Cross-Project Search in Elastic Cloud Serverless

What Changed Operationally

The operational landscape of distributed systems has fundamentally shifted with the introduction of cross-project search capabilities in Elastic Cloud Serverless. This feature enables engineers and operators to query multiple distinct projects—spanning observability, security, and analytics—from a single pane of glass. The immediate operational impact is the elimination of the traditional data silo problem, where teams must manually stitch together logs, metrics, and traces from different environments to gain a holistic view of system health. By treating distributed projects as a unified data source, organizations can now perform correlation analysis across workloads without the friction of context switching or managing multiple dashboards. This capability matters operationally because it transforms fragmented data streams into a cohesive narrative, allowing for faster root cause analysis and more efficient resource utilization across complex cloud-native environments.

The underlying mechanism of this capability relies on a sophisticated architecture that preserves data isolation while enabling global visibility. Cross-project search (CPS) operates by creating a federated query layer that sits atop existing Elastic Cloud Serverless projects. Rather than physically moving data between projects, the system routes the query to the origin projects, executes the search locally, and aggregates the results in real-time. This approach ensures that data sovereignty and security boundaries remain intact; each project retains its own access controls and retention policies. The architecture supports this by utilizing project routing and tagging mechanisms. When a user issues a query, the CPS layer interprets the scope based on these tags and routes the request to the appropriate origin projects. The results are then unified, allowing the user to see a combined dataset that reflects the state of all linked projects simultaneously. This architectural design decouples the user experience from the underlying data storage, providing the illusion of a single, massive dataset without the performance overhead or cost implications of data movement.

How The Capability Fits Together

Data flow within the CPS model is designed to be efficient and transparent to the end-user. The process begins with a unified query submitted through the Elastic Cloud Serverless interface or via programmatic access using Elastic Cloud API keys. The system parses the query to determine the scope of the linked projects. Once the scope is defined, the query is dispatched to the relevant origin projects. The origin projects execute the search against their local indices and return the results to the CPS layer. The layer then merges these results, applying any necessary formatting or sorting, and presents the final output. This flow is critical for maintaining low latency, as it avoids the network latency associated with transferring large volumes of data between regions or zones. Furthermore, the system handles the aggregation of metrics and the merging of log entries seamlessly, presenting the user with a consistent view that respects the schema and data types of the source projects.

It is important to clarify the specific scope and limitations of this technology to manage expectations regarding its deployment. Cross-project search is currently available as a technology preview and is scheduled for general availability starting September 16, 2026. While the feature provides powerful capabilities, it is not a catch-all solution for every project type within Elastic Cloud Serverless. For instance, CPS is currently restricted to Observability Complete and Security Complete tiers for observability and security project types. Additionally, the feature is not available for Elasticsearch or Vector DB projects at this time. Users should also be aware of the billing implications, which are structured as an add-on service. There is a separate charge for data transferred between projects, and a linked retained data charge applies, where each gigabyte of data retained in a linked project is billed at the origin project on a monthly basis. Understanding these constraints ensures that teams can accurately plan their infrastructure and budget for the adoption of this unified search capability.

Operational Impact

Administrator and Engineer Impact

The introduction of cross-project search capabilities fundamentally shifts the operational paradigm for teams managing distributed environments. Administrators and engineers must now navigate a landscape where data isolation is preserved, yet visibility is aggregated across disparate workloads. This capability allows for the querying of distributed Elastic Cloud Serverless projects as a unified entity, eliminating the need for manual data movement or the associated egress fees. For engineers, this means the ability to troubleshoot complex, multi-service failures from a single pane of glass without the latency introduced by stitching together disparate dashboards. The impact is a reduction in cognitive load and a significant acceleration in incident response times, as context is no longer siloed within individual project boundaries.

However, this shift requires a re-evaluation of access control and security policies. While the system maintains strict project isolation, the ability to query across projects introduces new attack surfaces. Administrators must implement precise scope controls to ensure that engineers only have access to the data necessary for their specific tasks. The platform supports programmatic access via Elastic Cloud API keys, which must be managed with the same rigor as traditional credentials. Engineers relying on these tools must be trained to write queries that respect these boundaries, ensuring that broad searches do not inadvertently expose sensitive data from unrelated projects. The governance model must therefore evolve to handle not just the volume of data, but the complexity of the relationships between different data silos.

Prerequisites and Licensing Constraints

Rollout And Governance Decisions

Implementing cross-project search is not a drop-in feature; it is tied to specific infrastructure and licensing tiers that administrators must verify before deployment. The feature is currently available only on Elastic Cloud Serverless projects, specifically within the Observability Complete and Security Complete tiers. This means that organizations using lower-tier plans or standard Elasticsearch projects will not have access to this functionality, necessitating a potential upgrade path for teams seeking to consolidate their observability stack. Administrators must audit their current project types to ensure they meet the eligibility requirements, as the feature is not available for Vector DB or standard Elasticsearch projects.

