CPS tech preview by shainaraskas · Pull Request #5498 · elastic/docs-content

shainaraskas · 2026-03-13T19:12:23Z

This PR contains most of the content changes for the tech preview scope of CPS

Page	Scope	Notes
Configure cross-project search	the CPS model, project compatibility, recommended CPS architectures, links	Review in #5245
Link and manage projects for cross-project search	procedures to link and unlink projects	Review in #5245
Manage access and scope for cross-project search	Access/permissions to data in the CPS model - reliance on cloud-level roles and permissions Mechanism that impact CPS scope: user permissions, space settings, project routing, qualified search expressions setting cps scope on spaces CPS scope logic in kibana	Review in #5245
Cross-project search impacts and limitations	The ways feature behaviors change when projects are linked to an origin project Limitations (both designed limitations and tech preview limitations)	Review in #5245

Usage

Core usage

Page	Scope	Notes
Cross-project search	Explanation of default behavior, origin/linked projects, security/access evaluation, supported APIs, limitations, examples	Edits only - see live docs

Kibana usage + feature impacts

Page	Scope	Notes
Managing cross-project search scope in your project apps	How your query scope is determined in kibana, mechanisms for adjusting CPS scope, CPS availability by app
Create a dashboard	New Store CPS scope with dashboard option
Exploring dashboards	Viewing clusters/shards queried to fetch data includes CPS info How CPS scope is determined for dashboards and how to identify/adjust scope
Data views	The default CPS scope used for data views, and how to restrict/override the active scope
Use ES\|QL in the Kibana UI	How to override the CPS scope in an ES\|QL query (in the context of the in-Kibana editor)
ES\|QL visualizations	Impact of CPS scope on this visualization type, overriding at the query level
Maps	Impact of CPS scope on map layers, query overrides for ES\|QL layers

Rule and alert docs

Page	Scope	Notes
Set up [alerting]	applies_to tags for CCS-related content (does not apply to serverless)
Create and manage alerting rules with Kibana	Impact of CPS scope on rules (space-level scope only, overrides for ES\|QL rule only)
Observability: Create and manage rules for Elastic Observability	same content as Create and manage alerting rules with Kibana
Security: Cross-project search and detection rules	same content as Create and manage alerting rules with Kibana
Security: Advanced data source configuration	Introduces CPS as an advanced data source configuration for detection rules

Not included in this PR

Original drafts for the Cross-project search page and child pages, which were checked in as hidden. Some refinements to those pages are made in this PR
ES|QL tutorial content, which is authored in the elasticsearch repo:
- One page is published hidden: Query across Serverless projects with ES|QL
- Edits are ongoing: [DOCS][ESQL] Update additional docs for CPS elasticsearch#144300
Some ongoing edits and additions, which are stored in branches, and will be merged in as they're finalized:
- CPS-related edits to existing pages #5560

Pending

Anything to do with subscriptions / tiers / add-ons
Metering
Observability- and Security- specific pages with specific app limitations (see obs draft, issue)

…preview

github-actions · 2026-03-13T19:13:21Z

Vale Linting Results

Summary: 2 warnings found

⚠️ Warnings (2)

File	Line	Rule	Message
explore-analyze/query-filter/languages/esql-kibana.md	273	Elastic.Spelling	'autocompletes' is a possible misspelling.
explore-analyze/visualize/maps.md	74	Elastic.DontUse	Don't use 'just'.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

github-actions · 2026-03-13T19:16:28Z

🔍 Preview links for changed docs

More links …

## Summary Adds a "Use data sources with CPS" section to the data views page (`data-views.md`), explaining how data views interact with cross-project search: - When CPS is active, the data view creation form previews matching indices from linked projects based on the current CPS scope. - The data view itself does not store the CPS scope — at query time, the active scope determines which linked projects are searched. - Users can restrict scope using qualified expressions in the index pattern (e.g. `project_alpha:logs-*`, `_origin:logs-*`), or project routing in queries. Positioned after the existing CCS section as the serverless equivalent. Closes elastic/docs-content-internal#687 ## Test plan - [x] Verify the page builds correctly at `explore-analyze/find-and-organize/data-views` - [x] Confirm `applies_to` tags render properly (serverless preview / stack unavailable) - [ ] Check cross-links to CPS pages resolve correctly ## Generative AI disclosure 1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No 2. If you answered "Yes" to the previous question, please specify the tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.). Tool(s) and model(s) used: Claude (Cursor)

