--- title: Cross-project search in Observability description: Learn how cross-project search (CPS) works in Elastic Observability, including app compatibility, scope selector behavior, and known limitations. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/solutions/observability/cross-project-search products: - Elastic Observability applies_to: - Elastic Cloud Serverless: Preview - Elastic Stack: Unavailable --- # Cross-project search in Observability [Cross-project search (CPS)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/cross-project-search) lets you run a single search request across multiple Serverless projects. When your observability data is split across projects to organize ownership, use cases, or environments, cross-project search lets you query all that data from a single origin project without searching each project individually. When projects are linked, platform apps like Discover and Dashboards automatically include data from all linked projects. Observability apps have partial CPS support. Some apps show cross-project data automatically; others remain scoped to the origin project. Cross-project search is unavailable for Logs Essentials projects. For full details on CPS concepts, configuration, and search syntax, refer to: - [Cross-project search overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/cross-project-search) - [Configure cross-project search](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/deploy-manage/cross-project-search-config) - [Manage cross-project search scope in your project apps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/cross-project-search/cross-project-search-manage-scope) ## Observability app compatibility The following table shows how each Observability app behaves with CPS. | Observability app | CPS availability | |-------------------------------------------------------------------|--------------------------------------------------------------------------| | **APM** (Service Inventory, Traces, Dependencies) | Available (scope selector available) | | **Infrastructure** (Inventory, Hosts) | Available (scope selector available) | | **Observability Overview** (Hosts, Log Events, Service Inventory) | Not available | | **SLOs** | Available (scope stored on the SLO) | | **Alerts** | [This project's alerts only](#obs-cps-overview-alerts) | | **Rules** (Custom Threshold) | Read-only | | **Synthetics** (monitors, TLS Certificates) | Available (scope selector available; view monitors from linked projects) | | **Streams** | Not available | ## Cross-project search scope selector in Observability apps How you set project scope depends on the app. APM, Infrastructure, and Synthetics use the [CPS scope selector](/elastic/docs-content/pull/8004/explore-analyze/cross-project-search/cross-project-search-manage-scope#cps-in-kibana) (`cross_project_search`) in the project header, as do platform apps like Discover, Dashboards, and Lens. When you [create an SLO](/elastic/docs-content/pull/8004/solutions/observability/incident-management/create-an-slo#slo-cps-scope), specify an SLO-specific **Project scope** to choose which linked projects the SLO monitors. For other Observability-specific apps, the scope selector is not available. This means: - Those apps operate in their default scope, which varies by app (refer to [Observability app compatibility](#obs-cps-compatibility)). - The scope you select in platform apps like Discover does not carry over to Observability apps that don't support it. - Data volumes might change when switching between Discover (which shows cross-project data by default) and features in the Observability app (which is scoped to the origin project) for the same index pattern. To learn how to use the scope selector to include or exclude linked projects, refer to [Managing cross-project search scope in your project apps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/cross-project-search/cross-project-search-manage-scope). ## Navigating between Discover and Observability apps When CPS is enabled, Discover shows documents from all linked projects by default, unless the space-level default scope has been changed. Observability apps might not have the same scope, which can lead to differences when navigating between them. ### Discover to Streams Streams remains scoped to the origin project only and does not support CPS. If you open a stream from Discover and the document is from a linked project, Observability shows a warning that the stream is remote. The Streams UI then shows origin project data only, so counts can differ from Discover. ## Identifying the location of a document To determine whether a document comes from the origin project or a linked project, refer to [Identifying the location of a document](/elastic/docs-content/pull/8004/explore-analyze/cross-project-search#cps-identify-documents). ## Known issues and limitations The following known issues and limitations apply to CPS in Observability apps. For an overview of Observability app compatibility, refer to [Observability app compatibility](#obs-cps-compatibility). ### Rules data scope inconsistency SLO burn rate rules query the SLO's [SLI and summary indices](/elastic/docs-content/pull/8004/solutions/observability/incident-management/create-an-slo-burn-rate-rule#indices-used-by-this-rule), not the SLO's source data view. Those indices reflect the **Project scope** stored on the SLO. Discover uses the session scope on that source data view. If those scopes differ, Discover can show more or fewer documents than the rule evaluates. Machine learning rules query the anomaly detection job's results, not the job's source data. Those results reflect the **Project scope** stored on the [job](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8004/explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs). Synthetics status and TLS rules query origin-project monitors only, even when the scope selector includes linked projects. ### SLO visibility Only origin SLOs are visible, even when connected to a linked project. To monitor SLO breaches across Elasticsearch projects, create SLOs in this project and [scope them](/elastic/docs-content/pull/8004/solutions/observability/incident-management/create-an-slo#slo-cps-scope) to linked projects. ### Alerts are origin only **Alerts** are from the origin project only, even when rules are configured to act on cross-project data.