no matching project after applying project routing [_alias:nonexistent-*]). Link the missing project in Elastic Cloud project settings, or update project_routing to a valid linked alias (for example _origin for local-only scope).
		

During extraction or preview:

Datafeed [my-datafeed] cannot search any project: project_routing [_alias:nonexistent-*] matched no linked projects at run time (no matching project after applying project routing [_alias:nonexistent-*]). Link the missing project(s) in Elastic Cloud project settings, or update project_routing to an expression that matches at least one linked project (for example _origin for local-only scope).
		

The bracketed datafeed id, routing expression, and parenthesized cause vary with your configuration. The parenthesized text comes from Elasticsearch itself, typically in one of these forms:

no matching project after applying project routing [_alias:nonexistent-*]
		

No such project: [missing-project] with project routing [_alias:production-*]
		

The suggested _origin example in the machine learning messages is not a valid routing value. Use _alias:_origin for origin-project-only scope instead. See Project routing in CPS.

A project_routing value that matches nothing is deferred to run time only when every entry in indices is unqualified. Any qualified project:index pattern, including one whose project alias is missing, fails immediately on create or update.

Update routing to a valid _alias: expression, or link the missing project in Link and manage projects. Stop the datafeed and close the anomaly detection job before you update routing. For step-by-step guidance on setting scope in Kibana or through the API, see Change the project scope of an anomaly detection job.

• The Project scope column shows the intended parsed/total count.
• GET _ml/datafeeds/{datafeed_id} returns the expected project_routing value.
• GET _ml/datafeeds/{datafeed_id}/_stats shows successful extraction cycles.

• datafeed extraction cycles take noticeably longer after new projects were linked.
• GET _ml/datafeeds/{datafeed_id}/_stats shows remote_cluster_stats fanning out to many linked projects you do not need.

Narrow project_routing to the projects you need. Stop the datafeed and close the anomaly detection job before you update. See Change the project scope of an anomaly detection job for how to set Project scope in Kibana or update routing through the API.

• The Project scope column shows the intended parsed/total count.
• GET _ml/datafeeds/{datafeed_id}/_stats shows remote_cluster_stats listing only the intended projects.
• Extraction cycle duration returns to expected levels.

• Job messages or extraction errors reference a project alias that no longer appears in GET /_project/tags or the Cloud console linked-project list.
• project_routing still contains an _alias: tag that matched a project before it was renamed or unlinked.
• A qualified index pattern such as old-alias:logs-* names a project alias that is no longer linked.

When indices contains a qualified project:index pattern, update both project_routing and the qualified index reference after a rename or unlink. Stop the datafeed and close the anomaly detection job before you update. See Change the project scope of an anomaly detection job.

Changing indices also changes the cross-project search surface, which can re-key the internal cloud API key. See Cloud credential problems.

If the project should still be in scope, re-establish the link in Link and manage projects.

• GET _ml/datafeeds/{datafeed_id} returns updated project_routing and indices values.
• Job messages no longer reference the stale alias.
• GET _ml/datafeeds/{datafeed_id}/_stats shows successful extraction cycles.