## Summary Adds a dedicated "Managing CPS scope in your project apps" overview page (`cross-project-search-manage-scope.md`) under `explore-analyze/cross-project-search/`: - **Scope hierarchy**: introduces the three levels of CPS scope control (space default, session scope, query-level override) upfront. - **Scope selector**: describes the CPS scope selector in the header, its options (This project, All projects), and session persistence behavior. - **Query-level overrides**: documents how to override the scope using `SET project_routing` or qualified index expressions in ES|QL `FROM` commands, with a concrete ES|QL example. - **Availability matrix**: table showing which apps support the CPS scope selector and query-level overrides, covering 10 apps (Discover, Dashboards, Lens, Maps, Vega, Rules, Dev Tools, ML Data Visualizer, Streams, Agent Builder). - **Related pages**: links to CPS overview, project routing, search behavior, admin configuration, ES|QL in Kibana, and the ES|QL CPS reference (cross-link to elasticsearch repo). Closes elastic/docs-content-internal#850 Closes elastic/docs-content-internal#852 Closes elastic/docs-content-internal#853 ## Known issues (preview) - **ES|QL editor underlines qualified index names as "unknown index"**: When using qualified expressions like `project_alias:kibana_sample_data_ecommerce` in an ES|QL `FROM` command, the editor flags the index as unknown (red underline), but the query executes successfully and returns correct results. This appears to be a client-side validation gap in the ES|QL editor that doesn't yet account for CPS qualified expressions. Likely to be fixed before GA. - **`_origin:` qualified expression not working**: Using `FROM _origin:index_name` to target only the origin project does not work in the current preview, despite being documented in the ES|QL CPS reference. This may be a not-yet-implemented feature. ## Test plan - [x] Verify the page builds correctly - [x] Verify scope selector behavior (session persistence, space default as fallback) against Kibana source - [x] Verify Rules row (read-only scope) against Kibana source - [x] Verify qualified expressions work in ES|QL FROM (tested with real linked project) - [x] Verify SET project_routing works in ES|QL (tested with real linked project) - [x] Cross-links validated (all resolve to existing pages/anchors on feature branches) - [x] Content type check: passes overview guidelines (type field, required elements, best practices) ## Generative AI disclosure 1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No 2. If you answered "Yes" to the previous question, please specify the tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.). Tool(s) and model(s) used: Claude (Cursor) --------- Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

## Summary Updates the shared Inspector snippet (`_snippets/inspect-request.md`) to mention CPS alongside CCS in the "Clusters and shards" tab description. When either feature is active, this tab shows the remote clusters or linked projects that were searched. Also fixes an inaccuracy: the tab *is* available for ES|QL queries (confirmed via manual testing with CPS), so the limitation note now only mentions Vega visualizations. Since this is a shared snippet, the change automatically applies to both the Discover and Dashboards documentation pages. Closes elastic/docs-content-internal#686 ## Test plan - [x] Verify the snippet renders correctly in both `explore-analyze/dashboards/using` and `explore-analyze/discover/discover-get-started` - [x] Confirm "Clusters and shards" tab works with ES|QL queries when CPS is active - [x] Check cross-links to CCS and CPS pages resolve correctly ## Generative AI disclosure 1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No 2. If you answered "Yes" to the previous question, please specify the tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.). Tool(s) and model(s) used: Claude (Cursor) Made with [Cursor](https://cursor.com)

…zations (#5424) ## Summary Adds CPS project routing documentation to the ES|QL pages: **ES|QL in Kibana** (`esql-kibana.md`): - New "Search across linked projects with SET project_routing" section - Documents the `SET project_routing` syntax, autocomplete values (`_alias:_origin`, `_alias:*`), tag-based expressions, and named project routing expressions - Notes the Custom CPS scope badge behavior on dashboard panels **ES|QL visualizations** (`esorql.md`): - New "Query data from multiple projects" subsection under "Create from dashboard" - Explains that `SET project_routing` in an ES|QL visualization triggers a Custom CPS scope badge on the dashboard panel Closes elastic/docs-content-internal#685 ## Test plan - [ ] Verify pages build correctly at `explore-analyze/query-filter/languages/esql-kibana` and `explore-analyze/visualize/esorql` - [ ] Confirm `applies_to` tags render properly (serverless preview / stack unavailable) - [ ] Check cross-links to CPS pages resolve correctly (depend on sibling CPS branches) - [ ] Test `SET project_routing` autocomplete in ES|QL editor with CPS enabled ## Generative AI disclosure 1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No 2. If you answered "Yes" to the previous question, please specify the tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.). Tool(s) and model(s) used: Claude (Cursor) Made with [Cursor](https://cursor.com)

