Add observability CPS docs #5722
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mdbirnstiehl marked this conversation as resolved.
Show resolved
Hide resolved
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| | {{observability}} app | {{cps-init}} availability | | ||
| | --- | --- | | ||
| | **APM** (Service Inventory, Traces, Dependencies) | Not available | | ||
| | **Infrastructure** (Inventory, Hosts) | Not available | | ||
| | **Observability Overview** (Hosts, Log Events, Service Inventory) | Not available | | ||
| | **Observability AI Assistant** | Not available | | ||
| | **SLOs** | Not available | | ||
| | **Rules** (Custom Threshold, SLO Burn Rate) | Read-only | | ||
| | **Synthetics** (monitors, TLS Certificates) | Not available | | ||
| | **Streams** | Not available | | ||
|
|
||
| % DOCS NOTE — CONDITIONAL: If APM/Infra CPS enablement (observability-dev#5328, observability-dev#5374) ships before tech preview goes GA, update the APM and Infrastructure rows in the availability column to "Yes (scope selector editable)" and confirm cross-project data behavior. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,117 @@ | ||
| --- | ||
| applies_to: | ||
| stack: unavailable | ||
| serverless: preview | ||
| products: | ||
| - id: observability | ||
| navigation_title: "Cross-project search" | ||
| description: Learn how cross-project search (CPS) works in Elastic Observability, including app compatibility, scope selector behavior, and known limitations. | ||
| --- | ||
|
|
||
| # {{cps-cap}} in {{observability}} [obs-cross-project-search] | ||
|
|
||
| [{{cps-cap}} ({{cps-init}})](/explore-analyze/cross-project-search.md) lets you run a single search request across multiple {{serverless-short}} projects. When your observability data is split across projects to organize ownership, use cases, or environments, {{cps}} lets you query all that data from a single origin project without searching each project individually. | ||
|
|
||
| When projects are linked, platform apps like Discover and Dashboards automatically include data from all linked projects. {{observability}} apps have varying levels of {{cps-init}} support. Some apps show cross-project data automatically; others remain scoped to the origin project. {{cps-cap}} is unavailable for Logs Essentials projects. | ||
|
|
||
| For full details on {{cps-init}} concepts, configuration, and search syntax, refer to: | ||
|
|
||
| * [{{cps-cap}} overview](/explore-analyze/cross-project-search.md) | ||
| * [Configure {{cps}}](/deploy-manage/cross-project-search-config.md) | ||
| * [Manage {{cps}} scope in your project apps](/explore-analyze/cross-project-search/cross-project-search-manage-scope.md) | ||
|
|
||
| ## {{observability}} app compatibility [obs-cps-compatibility] | ||
|
|
||
| The following table shows how each {{observability}} app behaves with {{cps-init}} at technical preview. | ||
|
|
||
| ::::{include} /solutions/_snippets/cps-obs-compatibility.md | ||
| :::: | ||
|
|
||
|
|
||
| ## {{cps-cap}} scope selector in {{observability}} apps [obs-cps-scope-selector] | ||
|
|
||
| The **{{cps-init}} scope** selector ({icon}`cross_project_search`) in the project header for platform apps like Discover, Dashboards, and Lens, lets you search **This project** or **All projects**. | ||
|
|
||
| In {{observability}}-specific apps, the scope selector is not available. This means: | ||
|
|
||
| * {{observability}} apps operate in their default scope, which varies by app (refer to [{{observability}} app compatibility](#obs-cps-compatability)). | ||
|
Member
There was a problem hiding this comment. it might be useful to clarify how this relates to the selectable default scope at the space level (does it ignore that setting? does it follow it?) |
||
| * The scope you select in platform apps like Discover does not carry over to {{observability}} apps. | ||
| * Data volumes might change when switching between Discover (which shows cross-project data by default) and an {{observability}} app (which is scoped to a origin project) for the same index pattern. | ||
|
|
||
| For apps where the scope selector is available, refer to [Managing {{cps}} scope in your project apps](/explore-analyze/cross-project-search/cross-project-search-manage-scope.md). | ||
|
|
||
| ## Navigating between Discover and {{observability}} apps [obs-cps-discover-navigation] | ||
|
|
||
| When {{cps-init}} is enabled, Discover shows documents from all linked projects by default, unless the space-level default scope has been changed. {{observability}} apps may not have the same scope, which can lead to differences when navigating between them. | ||
|
|
||
| % DOCS NOTE — CONDITIONAL: Include the following subsection only if APM/Infra CPS work (observability-dev#5328, observability-dev#5374) has NOT shipped. Remove it when that work lands. | ||
|
|
||
| ### Discover to {{product.apm}} and Infrastructure | ||
|
|
||