Furthermore, the financial implications of adopting this feature extend beyond a simple add-on license. CPS is billed as an add-on, but administrators must account for the "linked retained data charge." This fee structure charges a monthly rate per gigabyte of data retained in each linked project, billed at the origin project level. Additionally, there is a separate charge for data transferred between projects during a query. These costs can accumulate rapidly in large-scale environments, making it crucial for finance teams to model the potential expenses based on projected data retention and query volume. Engineers should be aware that while CPS removes egress fees for moving data, it introduces variable costs based on the data movement inherent in cross-project queries.

Evaluation and Pilot Strategy

A realistic evaluation of cross-project search should begin with a controlled pilot rather than a fleet-wide rollout. Given the billing structure involving linked retained data and project transfers, organizations should select a non-critical subset of projects—such as development or staging environments—to test the performance and cost implications. During this pilot, administrators should measure the latency of cross-project queries against single-project queries to ensure that the "single pane of glass" promise translates to actual performance gains. Engineers should focus on validating that the routing and tags used for filtering are granular enough to prevent performance bottlenecks when aggregating data from multiple sources.

The pilot phase should also serve as a stress test for the governance policies established in the previous section. Teams must determine how to handle the "separate charge for data transferred between projects" by optimizing query patterns. For example, instead of querying all data across projects, engineers should refine their queries to use specific tags or routing keys that minimize the amount of data transferred between projects. Once the pilot demonstrates that the feature provides sufficient value without incurring prohibitive costs, a phased rollout to production environments can be considered. This approach mitigates risk and ensures that the organization is fully prepared for the operational and financial realities of managing a unified observability view.

Failure Modes And Limits

Failure Modes and Instrumentation Gaps

A critical failure mode in modern full-stack observability is the creation of fragmented data silos, where telemetry is trapped within isolated projects or environments. Without a mechanism to correlate data across these boundaries, troubleshooting becomes a disjointed process that requires manual data movement or expensive egress fees. This fragmentation prevents teams from achieving the "single pane of glass" view necessary for holistic system understanding. When services are instrumented independently, gaps in connectivity can obscure the root cause of latency or errors, making it difficult to determine whether an issue lies within a specific microservice or at the network boundary between them.

Security And Privacy Considerations

Even when data is centralized, the quality of the instrumentation itself presents a significant risk. Incomplete or incorrect telemetry—such as missing service names, incorrect Kubernetes labels, or absent logs—renders the available data useless for analysis. Without automated validation, these gaps can go unnoticed until a critical incident occurs. The absence of standardized instrumentation means that dashboards may display partial information, leading to false confidence in system health. Consequently, the effectiveness of observability tools is directly tied to the rigor of the data collection process; poor instrumentation quality renders even the most sophisticated analysis tools ineffective.

Uncertainty and Cost Considerations

While the promise of cross-project search offers significant advantages in operational efficiency, several uncertainties and cost implications must be carefully evaluated before implementation. The feature is currently scheduled for general availability on September 16, 2026, meaning that organizations cannot yet rely on it for production environments. Until GA, the feature may undergo significant changes in functionality, pricing, or availability, introducing a risk of architectural lock-in before the technology is fully mature. Additionally, the specific billing model for cross-project search remains a variable; while the add-on nature is confirmed, the precise cost structure for data transfer and linked retained data requires scrutiny to avoid unexpected operational expenses.

Open Questions

Furthermore, the availability of cross-project search is not universal across all project types. For observability and security use cases, the feature is restricted to the Observability Complete and Security Complete tiers, potentially excluding smaller teams or organizations with specific budget constraints. This tiering creates a barrier to entry for those who might benefit most from the ability to query distributed workloads. Additionally, the requirement for specific API keys and scope controls implies a learning curve for operations teams, as managing access permissions across multiple projects adds a layer of administrative complexity that must be weighed against the potential gains in visibility.

Environment Checklist

Environment Checklist

• Verify Project Types: Confirm that your observability and security projects are running on the Observability Complete or Security Complete tiers, as cross-project search is not available on lower tiers.
• Review Billing Models: Analyze the projected data volume and transfer requirements to estimate the cost of the add-on and any potential charges for data transfer between projects.
• Assess Readiness for GA: Acknowledge that the feature is currently in a tech preview or pre-GA state (scheduled for Sep 16, 2026) and that functionality may change before general availability.
• Plan for Administrative Overhead: Prepare to manage API keys and scope controls to ensure secure and precise programmatic access to linked projects.

Verification

This article was not lab-tested. The information provided regarding pricing, feature availability dates, and specific billing models is based on published research notes and is subject to change. Readers must verify all claims directly with the respective vendors—specifically Grafana and Elastic—before deploying these technologies in production environments.