## Summary Adds CPS documentation to the dashboard pages, split by audience: **For dashboard viewers** (`using.md`): - New "View data from multiple projects" subsection under "Search and filter your dashboard data" - Explains how the CPS scope selector controls which projects the dashboard queries - Documents the "Custom CPS scope" badge on panels that use project routing **For dashboard creators** (`create-dashboard.md`): - Adds **Store CPS scope with dashboard** to the settings list (step 5) and save options (step 6) - Restructures the save step with a comprehensive list of all save options - Updated screenshot of the save dialog Closes elastic/docs-content-internal#690 Closes elastic/docs-content-internal#691 ## Test plan - [x] Verify pages build correctly at `explore-analyze/dashboards/using` and `explore-analyze/dashboards/create-dashboard` - [x] Confirm `applies_to` tags render properly (serverless preview / stack unavailable) - [x] Check cross-links to CPS pages resolve correctly (depend on sibling CPS branches) - [x] Verify "Store CPS scope with dashboard" label matches Kibana UI (confirmed, fix in elastic/kibana#259142) ## Generative AI disclosure 1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No 2. If you answered "Yes" to the previous question, please specify the tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.). Tool(s) and model(s) used: Claude (Cursor) Made with [Cursor](https://cursor.com) --------- Co-authored-by: Nastasha Solomon <nastasha.solomon@elastic.co> Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

Add missing .md extension to elasticsearch:// cross-links pointing to the SET command reference page. Made-with: Cursor

Replace references to the old cross-project-search-link-projects.md path with the new deploy-manage/ location. Made-with: Cursor

## Summary Adds a new "Search across linked projects" section to the Maps page (`maps.md`), explaining that: - Maps supports CPS with an editable project picker scope - Vector layers and joins pull data from linked projects based on the current CPS scope - Map panels in dashboards display a "Custom CPS scope" badge when layers use specific project routing Closes elastic/docs-content-internal#851 ## Test plan - [ ] Verify the page builds correctly at `explore-analyze/visualize/maps` - [ ] Confirm `applies_to` tags render properly (serverless preview / stack unavailable) - [ ] Check cross-links to CPS and dashboard pages resolve correctly ## Generative AI disclosure 1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No 2. If you answered "Yes" to the previous question, please specify the tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.). Tool(s) and model(s) used: Claude (Cursor) Made with [Cursor](https://cursor.com)

## Summary Adds a new "Cross-project search scope for rules" section to the alerting rules page (`create-manage-rules.md`), explaining that: - Alerting rules query data across linked projects based on the **space-level CPS scope**, not a per-rule setting - The project picker on rule pages is read-only -- to change which projects a rule queries, update the space's CPS configuration This reflects the actual implementation, which differs from the original issue description (no per-rule CPS scope selector). Closes elastic/docs-content-internal#688 ## Test plan - [ ] Verify the page builds correctly at `explore-analyze/alerting/alerts/create-manage-rules` - [ ] Confirm `applies_to` tags render properly (serverless preview / stack unavailable) - [ ] Check cross-links to CPS pages resolve correctly ## Generative AI disclosure 1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [x] Yes - [ ] No 2. If you answered "Yes" to the previous question, please specify the tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.). Tool(s) and model(s) used: Claude (Cursor) Made with [Cursor](https://cursor.com) --------- Co-authored-by: Nastasha Solomon <nastasha.solomon@elastic.co> Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

Remove #cps-project-routing fragment from links (page title heading is not a linkable anchor) and update redirected references to cps-config-link-and-manage.md. Made-with: Cursor

Sort availability table alphabetically and link session scope bullet to the scope selector section. Made-with: Cursor

Made-with: Cursor

shainaraskas

oops almost lost all of my comments so panic submitting

shainaraskas · 2026-03-24T19:45:50Z

deploy-manage/cross-project-search-config.md

+
+With {{cps}} ({{cps-init}}), users in your organization can search across multiple {{serverless-full}} projects at once, instead of searching each project individually. When your data is split across projects to organize ownership, use cases, or environments, {{cps}} lets you query all the data from a single place. 
+
+{{cps-cap}} is the {{serverless-short}} equivalent of [{{ccs}}](/explore-analyze/cross-cluster-search.md), without requiring an understanding of deployment architecture. Permissions stay consistent across projects, and you can always adjust scope and access as needed.


wonder if we should do more here? the "without requiring" kind of tripped me up

maybe we don't care so much about comparing the feature, but a little clarity on whether the understanding of the architecture is setup side, query side, or both would be nice

Suggested change

{{cps-cap}} is the {{serverless-short}} equivalent of [{{ccs}}](/explore-analyze/cross-cluster-search.md), without requiring an understanding of deployment architecture. Permissions stay consistent across projects, and you can always adjust scope and access as needed.

