Inject origin-only project_routing into transport.request CPS call sites

src/platform/plugins/shared/data/server/search/strategies/esql_async_search/esql_async_search_strategy.ts

@@ -119,7 +119,7 @@ export const esqlAsyncSearchStrategyProvider = (
       {
         method: 'POST',
         path: `/_query/async`,
-        body: params,
+        body: { project_routing: '_alias:_origin', ...params },
         querystring: dropNullColumns ? 'drop_null_columns' : '',
       },
       {

src/platform/plugins/shared/data/server/search/strategies/esql_search/esql_search_strategy.ts

@@ -44,6 +44,7 @@ export const esqlSearchStrategyProvider = (
             path: `/_query`,
             querystring: dropNullColumns ? 'drop_null_columns' : '',
             body: {
+              project_routing: '_alias:_origin',
               ...requestParams,
             },
           },

x-pack/platform/plugins/shared/maps/server/mvt/mvt_routes.ts

@@ -230,6 +230,7 @@ async function getTile({
           method: 'POST',
           path,
           body,
+          querystring: { project_routing: '_alias:_origin' },
         },
         {
           signal: abortController.signal,

x-pack/platform/plugins/shared/observability_ai_assistant/server/functions/elasticsearch.ts

@@ -55,7 +55,11 @@ export function registerElasticsearchFunction({
       const response = await esClient.asCurrentUser.transport.request({
         method,
         path,
-        body,
+        // POST _search: inject project_routing for CPS (stripped automatically when CPS is disabled)
+        body:
+          isSearchEndpoint && method === 'POST'
+            ? { project_routing: '_alias:_origin', ...body }
+            : body,
       });
 
       return { content: { response } };

x-pack/solutions/search/plugins/search_playground/server/lib/elasticsearch_retriever.ts

@@ -75,6 +75,7 @@ export class ElasticsearchRetriever extends BaseRetriever {
         method: 'POST',
         path: `/${this.index}/_search`,
         body: {
+          project_routing: '_alias:_origin',
           ...queryBody,
           size: this.k,
         },

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_types/esql/esql_request.ts

@@ -85,7 +85,7 @@ export const performEsqlRequest = async ({
     const asyncEsqlResponse = await esClient.transport.request<AsyncEsqlResponse>({
       method: 'POST',
       path: '/_query/async',
-      body: requestBody,
+      body: { project_routing: '_alias:_origin', ...requestBody },
       querystring: requestQueryParams,
     });
     setLatestRequestDuration(asyncSearchStarted, loggedRequests);