diff --git a/explore-analyze/cross-project-search.md b/explore-analyze/cross-project-search.md index 4bcba7c75d..d5e9ca6e6d 100644 --- a/explore-analyze/cross-project-search.md +++ b/explore-analyze/cross-project-search.md @@ -168,13 +168,41 @@ For additional information, refer to the [{{product.painless}} execute API refer * [Get tags](https://www.elastic.co/docs/api/doc/elasticsearch-serverless/operation/operation-project-tags) -## Limitations +## Identifying remote and origin documents [cps-identify-documents] + +To determine whether a document comes from the origin project or a linked project, examine the `_index` field. + +Remote documents include the linked project's alias as a prefix, separated by a colon: + +``` +my-linked-project-abc123:.ds-logs-generic.otel-default-2026.03.02-000001 +``` + +Origin documents have no prefix: + +``` +.ds-logs-generic.otel-default-2026.03.02-000001 +``` + +In {{esql}}, the `_index` field is not returned by default. To include it, use the `METADATA` keyword: + +```esql +FROM logs-* METADATA _index +| WHERE @timestamp > "2026-03-16T15:15:00Z" +| KEEP @timestamp, _index, message +``` + +## Limitations [cps-limitations] ::::{include} /deploy-manage/_snippets/cps-limitations-core.md :::: For administrator-focused details including compatibility, architecture patterns, and feature impacts, refer to [](/deploy-manage/cross-project-search-config.md). +### Observability app limitations + +{{observability}}-specific apps have limited {{cps-init}} support. The scope selector is not available and they remain scoped to the local project. This does not apply to shared apps such as Discover and dashboards. + ## {{cps-cap}} examples [cps-examples] The following examples demonstrate how search requests behave in different {{cps-init}} scenarios. diff --git a/explore-analyze/cross-project-search/cross-project-search-manage-scope.md b/explore-analyze/cross-project-search/cross-project-search-manage-scope.md index 6515d989dc..4789e2194e 100644 --- a/explore-analyze/cross-project-search/cross-project-search-manage-scope.md +++ b/explore-analyze/cross-project-search/cross-project-search-manage-scope.md @@ -73,6 +73,15 @@ The header's {{cps-init}} scope selector is not available in other apps, includi [^cps-badge]: When a visualization panel uses a query-level override, it displays a **Custom CPS scope** badge on dashboards to indicate that it uses a different scope than the {{cps-init}} scope selector. +### {{cps-cap}} availability in {{observability}} apps [cps-availability-observability] + +{{observability}} apps have limited {{cps-init}} support. The scope selector is not available in {{observability}} apps, and most apps remain scoped to the local project. The following table shows how each {{observability}} app behaves with {{cps-init}}: + +::::{include} /solutions/_snippets/cps-obs-compatibility.md +:::: + +For specific app details, refer to [{{cps-cap}} in {{observability}}](/solutions/observability/cross-project-search.md). + ### {{cps-cap}} availability in {{elastic-sec}} apps [cps-availability-security] {{elastic-sec}} apps have limited {{cps-init}} support. Within Timeline, only the **{{esql}}** tab supports `SET project_routing`; all other Timeline tabs search the local project only. Other Security features. including the **Explore** page, threat-hunting workflows, the alert details flyout, and entity store, also remain scoped to the local project. diff --git a/solutions/_snippets/cps-obs-compatibility.md b/solutions/_snippets/cps-obs-compatibility.md new file mode 100644 index 0000000000..30c42dc16d --- /dev/null +++ b/solutions/_snippets/cps-obs-compatibility.md @@ -0,0 +1,12 @@ +| {{observability}} app | {{cps-init}} availability | +| --- | --- | +| **APM** (Service Inventory, Traces, Dependencies) | Not available | +| **Infrastructure** (Inventory, Hosts) | Not available | +| **Observability Overview** (Hosts, Log Events, Service Inventory) | Not available | +| **Observability AI Assistant** | Not available | +| **SLOs** | Not available | +| **Rules** (Custom Threshold, SLO Burn Rate) | Read-only | +| **Synthetics** (monitors, TLS Certificates) | Not available | +| **Streams** | Not available | + +% DOCS NOTE — CONDITIONAL: If APM/Infra CPS enablement (observability-dev#5328, observability-dev#5374) ships before tech preview goes GA, update the APM and Infrastructure