Managing cross-project search scope in your project apps
When cross-project search (CPS) is enabled and projects are linked, searches initiated from your project's apps run across all linked projects by default. Kibana provides several ways to narrow or change this scope:
- Space default: Admins configure a default scope per space, which applies when you start a new session.
- Session scope: Use the CPS scope selector in the project's header to change which projects are searched during your session.
- Query-level override: Use project routing or qualified index expressions in individual queries to target specific projects.
The Cross-project search (CPS) scope selector in your project's header lets you control which linked projects your searches include.
With the CPS scope selector, you can select:
- This project: Searches only the origin project.
- All projects: Searches the origin project and all linked projects.
The scope selector also lists the aliases of all linked projects, which is useful when you need to reference them in queries or index patterns.
The scope selector is not editable in every app. Some apps display it as read-only, meaning the app uses the space default scope but you cannot change it. Other apps show it as unavailable, meaning the app searches only the current project. Refer to Cross-project search availability by app for details.
When you change the scope during a session, your selection is preserved as you navigate between apps. Admins can configure a default cross-project search scope for each space, which is used when you start a new session.
In apps where you write queries, you can define a different cross-project search scope than the one set in the header's scope selector or the space-level default. This is useful when you want a specific query or dashboard panel to search a different set of projects.
There are two main mechanisms:
- Project routing: Use a
project_routingparameter to limit which projects a query runs against. In ES|QL, useSET project_routingat the beginning of your query. Project routing is evaluated before query execution, so excluded projects are never queried. - Qualified index expressions: Prefix an index name with a project alias to target a specific project, for example
my_project:logs-*. Qualified expressions work in index patterns and query source commands.
For example, to search only a specific linked project from Discover, start your ES|QL query with:
SET project_routing="_alias:my-project";
FROM logs-*
| LIMIT 100
Not all apps support cross-project search. The following table shows which apps support the CPS scope selector and query-level overrides. Any app with an ES|QL editor supports SET project_routing and qualified index expressions in FROM commands.
| App | CPS scope selector | Query-level overrides |
|---|---|---|
| Agent Builder | Not available | ES|QL |
| Dashboards | Editable | Per-panel overrides using ES|QL visualizations or Maps layer routing. Dashboards can also store a cross-project search scope. |
| Dev Tools / Console | Not available | Full CPS through raw API requests, including ES|QL |
| Discover | Editable | ES|QL |
| Lens visualizations | Editable | ES|QL visualizations 1 |
| Maps | Editable | Layer-level project routing for vector layers and joins |
| Machine Learning Data Visualizer | Not available | ES|QL |
| Rules and alerts | Read-only | ES|QL rules support SET project_routing. For non-ES|QL rules that use index patterns, you can use qualified index expressions to scope the rule to specific projects. |
| Streams | Not available | ES|QL |
| Vega | Editable | Project routing in Vega specs |
The header's CPS scope selector is not available in other apps, including Transforms, Canvas, and object listing pages.
- Cross-project search overview
- Project routing
- How search works in CPS
- Configure cross-project search access and scope
- ES|QL in Kibana
- Query across Serverless projects with ES|QL
Footnotes
-
When a visualization panel uses a query-level override, it displays a Custom CPS scope badge on dashboards to indicate that it uses a different scope than the CPS scope selector.↩