---
title: Search scope changed
description: When linked projects are added or removed, a cross-project search machine learning datafeeds may search a different set of projects than when the anomaly...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7403/troubleshoot/elasticsearch/machine-learning/cps-datafeed-search-scope-changed
products:
  - Elastic Cloud Serverless
  - Elasticsearch
  - Machine Learning
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Unavailable
---

# Search scope changed
When linked projects are added or removed, a cross-project search machine learning datafeeds may search a different set of projects than when the anomaly detection jobs model was trained. Elasticsearch records scope changes after they stabilize across several extraction cycles. Temporary anomalies are expected while the model adapts to the new data distribution.
<tip>
  If you can't find your issue here, explore the other [troubleshooting topics](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7403/troubleshoot) or [contact us](/elastic/docs-content/pull/7403/troubleshoot#contact-us).
</tip>


## Diagnose search scope changed

**Error messages**
Scope changes appear in machine learning job **Messages** (Kibana **Machine Learning → Anomaly Detection → your job → Messages**, or the `.ml-notifications-*` index). When a project is newly linked, you may see:
```txt
Datafeed search scope changed: [project] linked. Data distribution may have changed due to new data sources, which can cause temporary anomalies while the model adapts. If detection quality degrades, consider specifying the source clusters explicitly and reviewing recent model snapshots for potential rollback.
```

When a project is unlinked, you may see:
```txt
Datafeed search scope changed: [project] unlinked. Data distribution may have changed due to removed data sources, which can cause temporary anomalies as patterns the model learned are no longer present. If detection quality degrades, consider specifying the source clusters explicitly and reviewing recent model snapshots for potential rollback.
```

Replace `[project]` with the linked project alias from your message.
**Check annotations**
Elasticsearch also writes scope-change annotations to `.ml-annotations-*` for the job id. Search that index for the job id and annotation type `search_scope_changed` to see when scope stabilized and which projects changed.
**Check datafeed statistics**
Use the [get datafeed stats API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ml-get-datafeed-stats) to compare linked-project visibility over recent cycles:
```json
```

Inspect `remote_cluster_stats` together with `project_routing` from `GET _ml/datafeeds/{datafeed_id}` to confirm whether the effective search scope matches your intent.

## Resolve search scope changed

**Restore or narrow the project link**
If the scope change was unintentional, re-establish the project link in Elastic Cloud project settings, or update `project_routing` so the datafeeds searches only the projects you want:
```json

{
  "project_routing": "_alias:production-*"
}
```

Use `_origin` or `_alias:_origin` for local-only analysis. For syntax details, see [Project routing in CPS](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7403/explore-analyze/cross-project-search/cross-project-search-project-routing).
**Roll back the model if detection quality degrades**
If anomalies persist after the scope change and are not meaningful, revert to a model snapshot taken before the change:
1. Close the job.
2. In Kibana, open **Machine Learning → Anomaly Detection → your job → Model snapshots**, select a snapshot from before the scope change, and revert.
3. Restart the datafeeds after confirming `project_routing` matches your intended scope.

If you deliberately widened scope, Elasticsearch may retain a snapshot automatically when you update `project_routing` with the job closed — use that retained snapshot for rollback.
**Verify recovery**
After fixing the link or routing, confirm new `SEARCH_SCOPE_CHANGED` annotations stop appearing and that **Messages** no longer report scope-change warnings on every cycle.