{{cps-cap}} is the {{serverless-short}} equivalent of [{{ccs}}](/explore-analyze/cross-cluster-search.md). Unlike CPS, an understanding of your deployment architecture isn't required to [build cross-project queries?]. Permissions stay consistent across projects, and you can always adjust scope and access as needed.

Suggested change

{{cps-cap}} is the {{serverless-short}} equivalent of [{{ccs}}](/explore-analyze/cross-cluster-search.md), without requiring an understanding of deployment architecture. Permissions stay consistent across projects, and you can always adjust scope and access as needed.

{{cps-cap}} is the {{serverless-short}} equivalent of [{{ccs}}](/explore-analyze/cross-cluster-search.md), with the following additional enhancements:

* [Querying across projects?] [Setting up cross-project search?] doesn't require an understanding of your deployment architecture or complex security configurations.

* Permissions stay consistent across projects, and you can always adjust scope and access as needed. [split this one further?]

* Search is performed across projects by default, reducing the need to refactor your queries as you link additional projects.

deploy-manage/cross-project-search-config.md

shainaraskas · 2026-03-24T19:57:05Z

deploy-manage/cross-project-search-config.md

+* [Link and manage projects](/deploy-manage/cross-project-search-config/cps-config-link-and-manage.md): Link projects in the {{ecloud}} UI, manage linked projects, and unlink projects.
+* [Access and scope](/deploy-manage/cross-project-search-config/cps-config-access-and-scope.md): Manage user access across linked projects and configure the default {{cps}} scope per space.
+* [Impacts and limitations](/deploy-manage/cross-project-search-config/cps-config-impacts-and-limitations.md): Understand how {{cps}} affects alerting, dashboards, and other features, and review current limitations.


wonder if these exit points will prevent people from reading down further. should we maybe sit this in a "configure cps" section on this page that is below the plan section? they can always use our sidebar links to exit early

shainaraskas · 2026-03-24T19:59:20Z

deploy-manage/cross-project-search-config.md

+::::{include} /deploy-manage/_snippets/cps-origin-linked-definitions.md
+::::
+
+::::{include} /explore-analyze/cross-project-search/_snippets/cps-default-search-behavior.md


is the explanation of projects as namespaces maybe nice to have here too?

Projects are intended to act as logical namespaces for data, not hard boundaries for querying it. You can split data into projects to organize ownership, use cases, or environments, while still expecting to search and analyze that data from a single place.

https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5498/explore-analyze/cross-project-search#cps-cap-as-the-default-behavior-for-linked-projects

or it could go in the "plan your architecture" section

deploy-manage/cross-project-search-config.md

deploy-manage/cross-project-search-config/cps-config-access-and-scope.md

shainaraskas · 2026-03-24T20:49:28Z

deploy-manage/cross-project-search-config/cps-config-access-and-scope.md

+  - Using [qualified search expressions](/explore-analyze/cross-project-search/cross-project-search-search.md#search-expressions)
+  - Using [project routing](/explore-analyze/cross-project-search/cross-project-search-project-routing.md)
+
+The scope controls which projects receive the search request, while _filtering_ controls which results are returned by the search.


where do i learn about filtering? can this be a link instead

shainaraskas · 2026-03-24T20:53:00Z

deploy-manage/cross-project-search-config/cps-config-access-and-scope.md

+
+### Set the default {{cps-init}} scope for a space [cps-default-search-scope]
+
+You can adjust the broad {{cps-init}} default by setting a narrower {{cps}} scope for each space. This setting determines the _default_ search scope for all users in that space. Users can override the default by setting their preferred scope when searching, filtering, or running queries. 


"for all users in that space" might not be accurate necessarily - iirc it's about the defaults when you create something within the context of the space

need to link to this in the context of overrides - various saved objects technically have searches/ftilers/queries under the hood, but you can also select a scope in the project header

https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5498/explore-analyze/cross-project-search/cross-project-search-manage-scope

shainaraskas · 2026-03-24T20:54:13Z

deploy-manage/cross-project-search-config/cps-config-access-and-scope.md

+### How {{cps-init}} scope works in {{kib}}
+
+When processing a search request, {{kib}} applies the most specific scope setting available:
+
+1. **Saved object scope (most specific):** Explicit project routing saved on a specific rule, dashboard panel, or other saved object (for example, `project_routing: _origin`).
+2. **Space-level default:** The default {{cps}} scope that an administrator configures for a space.
+3. **{{cps-init}} default (least specific):** The default broad setting, which searches the origin project and all linked projects.
+
+New dashboards, rules, and saved searches automatically adopt the space's default scope. Existing saved objects that don't have an explicit project routing also follow the space-level default.


