# Endpoint Security integration and index naming (.logs-endpoint.action.responses)

**URL:** <https://discuss.elastic.co/t/endpoint-security-integration-and-index-naming-logs-endpoint-action-responses/313744>\
**Category:** Elastic Agent\
**Tags:** fleet\
**Created:** [September 6, 2022, 6:30am UTC](https://discuss.elastic.co/t/endpoint-security-integration-and-index-naming-logs-endpoint-action-responses/313744 "2022-09-06T06:30:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ivo.raisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ivo.raisr/32/108521_2.png) [@ivo.raisr](https://discuss.elastic.co/u/ivo.raisr)\
**Post date:** [September 6, 2022, 6:30am UTC](https://discuss.elastic.co/t/endpoint-security-integration-and-index-naming-logs-endpoint-action-responses/313744/1 "2022-09-06T06:30:08Z")

</div>

"Endpoint and Cloud Security" integration for Elastic Agent mentions in the [documentation](https://docs.elastic.co/en/integrations/endpoint) (for Elastic 8.4.1) that

```auto
...The log type of documents are stored in the logs-endpoint.* indices. ...

```

However this is not entirely true. The following data streams were created when using "Endpoint and Cloud Security" integration:

- .logs-endpoint.action.responses
- .logs-endpoint.actions
- logs-elastic\_agent.endpoint\_security
- logs-endpoint.events.file
- logs-endpoint.events.network
- logs-endpoint.events.process

Which results in:

1. Incosistency across the data stream naming pattern.
2. Inconsitency with the integration documentation.
3. Problems when ingesting by logstash all events from Elastic Agent and following the ELastic's [documentation](https://www.elastic.co/guide/en/logstash/current/ls-security.html#ls-http-auth-basic) for using a dedicated `logstash_writer` role.

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [September 6, 2022, 9:33am UTC](https://discuss.elastic.co/t/endpoint-security-integration-and-index-naming-logs-endpoint-action-responses/313744/2 "2022-09-06T09:33:59Z")

</div>

Hello,

`.logs-endpoint` are supposed to be hidden streams (now I don't remember what was the reason behind). Apart from that, all is consitent, Elastic Endpoint Security streams are `logs-endpoint`, the other one `logs-elastic_agent` belongs to Elastic Agent SIEM

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2022, 9:34am UTC](https://discuss.elastic.co/t/endpoint-security-integration-and-index-naming-logs-endpoint-action-responses/313744/3 "2022-10-04T09:34:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.