rows in the availability column to "Yes (scope selector editable)" and confirm cross-project data behavior. diff --git a/solutions/observability/cross-project-search.md b/solutions/observability/cross-project-search.md new file mode 100644 index 0000000000..493ff7ef67 --- /dev/null +++ b/solutions/observability/cross-project-search.md @@ -0,0 +1,117 @@ +--- +applies_to: + stack: unavailable + serverless: preview +products: + - id: observability +navigation_title: "Cross-project search" +description: Learn how cross-project search (CPS) works in Elastic Observability, including app compatibility, scope selector behavior, and known limitations. +--- + +# {{cps-cap}} in {{observability}} [obs-cross-project-search] + +[{{cps-cap}} ({{cps-init}})](/explore-analyze/cross-project-search.md) lets you run a single search request across multiple {{serverless-short}} projects. When your observability data is split across projects to organize ownership, use cases, or environments, {{cps}} lets you query all that data from a single origin project without searching each project individually. + +When projects are linked, platform apps like Discover and Dashboards automatically include data from all linked projects. {{observability}} apps have varying levels of {{cps-init}} support. Some apps show cross-project data automatically; others remain scoped to the origin project. {{cps-cap}} is unavailable for Logs Essentials projects. + +For full details on {{cps-init}} concepts, configuration, and search syntax, refer to: + +* [{{cps-cap}} overview](/explore-analyze/cross-project-search.md) +* [Configure {{cps}}](/deploy-manage/cross-project-search-config.md) +* [Manage {{cps}} scope in your project apps](/explore-analyze/cross-project-search/cross-project-search-manage-scope.md) + +## {{observability}} app compatibility [obs-cps-compatibility] + +The following table shows how each {{observability}} app behaves with {{cps-init}} at technical preview. + +::::{include} /solutions/_snippets/cps-obs-compatibility.md +:::: + + +## {{cps-cap}} scope selector in {{observability}} apps [obs-cps-scope-selector] + +The **{{cps-init}} scope** selector ({icon}`cross_project_search`) in the project header for platform apps like Discover, Dashboards, and Lens, lets you search **This project** or **All projects**. + +In {{observability}}-specific apps, the scope selector is not available. This means: + +* {{observability}} apps operate in their default scope, which varies by app (refer to [{{observability}} app compatibility](#obs-cps-compatability)). +* The scope you select in platform apps like Discover does not carry over to {{observability}} apps. +* Data volumes might change when switching between Discover (which shows cross-project data by default) and an {{observability}} app (which is scoped to a origin project) for the same index pattern. + +For apps where the scope selector is available, refer to [Managing {{cps}} scope in your project apps](/explore-analyze/cross-project-search/cross-project-search-manage-scope.md). + +## Navigating between Discover and {{observability}} apps [obs-cps-discover-navigation] + +When {{cps-init}} is enabled, Discover shows documents from all linked projects by default, unless the space-level default scope has been changed. {{observability}} apps may not have the same scope, which can lead to differences when navigating between them. + +% DOCS NOTE — CONDITIONAL: Include the following subsection only if APM/Infra CPS work (observability-dev#5328, observability-dev#5374) has NOT shipped. Remove it when that work lands. + +### Discover to {{product.apm}} and Infrastructure + +**Open in {{product.apm}}** and **Open in Infra** links in the Discover document flyout may not resolve correctly for documents from linked projects. Because {{product.apm}} and Infrastructure are scoped to the origin project, following a link for a remote document may fail to load the expected data. If a remote service shares the same name as a origin service, the origin service may open instead. + +This will be resolved when {{cps-init}} is enabled in APM and Infrastructure. + +### Discover to Streams + +Streams remains scoped to the origin project only and does not support {{cps-init}}. If you open a stream from Discover and the document is from a linked project, {{observability}} shows a warning that the stream