needs to be reconciled with https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5498/explore-analyze/cross-project-search/cross-project-search-manage-scope

I think that page needs this context

shainaraskas · 2026-03-24T20:57:51Z

deploy-manage/cross-project-search-config/cps-config-access-and-scope.md

+
+When processing a search request, {{kib}} applies the most specific scope setting available:
+
+1. **Saved object scope (most specific):** Explicit project routing saved on a specific rule, dashboard panel, or other saved object (for example, `project_routing: _origin`).


is this where the header selection comes in?

shainaraskas · 2026-03-24T20:59:01Z

deploy-manage/cross-project-search-config/cps-config-access-and-scope.md

+2. **Space-level default:** The default {{cps}} scope that an administrator configures for a space.
+3. **{{cps-init}} default (least specific):** The default broad setting, which searches the origin project and all linked projects.
+
+New dashboards, rules, and saved searches automatically adopt the space's default scope. Existing saved objects that don't have an explicit project routing also follow the space-level default.


they also might adopt the override selection from the cps scope selector when saved? not sure

shainaraskas

done deploy-manage - more tc

cc: @marciw

shainaraskas · 2026-03-24T21:01:43Z

deploy-manage/_snippets/cps-limitations-core.md

+- **Chaining/transitivity not supported:** If Project A links to Project B, and Project B links to Project C, Project A cannot automatically search Project C. Each link is independent.
+- **Links are unidirectional:** Searches that run from a linked project do **not** run against the origin project. If you need bidirectional search, link the projects twice, in both directions.
+- **System indices are excluded:** System indices (such as `.security` and `.fleet-*`) are excluded from {{cps}}.
+- **Unavailable APIs:** `_transform` and `_fleet_search` requests do not support {{cps-init}}.


I realize that this list is used in two places, but it would be nice to link to the complete list of supported apis here

https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5498/explore-analyze/cross-project-search#cps-supported-apis

shainaraskas · 2026-03-24T21:02:41Z

deploy-manage/cross-project-search-config/cps-config-impacts-and-limitations.md

+For more details about {{cps-init}} configuration, refer to [](/deploy-manage/cross-project-search-config.md). For information about _using_ {{cps-init}}, refer to [](/explore-analyze/cross-project-search.md).
+
+## Feature impacts [cps-feature-impacts]
+


best practice is a little intro section before a bulleted list

shainaraskas · 2026-03-24T21:03:15Z

deploy-manage/cross-project-search-config/cps-config-impacts-and-limitations.md

+navigation_title: "Impacts and limitations"
+---
+
+# {{cps-cap}} impacts and limitations [cps-impacts-and-limitations]


hmm maybe a little small for its own page. just a thought - up to you

shainaraskas · 2026-03-24T21:43:25Z

explore-analyze/cross-project-search.md

 When you search from an origin project, the query runs against its linked projects automatically unless you explicitly change the query scope by using [project routing expressions](/explore-analyze/cross-project-search/cross-project-search-project-routing.md) or [qualified index expressions](/explore-analyze/cross-project-search/cross-project-search-search.md#search-expressions).

-Project linking is not bidirectional. Searches initiated from a linked project do not run against the origin project.
+::::{include} /deploy-manage/_snippets/cps-bidirectional-note.md


is this used anywhere else? is a snippet needed?

shainaraskas

second round of comments, this time for @florent-leborgne and @nastasha-solomon

shainaraskas · 2026-03-25T17:16:14Z

explore-analyze/cross-project-search.md

+* [Search in {{cps-init}}](/explore-analyze/cross-project-search/cross-project-search-search.md): Learn how search expressions, search options, and index resolution work.
+* [Tags in {{cps-init}}](/explore-analyze/cross-project-search/cross-project-search-tags.md): Learn about predefined and custom project tags and how to use them in queries.
+* [Project routing in {{cps-init}}](/explore-analyze/cross-project-search/cross-project-search-project-routing.md): Learn how to route searches to specific projects based on tag values.
+* [Manage {{cps}} scope in your project apps](/explore-analyze/cross-project-search/cross-project-search-manage-scope.md): Control which projects are searched as you work in Discover, Dashboards, and other {{kib}} apps.


should use the acronym for parallelism

Suggested change

* [Manage {{cps}} scope in your project apps](/explore-analyze/cross-project-search/cross-project-search-manage-scope.md): Control which projects are searched as you work in Discover, Dashboards, and other {{kib}} apps.

