--- title: Troubleshoot cross-project search datafeeds description: Anomaly detection datafeeds on Elastic Cloud Serverless can search data across linked projects when cross-project search is configured. These topics help... url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning-cps products: - Elastic Cloud Serverless - Elasticsearch - Machine Learning applies_to: - Elastic Cloud Serverless: Preview - Elastic Stack: Unavailable --- # Troubleshoot cross-project search datafeeds Anomaly detection datafeeds on Elastic Cloud Serverless can search data across linked projects when cross-project search is configured. These topics help you diagnose and resolve problems with project scope (`project_routing`), internal cloud credentials, linked-project availability, and field mappings. Before you troubleshoot, confirm that projects are linked and that users have access. See [Link and manage projects](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/deploy-manage/cross-project-search-config/cps-config-link-and-manage) and the [Cross-project search overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/explore-analyze/cross-project-search). If you can't find your issue here, explore the other [troubleshooting topics](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot) or [contact us](/elastic/docs-content/pull/8277/troubleshoot#contact-us). ## Where to find diagnostics Use these sources to gather diagnostic information: - **Anomaly detection job job messages in Kibana**: Open **Machine Learning → Anomaly Detection**, select the job, and review the **Job messages** tab for audit entries and warnings about linked projects, credentials, or scope changes. On the **Datafeed** tab, **View datafeed counts** opens the datafeed chart flyout for extraction timing. The same entries are stored in `.ml-notifications-*`. - **`GET _ml/datafeeds/{datafeed_id}`**: Shows the effective `project_routing` value and, when an internal cloud API key exists, `authorization.cloud_api_key.id`. - **`GET _ml/datafeeds/{datafeed_id}/_stats`**: While the datafeed runs, shows `remote_cluster_stats` with `total_clusters`, `available_clusters`, `skipped_clusters`, `availability_ratio`, `stabilized_cluster_aliases`, and `per_cluster_consecutive_skips`. The object is absent until the first search cycle establishes a baseline. - **`.ml-annotations-read`**: Scope-change annotations for the job. The annotation `event` field carries `search_scope_changed` (not the separate `type` field). - **`GET /_project/tags`**: Lists linked projects and their tags so you can compare them with a routing expression. - **Elastic Cloud console**: Review linked projects in [Link and manage projects](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/deploy-manage/cross-project-search-config/cps-config-link-and-manage). If extraction failures are ongoing, check **Job messages** first. `remote_cluster_stats` from [get datafeed stats](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ml-get-datafeed-stats) only updates after a cycle completes. ## Find your issue Start with the symptom that best matches what you see: | Symptom | Start here | Notes | |--------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | The datafeed returns no results | [Project scope problems](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-project-scope) | — | | Results come only from the origin project | [Project scope problems](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-project-scope) | If `project_routing` is `_alias:_origin` or the job has no stored routing, this is expected legacy behavior.If `authorization.cloud_api_key.id` is missing or job messages report a cleared or never-minted key, refer to [Cloud credential problems](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-credentials) instead. | | Extraction cycles are suddenly slower after you linked projects | [Project scope problems](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-project-scope) | — | | The datafeed keeps failing with extraction errors | [Linked project unavailable](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-linked-project-unavailable) | Use this page when job messages report a skipped linked project. For authorization failures, refer to [Cloud credential problems](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-credentials). For field type conflicts, refer to [Field mapping conflicts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-field-mappings). | | Elasticsearch or Kibana rejected a project scope change | [Project scope changes](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-scope-change) | — | | Some jobs failed during a bulk **Change project scope** update | [Project scope changes](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-scope-change) | — | | Anomaly scores spiked after a scope change | [Project scope changes](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-scope-change) | — | | A field is missing, a project is excluded from a run, or mappings conflict across projects | [Field mapping conflicts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-field-mappings) | — | | Authorization errors after the datafeed had been working | [Cloud credential problems](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-credentials) | — | ## Find an error message If you already have an error or audit string from **Job messages**, the API, or Kibana, use this index: | Message (substring match) | Page | |---------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `matched no linked project` / `cannot search any project` | [Project scope problems](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-project-scope) | | `remote clusters out of` / `were skipped when performing datafeed search` | [Linked project unavailable](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-linked-project-unavailable) | | `Cannot update project_routing` / `while its status is started` | [Project scope changes](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-scope-change) | | `Rollback model snapshot` retained before `project_routing` scope change | [Project scope changes](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-scope-change) | | `CPS migration: project_routing defaulted` | [Run a job > Legacy jobs](/elastic/docs-content/pull/8277/explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs#ml-ad-cps-legacy) | | `Datafeed search scope changed` / `Elevated anomaly scores detected after search scope change` | [Project scope changes](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-scope-change) | | `Internal cloud API key` / `Datafeed search probe failed` / `User lacks the required permissions` | [Cloud credential problems](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-credentials) | | `Failed to revoke internal cloud API key` | [Cloud credential problems](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-credentials) | | `Cross-project field conflict` / `conflicting types across projects` / `excluded project` from this run | [Field mapping conflicts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-field-mappings) | | `Cannot run datafeed` + `required time field` | [Field mapping conflicts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-field-mappings) | | `Datafeed has recovered data extraction` / `started retrieving data again` | [Linked project unavailable](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/troubleshoot/elasticsearch/machine-learning/cps-datafeed-linked-project-unavailable) | ## `project_routing` syntax For valid `project_routing` values and wildcard rules, refer to [Project routing in CPS](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/explore-analyze/cross-project-search/cross-project-search-project-routing). ## Related pages - [Cross-project search](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/explore-analyze/cross-project-search) - [Using project routing to limit cross-project search scope](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/explore-analyze/cross-project-search/cross-project-search-project-routing) - [Run a job](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8277/explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs) ## When to contact support Contact [Elastic support](/elastic/docs-content/pull/8277/troubleshoot#contact-us) when: - A linked project or region appears unavailable across multiple jobs and you have confirmed project linking in Elastic Cloud. - The same datafeed fails repeatedly after you apply the fixes in these topics. - The origin project reports memory pressure or out-of-memory errors while CPS datafeeds are running, and narrowing `project_routing` does not relieve the symptoms.