--- title: Managing cross-project search scope in your project apps description: Learn how to manage cross-project search scope from your project apps using the scope selector, query-level overrides, and space defaults. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/cross-project-search/cross-project-search-manage-scope products: - Elastic Cloud Serverless - Kibana applies_to: - Elastic Cloud Serverless: Preview - Elastic Stack: Unavailable --- # Managing cross-project search scope in your project apps When [cross-project search (CPS)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/cross-project-search) is enabled and projects are linked, searches initiated from your project's apps run across all linked projects by default. Kibana provides several ways to narrow or change this scope: - **Space default**: Admins [configure a default scope for each space](/elastic/docs-content/pull/8004/deploy-manage/cross-project-search-config/cps-config-access-and-scope#cps-default-search-scope), which applies when you start a new session. - **Session scope**: Use the [CPS scope selector](#cps-in-kibana) in the project's header to change which projects are searched during your session. - **Query-level override**: Use project routing or qualified index expressions in individual queries to target specific projects. ## Cross-project search scope selector The **Cross-project search (CPS) scope** selector (`cross_project_search`) in your project's header lets you control which linked projects your searches include. With the CPS scope selector, you can select: - **This project**: Searches only the origin project. - **All projects**: Searches the origin project and all linked projects. The scope selector also lists the aliases of all [linked projects](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/deploy-manage/cross-project-search-config/cps-config-link-and-manage), which is useful when you need to reference them in queries or index patterns. The scope selector is not editable in every app. Some apps display it as **read-only**, meaning the app uses the space default scope but you cannot change it. Other apps show it as **unavailable**, meaning the app searches only the current project. Refer to [Cross-project search availability by app](#cps-availability) for details. When you change the scope during a session, your selection is preserved as you navigate between apps. Admins can configure a [default cross-project search scope for each space](/elastic/docs-content/pull/8004/deploy-manage/cross-project-search-config/cps-config-access-and-scope#cps-default-search-scope), which is used when you start a new session. ## Override cross-project search scope at the query level In apps where you write queries, you can define a different cross-project search scope than the one set in the header's scope selector or the [space-level default](/elastic/docs-content/pull/8004/deploy-manage/cross-project-search-config/cps-config-access-and-scope#cps-default-search-scope). This is useful when you want a specific query or dashboard panel to search a different set of projects. There are two main mechanisms: - **[Project routing](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/cross-project-search/cross-project-search-project-routing)**: Use a `project_routing` parameter to limit which projects a query runs against. In ES|QL, use [`SET project_routing`](/elastic/docs-content/pull/8004/explore-analyze/query-filter/languages/esql-kibana#esql-kibana-cps) at the beginning of your query. Project routing is evaluated before query execution, so excluded projects are never queried. - **[Qualified index expressions](/elastic/docs-content/pull/8004/explore-analyze/cross-project-search/cross-project-search-search#search-expressions)**: Prefix an index name with a project alias to target a specific project, for example `my_project:logs-*`. Qualified expressions work in index patterns and query source commands. For example, to search only a specific linked project from Discover, start your ES|QL query with: ```esql SET project_routing="_alias:my-project"; FROM logs-* | LIMIT 100 ``` ## Cross-project search availability by app Not all apps support cross-project search. The following table shows which apps support the CPS scope selector and query-level overrides. Any app with an ES|QL editor supports [`SET project_routing`](/elastic/docs-content/pull/8004/explore-analyze/query-filter/languages/esql-kibana#esql-kibana-cps) and [qualified index expressions](/elastic/docs-content/pull/8004/explore-analyze/cross-project-search/cross-project-search-search#search-expressions) in `FROM` commands. | App | CPS scope selector | Query-level overrides | |--------------------------------------|--------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Agent Builder** | Not available | ES|QL | | **Dashboards** | Editable | Per-panel overrides using ES|QL visualizations or Maps layer routing. Dashboards can also [store a cross-project search scope](/elastic/docs-content/pull/8004/explore-analyze/dashboards/using#dashboard-cps-scope). Dashboard