* [Manage {{cps-init}} scope in your project apps](/explore-analyze/cross-project-search/cross-project-search-manage-scope.md): Control which projects are searched as you work in Discover, Dashboards, and other {{kib}} apps.

explore-analyze/cross-project-search.md

explore-analyze/cross-project-search/cross-project-search-manage-scope.md

explore-analyze/dashboards/create-dashboard.md

shainaraskas · 2026-03-25T17:47:44Z

explore-analyze/alerting/alerts/create-manage-rules.md

+For {{esql}} rules, you can use [`SET project_routing`](/explore-analyze/cross-project-search/cross-project-search-project-routing.md) in the rule query to target specific linked projects, overriding the space-level scope. For non-{{esql}} rules that use index patterns, you can use [qualified index expressions](/explore-analyze/cross-project-search/cross-project-search-search.md#search-expressions) to scope the rule to specific projects.
+
+:::{note}
+{{ml}} rules don't support {{cps}}. {{ml}} rules search data in the origin project only.


Suggested change

{{ml}} rules don't support {{cps}}. {{ml}} rules search data in the origin project only.

{{ml-cap}} rules don't support {{cps}}. {{ml-cap}} rules search data in the origin project only.

shainaraskas · 2026-03-25T17:49:23Z

explore-analyze/alerting/alerts/alerting-setup.md

 ## {{ccs-cap}} [alerting-ccs-setup]

+```{applies_to}
+serverless: unavailable
+stack: ga
+```
+
 If you want to use alerting rules with {{ccs}}, you must configure privileges for {{ccs-init}} and {{kib}}. Refer to [Remote clusters](../../../deploy-manage/remote-clusters.md).


might make sense to hint about CPS here. could even do it under one heading

shainaraskas · 2026-03-25T17:51:51Z

solutions/observability/incident-management/create-manage-rules.md

+## {{cps-cap}} scope for rules [observability-cps-scope-for-rules]
+```{applies_to}
+serverless: preview
+stack: unavailable
+```
+
+When [{{cps}}](/explore-analyze/cross-project-search.md) is enabled and you have [linked projects](/deploy-manage/cross-project-search-config/cps-config-link-and-manage.md), alerting rules query data across linked projects based on the **space-level {{cps}} scope**. You cannot set a {{cps}} scope on individual rules.
+
+When you open a rule to create or edit it, the [{{cps-init}} scope selector](/deploy-manage/cross-project-search-config/cps-config-access-and-scope.md#cps-search-scope) in the header shows the current {{cps}} scope but is read-only. To change which projects rules query, update the [{{cps}} scope configured for the space](/deploy-manage/cross-project-search-config/cps-config-access-and-scope.md#cps-default-search-scope).
+
+For {{esql}} rules, you can use [`SET project_routing`](/explore-analyze/cross-project-search/cross-project-search-project-routing.md) in the rule query to target specific linked projects, overriding the space-level scope. For non-{{esql}} rules that use index patterns, you can use [qualified index expressions](/explore-analyze/cross-project-search/cross-project-search-search.md#search-expressions) to scope the rule to specific projects.
+
+:::{note}
+{{ml-cap}} rules don't support {{cps}}. {{ml-cap}} rules search data in the origin project only.
+:::


can this be a snippet?

The note or the section?

the section

shainaraskas · 2026-03-25T17:54:56Z

solutions/security/detect-and-alert/cross-project-search-detection-rules.md

+
+# {{cps-cap}} and detection rules [rules-cross-project-search]
+
+When [{{cps}}](/explore-analyze/cross-project-search.md) is enabled and you have [linked projects](/deploy-manage/cross-project-search-config/cps-config-link-and-manage.md), detection rules query data across linked projects based on the **space-level {{cps}} scope**. You cannot set a {{cps}} scope on individual rules.


same note about snippet

we can use a page-level sub key to specify alerts or detection rules

shainaraskas · 2026-03-25T19:24:44Z

explore-analyze/cross-project-search.md

@szabosteve how do you feel about covering this on this page? suggested by chris from obs

Identifying remote and local documents

You can determine whether a document comes from the local project or a linked project by examining the _index field.

