Configure cross-project search

With cross-project search (CPS), users in your organization can search across multiple Elastic Cloud Serverless projects. This page explains how to configure and manage cross-project search for your users, including linking projects, managing user access, and configuring search scopes.

Cross-project search runs across origin and linked projects within your Elastic Cloud organization:

• Origin project: The base project where you create links and run searches.
• Linked projects: The projects you connect to the origin project.

After you link projects, searches from the origin project run across the origin and all linked projects by default. To adjust this, you can configure the default search scope.

For more information about using cross-project search, including search expressions, tags, and project routing, refer to Cross-project search.

To configure cross-project search, make sure you meet these prerequisites:

• You must be an organization owner or project administrator.
• Your origin and linked projects must be compatible, as explained in the next section.
• Your projects must use Elastic Cloud API keys.

When you configure cross-project search, only compatible projects are available for linking:

Workplace AI projects are not compatible with cross-project search.

Cross-project search is available for the following feature tiers:

• Elasticsearch projects require the Serverless Plus add-on.
• Elastic Security Serverless and Elastic Observability Serverless projects require the Complete feature tier.

To link projects, use the cross-project search linking wizard in the Cloud UI:

1. On the home screen, find the project you want to use as the origin project and click Manage.

2. Click Link projects on the Cross-project search tile. Or click Cross-project search in the navigation, then click Link projects.

3. Browse or search for projects to link to the origin project. Only compatible projects appear in the project list. You can filter the project list by type, cloud provider, region, and tags.

4. Select the checkbox for each project you want to link. You can link up to 20 projects per origin project.

   Note

   If a project you expected to link to is missing from the list, it might not be compatible with the origin project.

5. Complete the remaining steps in the wizard to review and save your selections. In the last step, you can click View API request to see the equivalent API request for linking to the selected projects.

On the origin project's Cross-project search page, you can reconfigure cross-project search as needed:

• Link additional projects: Click Link projects to add more linked projects, up to the 20-project maximum.
• Unlink projects: Remove connections by unlinking projects.
• Open space settings in Kibana: Click Manage Space to set or adjust the default search scope.

You can remove linked projects from your origin project at any time. Select the checkbox next to the projects you want to remove from cross-project search, then click Unlink.

After you confirm, searches from the origin project will no longer include data from the unlinked projects.

Cross-project search respects user permissions across projects. When a user runs a cross-project search from the origin project, results are filtered based on that user's permissions in each linked project.

For example, if Project A is linked to Projects B and C, but a user only has access to Projects A and B, that user's cross-project searches will return results from A and B only. Results from Project C are excluded because the user does not have the necessary credentials.

As an administrator, make sure that users who need to search across linked projects have the appropriate roles and API keys. Authorization for cross-project search is evaluated on the linked project, without regard to the origin project.

TODO expand including how to diagnose access troubles

For details about managing roles and API keys, refer to Users and roles and API keys.

The search scope is the set of searchable resources included in a cross-project search. The scope can be:

• Origin project + all linked projects (default)
• Origin project + a set of linked projects, as defined by project routing
• Origin project only

The search scope is further restricted by the user's or key's permissions.

By default, an unqualified search from an origin project targets the searchable resources in all linked projects, plus the searchable resources in the origin project. This default search scope is intentionally broad, to provide the best user experience for searching across linked projects. As an administrator, you can narrow the search scope by adjusting the default scope for the space.

The following actions change the search scope:

• Administrator actions:
  • Setting the default cross-project search scope for a space
  • Adjusting user permissions based on roles or API keys
• User actions:
  • Using qualified search expressions
  • Using project routing

The search scope controls which projects receive the search request, while filtering controls which results are returned by the search.

To open space settings in Kibana, click Configure Space settings in Kibana in the banner that appears when you link projects. Or click Manage Space at the top of the project page. Select the space you want to configure.

In the cross-project search scope settings, choose the default scope:

• All projects: (default) Searches run across the origin project and all linked projects.
• Origin project only: Searches run only against the origin project's data.
• Specific projects: Select individual linked projects to include in the default scope.

Users can also set the search scope on a per-query basis as needed, using qualified search expressions or project routing.

When you set up cross-project search, consider creating a dedicated overview project that can act as an origin project. You can also think of this as a hub-and-spoke pattern.

In this architecture, you create a new, empty project and link existing projects to it. You run all cross-project searches and dashboards from the overview project, while your existing projects continue to operate independently. Isolated projects stay isolated and TK

TODO cover other arch patterns (less recommended)

Enabling cross-project search affects several features in the origin project:

• Billing and data transfer: TODO

• Alerting: By default, alerting rules in the origin project run against the combined dataset of the origin and all linked projects. (This is one reason we recommend using a dedciated overview project.)

• Dashboards and visualizations: After you link projects, existing dashboards and visualizations in the origin project will query all linked projects. To limit this scope, refer to Manage search scope.

• New projects only: During technical preview, only newly created projects can function as origin projects. This is a temporary restriction.
• Maximum of 20 linked projects: Each origin project can have up to 20 linked projects. A linked project can be associated with any number of origin projects.
• Chaining/transitivity not supported: If Project A links to Project B, and Project B links to Project C, Project A cannot automaticallysearch Project C. Each link is independent.
• Links are unidirectional: Searches that run from a linked project do not run against the origin project. If you need bidirectional search, link the projects twice, in both directions.
• System indices are excluded: System indices (such as .security and .fleet-*) are excluded from cross-project search.
• Some APIs are not supported: _reindex (cross-project), _transform, and _fleet_search are not supported for cross-project use.
• TODO verify Failure store: Failure store does not work with cross-project search in the technical preview.
• Workplace AI projects: Workplace AI projects are not compatible with cross-project search.
• Project aliases: During technical preview, you can't edit a project's alias on the Cross-project search page.

You can also link and unlink projects using the API. In the linking wizard, click View API request on the review step to see the equivalent API call for your current selection.

For information about searching across linked projects using the API, refer to Cross-project search.