controls, such as **Options list** controls, suggest values from all projects in the selected CPS scope. | | **Dev Tools / Console** | Not available | Full CPS through raw API requests, including ES|QL. The [Painless execute API](/elastic/docs-content/pull/8004/explore-analyze/cross-project-search#cps-painless-scripting) resolves index names differently. | | **Discover** | Editable | ES|QL | | **Lens visualizations** | Editable | ES|QL visualizations | | **Maps** | Editable | Layer-level [project routing](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/cross-project-search/cross-project-search-project-routing) for vector layers and joins | | **Machine Learning AIOps Labs** | Editable | Not available | | **Machine Learning Data Visualizer** | Editable | ES|QL | | **Rules and alerts** | Read-only | ES|QL rules support `SET project_routing`. For non-ES|QL rules that use index patterns, you can use [qualified index expressions](/elastic/docs-content/pull/8004/explore-analyze/cross-project-search/cross-project-search-search#search-expressions) to scope the rule to specific projects. | | **Streams** | Not available | ES|QL | | **Vega** | Editable | Project routing in Vega specs | The header's CPS scope selector is not available in other apps, including Transforms, Canvas, and object listing pages. ### Cross-project search availability in Elastic Observability apps Observability apps have partial CPS support. The following table shows how each app behaves with CPS: | Observability app | CPS availability | |-------------------------------------------------------------------|--------------------------------------------------------------------------| | **APM** (Service Inventory, Traces, Dependencies) | Available (scope selector available) | | **Infrastructure** (Inventory, Hosts) | Available (scope selector available) | | **Observability Overview** (Hosts, Log Events, Service Inventory) | Not available | | **SLOs** | Available (scope stored on the SLO) | | **Alerts** | [This project's alerts only](#obs-cps-overview-alerts) | | **Rules** (Custom Threshold) | Read-only | | **Synthetics** (monitors, TLS Certificates) | Available (scope selector available; view monitors from linked projects) | | **Streams** | Not available | For specific app details, refer to [Cross-project search in Observability](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/solutions/observability/cross-project-search). ### Cross-project search availability in Elastic Security apps Elastic Security apps have partial CPS support. The following features work across linked projects: - **Timeline:** Tables display documents from linked projects. Actions that don't apply to remote documents are disabled. - **Alert, event, and attack flyouts:** Flyouts render correctly for documents from linked projects. Remote documents are clearly identified, and actions that don't apply to remote documents are hidden or disabled. Investigate in Timeline remains available. - **Dashboards:** The Detection & Response and Data Quality dashboards support CPS. - **Intelligence:** Threat intelligence indicator searches support CPS. The following features remain scoped to the origin project: - **Alerts:** The Alerts page does not display remote alerts from linked projects. - **Explore page:** Host, network, and user exploration searches are scoped to the origin project only. - **Entity store:** Entity risk scoring and entity profiles do not include data from linked projects. - **Attack Discovery**: AI-generated attack discoveries are based on alerts from the origin project only. - **Overview**: The Security Overview page reflects data from the origin project only. - **Defend and Osquery**: Elastic Defend and Osquery are scoped to the origin project only. Defend and Osquery are managed through Fleet, meaning their configuration is tied to a single project. Endpoint artifacts, policies, response actions, and Osquery saved queries and packs are managed per project and are not shared across linked projects. ## Related pages - [Cross-project search overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/cross-project-search) - [Project routing](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/cross-project-search/cross-project-search-project-routing) - [How search works in CPS](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/cross-project-search/cross-project-search-search) - [Configure cross-project search access and scope](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/deploy-manage/cross-project-search-config/cps-config-access-and-scope) - [ES|QL in Kibana](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/query-filter/languages/esql-kibana) - [Query across Serverless projects with ES|QL](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/esql-cross-serverless-projects) When a visualization panel uses a query-level override, it displays a **Custom CPS scope** badge on dashboards to indicate that it uses a different scope than the CPS scope selector.