--- title: Managing cross-project search scope in your project apps description: Learn how to manage cross-project search scope from your project apps using the scope selector, query-level overrides, and space defaults. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6201/explore-analyze/cross-project-search/cross-project-search-manage-scope products: - Elastic Cloud Serverless - Kibana applies_to: - Elastic Cloud Serverless: Preview - Elastic Stack: Unavailable --- # Managing cross-project search scope in your project apps When [cross-project search (CPS)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6201/explore-analyze/cross-project-search) is enabled and projects are linked, searches initiated from your project's apps run across all linked projects by default. Kibana provides several ways to narrow or change this scope: - **Space default**: Admins [configure a default scope for each space](/elastic/docs-content/pull/6201/deploy-manage/cross-project-search-config/cps-config-access-and-scope#cps-default-search-scope), which applies when you start a new session. - **Session scope**: Use the [CPS scope selector](#cps-in-kibana) in the project's header to change which projects are searched during your session. - **Query-level override**: Use project routing or qualified index expressions in individual queries to target specific projects. ## Cross-project search scope selector The **Cross-project search (CPS) scope** selector (`cross_project_search`) in your project's header lets you control which linked projects your searches include. With the CPS scope selector, you can select: - **This project**: Searches only the origin project. - **All projects**: Searches the origin project and all linked projects. The scope selector also lists the aliases of all [linked projects](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6201/deploy-manage/cross-project-search-config/cps-config-link-and-manage), which is useful when you need to reference them in queries or index patterns. The scope selector is not editable in every app. Some apps display it as **read-only**, meaning the app uses the space default scope but you cannot change it. Other apps show it as **unavailable**, meaning the app searches only the current project. Refer to [Cross-project search availability by app](#cps-availability) for details. When you change the scope during a session, your selection is preserved as you navigate between apps. Admins can configure a [default cross-project search scope for each space](/elastic/docs-content/pull/6201/deploy-manage/cross-project-search-config/cps-config-access-and-scope#cps-default-search-scope), which is used when you start a new session. ## Override cross-project search scope at the query level In apps where you write queries, you can define a different cross-project search scope than the one set in the header's scope selector or the [space-level default](/elastic/docs-content/pull/6201/deploy-manage/cross-project-search-config/cps-config-access-and-scope#cps-default-search-scope). This is useful when you want a specific query or dashboard panel to search a different set of projects. There are two main mechanisms: - **[Project routing](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6201/explore-analyze/cross-project-search/cross-project-search-project-routing)**: Use a `project_routing` parameter to limit which projects a query runs against. In ES|QL, use [`SET project_routing`](/elastic/docs-content/pull/6201/explore-analyze/query-filter/languages/esql-kibana#esql-kibana-cps) at the beginning of your query. Project routing is evaluated before query execution, so excluded projects are never queried. - **[Qualified index expressions](/elastic/docs-content/pull/6201/explore-analyze/cross-project-search/cross-project-search-search#search-expressions)**: Prefix an index name with a project alias to target a specific project, for example `my_project:logs-*`. Qualified expressions work in index patterns and query source commands. For example, to search only a specific linked project from Discover, start your ES|QL query with: ```esql SET project_routing="_alias:my-project"; FROM logs-* | LIMIT 100 ``` ## Cross-project search availability by app Not all apps support cross-project search. The following table shows which apps support the CPS scope selector and query-level overrides. Any app with an ES|QL editor supports [`SET project_routing`](/elastic/docs-content/pull/6201/explore-analyze/query-filter/languages/esql-kibana#esql-kibana-cps) and [qualified index expressions](/elastic/docs-content/pull/6201/explore-analyze/cross-project-search/cross-project-search-search#search-expressions) in `FROM` commands. | App | CPS scope selector | Query-level overrides | |--------------------------------------|--------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Agent Builder** | Not available | ES|QL | | **Dashboards** | Editable | Per-panel overrides using ES|QL visualizations or Maps layer routing. Dashboards can also [store a cross-project search