Remote documents include the linked project's alias as a prefix, separated by a colon:

my-linked-project-abc123:.ds-logs-generic.otel-default-2026.03.02-000001

Local documents have no prefix:

.ds-logs-generic.otel-default-2026.03.02-000001

In ESQL, the _index field is not returned by default. To include it, use the METADATA keyword:

FROM logs-* METADATA _index | WHERE @timestamp > "2026-03-16T15:15:00Z" | KEEP @timestamp, _index, message

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com> Co-authored-by: florent-leborgne <florent.leborgne@elastic.co>

florent-leborgne · 2026-03-25T19:42:39Z

deploy-manage/cross-project-search-config/cps-config-access-and-scope.md

+The default {{cps}} scope is a space setting, not an access control. You can also [manage user access](#manage-user-access).
+::::
+
+### How {{cps-init}} scope works in {{kib}}


I find this section's content a bit misleading:

If you don't have a space default, you have a space default, that is "All projects".
Then each user in their session can use the header's selector when it's available.
Then for specific queries you can specify a specific scope to use. This is roughly what is described at the top of https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5498/explore-analyze/cross-project-search/cross-project-search-manage-scope, though we can maybe make it clearer.

shainaraskas · 2026-03-25T19:54:00Z

explore-analyze/toc.yml

    children:
-      - hidden: cross-project-search/cross-project-search-link-projects.md
-      - hidden: cross-project-search/cross-project-search-search.md
-      - hidden: cross-project-search/cross-project-search-tags.md


@szabosteve @leemthompo should an xref to https://www.elastic.co/docs/reference/query-languages/esql/esql-cross-serverless-projects go here?

alt: needs a link from https://www.elastic.co/docs/explore-analyze/cross-project-search

shainaraskas · 2026-03-25T19:57:01Z

deploy-manage/_snippets/cps-limitations-core.md

we will need to link to these from here
https://www.elastic.co/docs/reference/query-languages/esql/esql-cross-serverless-projects#limitations

explore-analyze/cross-project-search/cross-project-search-manage-scope.md

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

deploy-manage/cross-project-search-config/cps-config-access-and-scope.md

marciw and others added 3 commits March 12, 2026 17:04

CPS configuration docs

c0ccf4e

Merge branch 'main' of github.com:elastic/docs-content into cps-tech-…

d3f0044

…preview

Merge branch 'main' into cps-tech-preview

8997244

shainaraskas changed the title ~~Cps tech preview~~ CPS tech preview Mar 13, 2026

github-actions bot deployed to docs-preview March 13, 2026 19:13 View deployment

Merge branch 'main' into cps-tech-preview

45ad524

github-actions bot deployed to docs-preview March 13, 2026 19:23 View deployment

Merge branch 'main' into cps-tech-preview

a08794f

github-actions bot deployed to docs-preview March 18, 2026 21:39 View deployment

CPS config: update + reconcile with E&A CPS

2ea5469

github-actions bot deployed to docs-preview March 18, 2026 22:11 View deployment

github-actions bot had a problem deploying to docs-preview March 23, 2026 08:56 Failure

github-actions bot had a problem deploying to docs-preview March 23, 2026 17:33 Failure

github-actions bot had a problem deploying to docs-preview March 23, 2026 18:00 Failure

github-actions bot had a problem deploying to docs-preview March 23, 2026 18:53 Failure

Merge branch 'main' into cps-tech-preview

2a1539a

github-actions bot had a problem deploying to docs-preview March 23, 2026 18:55 Failure

github-actions bot had a problem deploying to docs-preview March 23, 2026 18:58 Failure

Fix invalid cross-link for ES|QL SET command

b6a8786

Add missing .md extension to elasticsearch:// cross-links pointing to the SET command reference page. Made-with: Cursor

github-actions bot had a problem deploying to docs-preview March 23, 2026 19:02 Failure

Update redirected links to cps-config-link-and-manage.md

fda3b8f

Replace references to the old cross-project-search-link-projects.md path with the new deploy-manage/ location. Made-with: Cursor

github-actions bot had a problem deploying to docs-preview March 23, 2026 19:08 Failure

github-actions bot had a problem deploying to docs-preview March 23, 2026 19:11 Failure

github-actions bot had a problem deploying to docs-preview March 23, 2026 19:13 Failure

Fix broken anchors and redirected links in CPS pages

afc7f7e

Remove #cps-project-routing fragment from links (page title heading is not a linkable anchor) and update redirected references to cps-config-link-and-manage.md. Made-with: Cursor

github-actions bot deployed to docs-preview March 23, 2026 19:16 View deployment

Merge branch 'main' into cps-tech-preview

6215d6c

github-actions bot deployed to docs-preview March 23, 2026 19:55 View deployment

Small tweaks to CPS manage scope page

b243911

Sort availability table alphabetically and link session scope bullet to the scope selector section. Made-with: Cursor