| **Open in {{product.apm}}** and **Open in Infra** links in the Discover document flyout may not resolve correctly for documents from linked projects. Because {{product.apm}} and Infrastructure are scoped to the origin project, following a link for a remote document may fail to load the expected data. If a remote service shares the same name as a origin service, the origin service may open instead. | ||
|
|
||
| This will be resolved when {{cps-init}} is enabled in APM and Infrastructure. | ||
|
|
||
| ### Discover to Streams | ||
|
|
||
| Streams remains scoped to the origin project only and does not support {{cps-init}}. If you open a stream from Discover and the document is from a linked project, {{observability}} shows a warning that the stream is remote. The Streams UI then shows origin project data only, so counts can differ from Discover. | ||
|
|
||
| ## Identifying remote and origin documents [obs-cps-identify-documents] | ||
mdbirnstiehl marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| To determine whether a document comes from the origin project or a linked project, refer to [Identifying remote and origin documents](/explore-analyze/cross-project-search.md#cps-identify-documents). | ||
|
|
||
| ## Known issues and limitations [obs-cps-known-issues] | ||
|
|
||
| The following known issues and limitations apply to {{cps-init}} in {{observability}} apps. For an overview of {{observability}} app compatibility, refer to [{{observability}} app compatibility](#obs-cps-compatibility). | ||
|
|
||
| ### Rules data scope inconsistency [obs-cps-rules-scope] | ||
|
|
||
| Custom threshold and SLO burn rate rules query only origin project data, even when the underlying data view (for example, `logs-*`) returns cross-project data in Discover. This means: | ||
|
|
||
| * A rule simulation may show a condition is violated, but the rule itself may not trigger an alert because it evaluates only origin data. | ||
|
Check notice on line 71 in solutions/observability/cross-project-search.md
|
||
| * Discover and rules may show different results for the same data view. | ||
|
|
||
| APM-specific rules (APM anomaly, error count threshold, failed transaction rate threshold, latency threshold) and Infrastructure Inventory rules are not fully tested with {{cps-init}}. | ||
|
|
||
| Tracking: [kibana#257714](https://github.com/elastic/kibana/issues/257714) | ||
|
|
||
| ### SLO visibility [obs-cps-slo-remote] | ||
|
|
||
| Only origin SLOs are visible, even when connected to a remote project. | ||
|
|
||
| Tracking: [kibana#252955](https://github.com/elastic/kibana/issues/252955) | ||
|
|
||
| % DOCS NOTE — CONDITIONAL: Include the following "Discover flyout links" subsection only if APM/Infra CPS work (observability-dev#5328, observability-dev#5374) has NOT shipped. Remove it when that work lands. | ||
|
|
||
| ### Discover flyout links for remote documents [obs-cps-discover-flyout] | ||
|
|
||
| The following Discover flyout links do not work correctly for documents from linked projects: | ||
|
|
||
| * Trace document flyout transaction name links ([kibana#256211](https://github.com/elastic/kibana/issues/256211)) | ||
| * Span links from linked projects ([kibana#256190](https://github.com/elastic/kibana/issues/256190)) | ||
| * **Explain this log entry** for linked project logs ([kibana#256168](https://github.com/elastic/kibana/issues/256168)) | ||
| * Log flyout stream links ([kibana#256075](https://github.com/elastic/kibana/issues/256075)) | ||
| * Trace flyout charts don't respect project selector ([kibana#256072](https://github.com/elastic/kibana/issues/256072)) | ||
|
|
||
| These issues will be resolved when {{cps-init}} is enabled in APM and Infrastructure. | ||
|
|
||
| ### No default data views in origin projects [obs-cps-no-data-views] | ||
|
|
||
| In a {{cps-init}} origin project, Discover may show no data even when linked projects contain data due to missing data views in the origin project. | ||
|
|
||
| Tracking: [kibana#260930](https://github.com/elastic/kibana/issues/260930) | ||
|
|
||
| ### {{observability}} overview alerts are origin only [obs-cps-overview-alerts] | ||
|
|
||
| The **Alerts** section on the {{observability}} overview page shows alerts from the origin project only, even when rules are configured to act on cross-project data. | ||
|
|
||
| ### Synthetics is not affected by {{cps-init}} [obs-cps-synthetics] | ||
|
|
||
| Synthetics monitors and TLS certificates are bound to saved objects and remain scoped to the origin project. Monitors from linked projects do not appear in the Synthetics UI of the origin project. | ||
|
|
||
| ## What's next [obs-cps-whats-next] | ||
|
|
||
| Native {{cps-init}} support for additional {{observability}} apps is planned. When {{cps-init}} is enabled in an app, the scope selector will become available in that app, matching the experience in Discover and Dashboards. | ||
|
|
||
| * SLO {{cps-init}} readiness: [kibana#252955](https://github.com/elastic/kibana/issues/252955) | ||
| * Rules {{cps-init}} readiness: [kibana#257714](https://github.com/elastic/kibana/issues/257714) | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.