scope](/elastic/docs-content/pull/6201/explore-analyze/dashboards/using#dashboard-cps-scope). | | **Dev Tools / Console** | Not available | Full CPS through raw API requests, including ES|QL. The [Painless execute API](/elastic/docs-content/pull/6201/explore-analyze/cross-project-search#cps-painless-scripting) resolves index names differently. | | **Discover** | Editable | ES|QL | | **Lens visualizations** | Editable | ES|QL visualizations | | **Maps** | Editable | Layer-level [project routing](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6201/explore-analyze/cross-project-search/cross-project-search-project-routing) for vector layers and joins | | **Machine Learning AIOps Labs** | Editable | Not available | | **Machine Learning Data Visualizer** | Editable | ES|QL | | **Rules and alerts** | Read-only | ES|QL rules support `SET project_routing`. For non-ES|QL rules that use index patterns, you can use [qualified index expressions](/elastic/docs-content/pull/6201/explore-analyze/cross-project-search/cross-project-search-search#search-expressions) to scope the rule to specific projects. | | **Streams** | Not available | ES|QL | | **Vega** | Editable | Project routing in Vega specs | The header's CPS scope selector is not available in other apps, including Transforms, Canvas, and object listing pages. ### Cross-project search availability in Elastic Observability apps Observability apps have limited CPS support. The scope selector is not available in Observability apps, and most apps remain scoped to the origin project. The following table shows how each Observability app behaves with CPS: | Observability app | CPS availability | |-------------------------------------------------------------------|--------------------------------------| | **APM** (Service Inventory, Traces, Dependencies) | Available (scope selector available) | | **Infrastructure** (Inventory, Hosts) | Available (scope selector available) | | **Observability Overview** (Hosts, Log Events, Service Inventory) | Not available | | **Observability AI Assistant** | Not available | | **SLOs** | Not available | | **Rules** (Custom Threshold, SLO Burn Rate) | Read-only | | **Synthetics** (monitors, TLS Certificates) | Not available | | **Streams** | Not available | For specific app details, refer to [Cross-project search in Observability](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6201/solutions/observability/cross-project-search). ### Cross-project search availability in Elastic Security apps Elastic Security apps have partial CPS support. The following features work across linked projects: - **Timeline:** Tables display documents from linked projects. Actions that don't apply to remote documents are disabled. - **Alert, event, and attack flyouts:** Flyouts render correctly for documents from linked projects. Remote documents are clearly identified, and actions that don't apply to remote documents are hidden or disabled. Investigate in Timeline remains available. - **Dashboards:** The Detection & Response and Data Quality dashboards support CPS. - **Intelligence:** Threat intelligence indicator searches support CPS. The following features remain scoped to the origin project: - **Alerts:** The Alerts page does not display remote alerts from linked projects. - **Explore page:** Host, network, and user exploration searches are scoped to the origin project only. - **Entity store:** Entity risk scoring and entity profiles do not include data from linked projects. - **Attack Discovery**: AI-generated attack discoveries are based on alerts from the origin project only. - **Overview**: The Security Overview page reflects data from the origin project only. - **Defend and Osquery**: Elastic Defend and Osquery are scoped to the origin project only. Defend and Osquery are managed through Fleet, meaning their configuration is tied to a single project. Endpoint artifacts, policies, response actions, and Osquery saved queries and packs are managed per project and are not shared across linked projects. ## Related pages - [Cross-project search overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6201/explore-analyze/cross-project-search) - [Project routing](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6201/explore-analyze/cross-project-search/cross-project-search-project-routing) - [How search works in CPS](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6201/explore-analyze/cross-project-search/cross-project-search-search) - [Configure cross-project search access and scope](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6201/deploy-manage/cross-project-search-config/cps-config-access-and-scope) - [ES|QL in Kibana](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6201/explore-analyze/query-filter/languages/esql-kibana) - [Query across Serverless projects with ES|QL](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/esql-cross-serverless-projects) When a visualization panel uses a query-level override, it displays a **Custom CPS scope** badge on dashboards to indicate that it uses a different scope than the CPS scope selector.