Difference regarding custom Namespace Setting via Fleet Policy Setting or Integrations itself?

Elastic Stack Kibana
1

Hello there,

hope you're doing fine!
My question: For configure any custom Namespace to separate ingested Data in its own/specific Data Streams i've seen two different places to do this.
One is via the Fleet Policy itself (Fleet > Policy > Settings) and the other is via any Integration itself (Fleet > Policy > Integration). Does the Policy Settings overwrite the ones configured in the Integrations itself or how is this handled internally?
Thanks in advance!
Best regards
Daniel

2

policy level sets the default (and is applied to the agent monitoring itself).
You can use the integration level to overwrite this.

3

so if all integrations had "default" and policy level had "test123" - every datastream (integrations included) have "test123" in the end?

4

apologies for not specifying enough. No, let me explain:

The namespace at policy level is the default set on integrations when you add a new integration to the policy, any integration level namespaces always overwrite.

Example
On policy_a I have the namespace cloud, now I add a new integration to this policy. This integration defaults to cloud namespace. But this can be overwritten.

On an existing integration you have the default namespace, because it wasn't changed from the policy default when it was added. You now set it to cloud. From then on only that integration will send to the new namespace, everything else within the policy remains unchanged.

Additionally when changing a namespace on the policy level, this will only apply to new integrations and the agent monitoring if you enable logging and metrics in the policy settings.

5

Thanks for your explanation. Now its clear :).
Best regards.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.