# Elastic endpoint overwrites configuration file

**URL:** <https://discuss.elastic.co/t/elastic-endpoint-overwrites-configuration-file/246531>\
**Category:** Endpoint Security\
**Tags:** elastic-stack-security\
**Created:** [August 27, 2020, 2:16am UTC](https://discuss.elastic.co/t/elastic-endpoint-overwrites-configuration-file/246531 "2020-08-27T02:16:47Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![PublicName](https://avatars.discourse-cdn.com/v4/letter/p/74df32/32.png) [@PublicName](https://discuss.elastic.co/u/PublicName)\
**Post date:** [August 27, 2020, 8:12pm UTC](https://discuss.elastic.co/t/elastic-endpoint-overwrites-configuration-file/246531/6 "2020-08-27T20:12:52Z")

</div>

Same issue. After following the steps above the agent does change but data is not sent to elastic cluster.

On the workstation side I do see a connection is being established but dies very quickly. From the log  
//  
{"@timestamp":"2020-08-27T20:06:36.8385000Z","agent":{"id":"removed","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"info","origin":{"file":{"line":1392,"name":"HttpLib.cpp"}}},"message":"HttpLib.cpp:1392 Establishing GET connection to [[https://myclustername:9200/\_cluster/health](https://myclustername:9200/_cluster/health)]","process":{"pid":4140,"thread":{"id":7080}}}

{"@timestamp":"2020-08-27T20:06:36.55357800Z","agent":{"id":"removed","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"notice","origin":{"file":{"line":65,"name":"BulkQueueConsumer.cpp"}}},"message":"BulkQueueConsumer.cpp:65 Elasticsearch connection is down","process":{"pid":4140,"thread":{"id":7080}}}  
\

Connection is dead before anything is sent.

---

_[View the full topic](https://discuss.elastic.co/t/elastic-endpoint-overwrites-configuration-file/246531)._