is remote. The Streams UI then shows origin project data only, so counts can differ from Discover. + +## Identifying remote and origin documents [obs-cps-identify-documents] + +To determine whether a document comes from the origin project or a linked project, refer to [Identifying remote and origin documents](/explore-analyze/cross-project-search.md#cps-identify-documents). + +## Known issues and limitations [obs-cps-known-issues] + +The following known issues and limitations apply to {{cps-init}} in {{observability}} apps. For an overview of {{observability}} app compatibility, refer to [{{observability}} app compatibility](#obs-cps-compatibility). + +### Rules data scope inconsistency [obs-cps-rules-scope] + +Custom threshold and SLO burn rate rules query only origin project data, even when the underlying data view (for example, `logs-*`) returns cross-project data in Discover. This means: + +* A rule simulation may show a condition is violated, but the rule itself may not trigger an alert because it evaluates only origin data. +* Discover and rules may show different results for the same data view. + +APM-specific rules (APM anomaly, error count threshold, failed transaction rate threshold, latency threshold) and Infrastructure Inventory rules are not fully tested with {{cps-init}}. + +Tracking: [kibana#257714](https://github.com/elastic/kibana/issues/257714) + +### SLO visibility [obs-cps-slo-remote] + +Only origin SLOs are visible, even when connected to a remote project. + +Tracking: [kibana#252955](https://github.com/elastic/kibana/issues/252955) + +% DOCS NOTE — CONDITIONAL: Include the following "Discover flyout links" subsection only if APM/Infra CPS work (observability-dev#5328, observability-dev#5374) has NOT shipped. Remove it when that work lands. + +### Discover flyout links for remote documents [obs-cps-discover-flyout] + +The following Discover flyout links do not work correctly for documents from linked projects: + +* Trace document flyout transaction name links ([kibana#256211](https://github.com/elastic/kibana/issues/256211)) +* Span links from linked projects ([kibana#256190](https://github.com/elastic/kibana/issues/256190)) +* **Explain this log entry** for linked project logs ([kibana#256168](https://github.com/elastic/kibana/issues/256168)) +* Log flyout stream links ([kibana#256075](https://github.com/elastic/kibana/issues/256075)) +* Trace flyout charts don't respect project selector ([kibana#256072](https://github.com/elastic/kibana/issues/256072)) + +These issues will be resolved when {{cps-init}} is enabled in APM and Infrastructure. + +### No default data views in origin projects [obs-cps-no-data-views] + +In a {{cps-init}} origin project, Discover may show no data even when linked projects contain data due to missing data views in the origin project. + +Tracking: [kibana#260930](https://github.com/elastic/kibana/issues/260930) + +### {{observability}} overview alerts are origin only [obs-cps-overview-alerts] + +The **Alerts** section on the {{observability}} overview page shows alerts from the origin project only, even when rules are configured to act on cross-project data. + +### Synthetics is not affected by {{cps-init}} [obs-cps-synthetics] + +Synthetics monitors and TLS certificates are bound to saved objects and remain scoped to the origin project. Monitors from linked projects do not appear in the Synthetics UI of the origin project. + +## What's next [obs-cps-whats-next] + +Native {{cps-init}} support for additional {{observability}} apps is planned. When {{cps-init}} is enabled in an app, the scope selector will become available in that app, matching the experience in Discover and Dashboards. + +* SLO {{cps-init}} readiness: [kibana#252955](https://github.com/elastic/kibana/issues/252955) +* Rules {{cps-init}} readiness: [kibana#257714](https://github.com/elastic/kibana/issues/257714) diff --git a/solutions/toc.yml b/solutions/toc.yml index 660db1d0a9..debf40cd80 100644 --- a/solutions/toc.yml +++ b/solutions/toc.yml @@ -528,6 +528,7 @@ toc: - file: observability/ai/observability-ai-assistant.md - file: observability/ai/agent-builder-observability.md - file: observability/ai/llm-performance-matrix.md + - file: observability/cross-project-search.md - file: observability/observability-serverless-feature-tiers.md - file: observability/apis.md - file: security.md