---
title: Data view search syntax
description: Reference for the index pattern syntax used to point a Kibana data view at rolled up data, cross-cluster search, or cross-project search.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views/data-view-search-syntax
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Data view search syntax
When you [create a data view](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views/create-data-view), the index pattern you enter can use the following syntax to reach rolled up data, or data in other clusters or projects.

## Rolled up data

<applies-to>
  - Elastic Cloud Serverless: Unavailable
  - Elastic Stack: Deprecated
</applies-to>

<admonition title="Admonition">
  Rollups are deprecated. Use [downsampling](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/manage-data/data-store/data-streams/downsampling-time-series-data-stream) instead.
</admonition>

A data view can match one rollup index. For a combination rollup data view with both raw and rolled up data, use the standard notation:
```ts
rollup_logstash,kibana_sample_data_logs
```

For an example, refer to [Create and visualize rolled up data](/elastic/docs-content/pull/7723/manage-data/lifecycle/rollup/getting-started-kibana#rollup-data-tutorial).

## Cross-cluster search

<applies-to>
  - Elastic Cloud Serverless: Unavailable
  - Elastic Stack: Generally available
</applies-to>

If your Elasticsearch clusters are configured for [cross-cluster search](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/cross-cluster-search), you can create a data view to search across the clusters of your choosing. Specify data streams, indices, and aliases in a remote cluster using the following syntax:
```ts
<remote_cluster_name>:<target>
```

To query Logstash indices across two Elasticsearch clusters that you set up for cross-cluster search, named `cluster_one` and `cluster_two`:
```ts
 cluster_one:logstash-*,cluster_two:logstash-*
```

Use wildcards in your cluster names to match any number of clusters. To search Logstash indices across clusters named `cluster_foo`, `cluster_bar`, and so on:
```ts
cluster_*:logstash-*
```

To query across all Elasticsearch clusters that have been configured for cross-cluster search, use a standalone wildcard for your cluster name:
```ts
*:logstash-*
```

To match indices starting with `logstash-`, but exclude those starting with `logstash-old`, from all clusters having a name starting with `cluster_`:
```ts
cluster_*:logstash-*,cluster_*:-logstash-old*
```

Excluding a cluster avoids sending any network calls to that cluster. To exclude a cluster with the name `cluster_one`:
```ts
cluster_*:logstash-*,-cluster_one:*
```

Once you configure a data view to use the cross-cluster search syntax, all searches and aggregations using that data view in Kibana take advantage of cross-cluster search.
For more information, refer to [Excluding clusters or indices from cross-cluster search](/elastic/docs-content/pull/7723/explore-analyze/cross-cluster-search#exclude-problematic-clusters).

## Cross-project search

<applies-to>
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Unavailable
</applies-to>

When [cross-project search](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/cross-project-search) is enabled and you have [linked projects](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/deploy-manage/cross-project-search-config/cps-config-link-and-manage), the data view creation form previews matching indices from linked projects based on the current [cross-project search scope](/elastic/docs-content/pull/7723/explore-analyze/cross-project-search/cross-project-search-manage-scope#cps-in-kibana). The data view itself does not store the scope. When you query the data view, results come from whichever linked projects the active cross-project search scope includes at that time.
To restrict a data view to specific projects regardless of the active scope, you can:
- **Use [qualified expressions](/elastic/docs-content/pull/7723/explore-analyze/cross-project-search/cross-project-search-search#search-expressions)** in the index pattern to target specific projects, for example `project_alpha:logs-*,project_beta:logs-*`. To search only the origin project, use `_origin:logs-*`.
- **Use [project routing](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/cross-project-search/cross-project-search-project-routing)** in your queries to narrow scope at query time.


## Related pages

- [Create a data view](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views/create-data-view)
- [Data views](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7723/explore-analyze/find-and-organize/data-views)