# Endpoint Security integration is sending its data always to default namespace

**URL:** <https://discuss.elastic.co/t/endpoint-security-integration-is-sending-its-data-always-to-default-namespace/249109>\
**Category:** Endpoint Security\
**Created:** [September 18, 2020, 1:29pm UTC](https://discuss.elastic.co/t/endpoint-security-integration-is-sending-its-data-always-to-default-namespace/249109 "2020-09-18T13:29:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SanWieb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sanwieb/32/75948_2.png) [@SanWieb](https://discuss.elastic.co/u/SanWieb)\
**Post date:** [September 18, 2020, 1:29pm UTC](https://discuss.elastic.co/t/endpoint-security-integration-is-sending-its-data-always-to-default-namespace/249109/1 "2020-09-18T13:29:59Z")

</div>

Hi all,

If you make a new configuration with as namespace not default but let's say 'custom'. All integrations which you add will have default as namespace 'custom', also the Elastic Endpoint Security.

However, the Elastic Endpoint Security is still sending its data to the default namespace with the default indexes. Some logs:

```
{"@timestamp":"XXX","agent":{"id":"XXX","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"info","origin":{"file":{"line":310,"name":"ElasticsearchComms.cpp"}}},"message":"ElasticsearchComms.cpp:310 Library Events Index : logs-endpoint.events.library-default","process":{"pid":16532,"thread":{"id":12420}}}
{"@timestamp":"XXX","agent":{"id":"XXX","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"info","origin":{"file":{"line":313,"name":"ElasticsearchComms.cpp"}}},"message":"ElasticsearchComms.cpp:313 Network Events Index : logs-endpoint.events.network-default","process":{"pid":16532,"thread":{"id":12420}}}
{"@timestamp":"XXX","agent":{"id":"XXX","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"info","origin":{"file":{"line":315,"name":"ElasticsearchComms.cpp"}}},"message":"ElasticsearchComms.cpp:315 Process Events Index : logs-endpoint.events.process-default","process":{"pid":16532,"thread":{"id":12420}}}
{"@timestamp":"XXX","agent":{"id":"XXX","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"info","origin":{"file":{"line":318,"name":"ElasticsearchComms.cpp"}}},"message":"ElasticsearchComms.cpp:318 Registry Events Index : logs-endpoint.events.registry-default","process":{"pid":16532,"thread":{"id":12420}}}
{"@timestamp":"XXX","agent":{"id":"XXX","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"info","origin":{"file":{"line":320,"name":"ElasticsearchComms.cpp"}}},"message":"ElasticsearchComms.cpp:320 Security Events Index : logs-endpoint.events.security-default","process":{"pid":16532,"thread":{"id":12420}}}
{"@timestamp":"XXX","agent":{"id":"XXX","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"info","origin":{"file":{"line":322,"name":"ElasticsearchComms.cpp"}}},"message":"ElasticsearchComms.cpp:322 Metadata Index : metrics-endpoint.metadata-default","process":{"pid":16532,"thread":{"id":12420}}}
{"@timestamp":"XXX","agent":{"id":"XXX","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"info","origin":{"file":{"line":323,"name":"ElasticsearchComms.cpp"}}},"message":"ElasticsearchComms.cpp:323 Policy Index : metrics-endpoint.policy-default","process":{"pid":16532,"thread":{"id":12420}}}
{"@timestamp":"XXX","agent":{"id":"XXX","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"info","origin":{"file":{"line":324,"name":"ElasticsearchComms.cpp"}}},"message":"ElasticsearchComms.cpp:324 Metrics Index : metrics-endpoint.metrics-default","process":{"pid":16532,"thread":{"id":12420}}}

```

Is this a bug already known? And is there maybe a workaround to solve it temporarily?

---

<div class="post-metadata">

**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\
**Post date:** [September 21, 2020, 2:13pm UTC](https://discuss.elastic.co/t/endpoint-security-integration-is-sending-its-data-always-to-default-namespace/249109/2 "2020-09-21T14:13:50Z")

</div>

Hi @SanWieb. This is a bug, thanks for finding and reporting it. We'll fix it ASAP. There is no workaround in the meantime.

I filed issue [https://github.com/elastic/endpoint/issues/2](https://github.com/elastic/endpoint/issues/2) so you can track this bug's progress if you'd like.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2020, 2:14pm UTC](https://discuss.elastic.co/t/endpoint-security-integration-is-sending-its-data-always-to-default-namespace/249109/3 "2020-10-19T14:14:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.