Loading

Cross-project search impacts and limitations

This page explains how setting up cross-project search affects features in the origin project, and lists overall limitations of cross-project search.

  • Alerting: By default, alerting rules in the origin project run against the combined dataset of the origin and all linked projects. Alerting rules tuned for a single project's data might produce false positives when they evaluate a larger dataset. This is one reason we recommend using a dedicated overview project, so that existing alerting rules on data projects are not affected.

  • Dashboards and visualizations: Existing dashboards and visualizations in the origin project will query all linked projects by default. To control this, set the default cross-project search scope for each space, or save explicit project routing on individual dashboard panels.

  • User permissions: cross-project search results are filtered by each user's role assignments across projects. Users with different roles will see different results from the same query. Refer to Manage user access.

  • Maximum of 20 linked projects: Each origin project can have up to 20 linked projects. A linked project can be associated with any number of origin projects.
  • Chaining/transitivity not supported: If Project A links to Project B, and Project B links to Project C, Project A cannot automatically search Project C. Each link is independent.
  • Links are unidirectional: Searches that run from a linked project do not run against the origin project. If you need bidirectional search, link the projects twice, in both directions.
  • System indices are excluded: System indices (such as .security and .fleet-*) are excluded from cross-project search.
  • Unavailable APIs: _transform and _fleet_search requests do not support CPS.
  • Workplace AI projects: Workplace AI projects are not compatible with cross-project search.
  • New projects only: During technical preview, only newly created projects can function as origin projects.
  • ML and transforms: ML anomaly detection jobs and transforms are not supported in the technical preview. They continue to run on origin project data only.
  • Failure store: 🚧 TODO