github-actions bot deployed to docs-preview March 23, 2026 20:50 View deployment

Improve manage scope description in CPS overview page

aa533ec

Made-with: Cursor

github-actions bot deployed to docs-preview March 23, 2026 21:05 View deployment

shainaraskas commented Mar 24, 2026

View reviewed changes

Merge branch 'main' into cps-tech-preview

de3d47b

github-actions bot deployed to docs-preview March 25, 2026 16:30 View deployment

shainaraskas commented Mar 25, 2026

View reviewed changes

Adjustments from feedback

c25ed7a

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com> Co-authored-by: florent-leborgne <florent.leborgne@elastic.co>

github-actions bot deployed to docs-preview March 25, 2026 19:39 View deployment

florent-leborgne reviewed Mar 25, 2026

View reviewed changes

shainaraskas commented Mar 25, 2026

View reviewed changes

explore-analyze/cross-project-search/cross-project-search-manage-scope.md Show resolved Hide resolved

marciw and others added 2 commits March 27, 2026 13:43

Apply suggestions from review

0964786

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Apply suggestions from review

9073304

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

marciw reviewed Mar 27, 2026

View reviewed changes

deploy-manage/cross-project-search-config/cps-config-access-and-scope.md Outdated Show resolved Hide resolved

Apply suggestions from review

461081e


		With {{cps}} ({{cps-init}}), users in your organization can search across multiple {{serverless-full}} projects at once, instead of searching each project individually. When your data is split across projects to organize ownership, use cases, or environments, {{cps}} lets you query all the data from a single place.

		{{cps-cap}} is the {{serverless-short}} equivalent of [{{ccs}}](/explore-analyze/cross-cluster-search.md), without requiring an understanding of deployment architecture. Permissions stay consistent across projects, and you can always adjust scope and access as needed.

-{{cps-cap}} is the {{serverless-short}} equivalent of [{{ccs}}](/explore-analyze/cross-cluster-search.md), without requiring an understanding of deployment architecture. Permissions stay consistent across projects, and you can always adjust scope and access as needed.
+{{cps-cap}} is the {{serverless-short}} equivalent of [{{ccs}}](/explore-analyze/cross-cluster-search.md), with the following additional enhancements:
+* [Querying across projects?] [Setting up cross-project search?] doesn't require an understanding of your deployment architecture or complex security configurations.
+* Permissions stay consistent across projects, and you can always adjust scope and access as needed. [split this one further?]
+* Search is performed across projects by default, reducing the need to refactor your queries as you link additional projects.


		### Set the default {{cps-init}} scope for a space [cps-default-search-scope]

		You can adjust the broad {{cps-init}} default by setting a narrower {{cps}} scope for each space. This setting determines the _default_ search scope for all users in that space. Users can override the default by setting their preferred scope when searching, filtering, or running queries.


		When processing a search request, {{kib}} applies the most specific scope setting available:

		1. Saved object scope (most specific): Explicit project routing saved on a specific rule, dashboard panel, or other saved object (for example, `project_routing: _origin`).

		For more details about {{cps-init}} configuration, refer to [](/deploy-manage/cross-project-search-config.md). For information about _using_ {{cps-init}}, refer to [](/explore-analyze/cross-project-search.md).

		## Feature impacts [cps-feature-impacts]

	* [Manage {{cps}} scope in your project apps](/explore-analyze/cross-project-search/cross-project-search-manage-scope.md): Control which projects are searched as you work in Discover, Dashboards, and other {{kib}} apps.
	* [Manage {{cps-init}} scope in your project apps](/explore-analyze/cross-project-search/cross-project-search-manage-scope.md): Control which projects are searched as you work in Discover, Dashboards, and other {{kib}} apps.

	{{ml}} rules don't support {{cps}}. {{ml}} rules search data in the origin project only.
	{{ml-cap}} rules don't support {{cps}}. {{ml-cap}} rules search data in the origin project only.


		# {{cps-cap}} and detection rules [rules-cross-project-search]

		When [{{cps}}](/explore-analyze/cross-project-search.md) is enabled and you have [linked projects](/deploy-manage/cross-project-search-config/cps-config-link-and-manage.md), detection rules query data across linked projects based on the space-level {{cps}} scope. You cannot set a {{cps}} scope on individual rules.

Conversation

shainaraskas commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Contents

Config

Usage

Core usage

Kibana usage + feature impacts

Rule and alert docs

Not included in this PR

Pending

Uh oh!

github-actions bot commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vale Linting Results

Uh oh!

github-actions bot commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

shainaraskas left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shainaraskas left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shainaraskas left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shainaraskas commented Mar 13, 2026 •

edited

Loading

github-actions bot commented Mar 13, 2026 •

edited

Loading

github-actions bot commented Mar 13, 2026 •

edited

Loading