diff --git a/x-pack/plugins/actions/server/lib/action_executor.ts b/x-pack/plugins/actions/server/lib/action_executor.ts
index af0353247d99f1..ba8bb79170c63b 100644
--- a/x-pack/plugins/actions/server/lib/action_executor.ts
+++ b/x-pack/plugins/actions/server/lib/action_executor.ts
@@ -75,7 +75,8 @@ export class ActionExecutor {
     } = this.actionExecutorContext!;
 
     const services = getServices(request);
-    const namespace = spaces && spaces.getSpaceId(request);
+    const spaceId = spaces && spaces.getSpaceId(request);
+    const namespace = spaceId && spaceId !== 'default' ? { namespace: spaceId } : {};
 
     // Ensure user can read the action before processing
     const {
@@ -91,9 +92,7 @@ export class ActionExecutor {
     } = await encryptedSavedObjectsPlugin.getDecryptedAsInternalUser<RawAction>(
       'action',
       actionId,
-      {
-        namespace: namespace === 'default' ? undefined : namespace,
-      }
+      namespace
     );
     const actionType = actionTypeRegistry.get(actionTypeId);
 
@@ -112,7 +111,7 @@ export class ActionExecutor {
     const actionLabel = `${actionTypeId}:${actionId}: ${name}`;
     const event: IEvent = {
       event: { action: EVENT_LOG_ACTIONS.execute },
-      kibana: { namespace, saved_objects: [{ type: 'action', id: actionId }] },
+      kibana: { saved_objects: [{ type: 'action', id: actionId, ...namespace }] },
     };
 
     eventLogger.startTiming(event);
diff --git a/x-pack/plugins/alerting/server/task_runner/create_execution_handler.test.ts b/x-pack/plugins/alerting/server/task_runner/create_execution_handler.test.ts
index 8d037a1ecee913..756080baba6266 100644
--- a/x-pack/plugins/alerting/server/task_runner/create_execution_handler.test.ts
+++ b/x-pack/plugins/alerting/server/task_runner/create_execution_handler.test.ts
@@ -91,7 +91,6 @@ test('calls actionsPlugin.execute per selected action', async () => {
             "alerting": Object {
               "instance_id": "2",
             },
-            "namespace": "default",
             "saved_objects": Array [
               Object {
                 "id": "1",
diff --git a/x-pack/plugins/alerting/server/task_runner/create_execution_handler.ts b/x-pack/plugins/alerting/server/task_runner/create_execution_handler.ts
index de06c8bbb374a8..72f9e70905dc28 100644
--- a/x-pack/plugins/alerting/server/task_runner/create_execution_handler.ts
+++ b/x-pack/plugins/alerting/server/task_runner/create_execution_handler.ts
@@ -87,16 +87,17 @@ export function createExecutionHandler({
         apiKey,
       });
 
+      const namespace = spaceId === 'default' ? {} : { namespace: spaceId };
+
       const event: IEvent = {
         event: { action: EVENT_LOG_ACTIONS.executeAction },
         kibana: {
           alerting: {
             instance_id: alertInstanceId,
           },
-          namespace: spaceId,
           saved_objects: [
-            { type: 'alert', id: alertId },
-            { type: 'action', id: action.id },
+            { type: 'alert', id: alertId, ...namespace },
+            { type: 'action', id: action.id, ...namespace },
           ],
         },
       };
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
index 520f8d5c99b16d..4e6d959f0ce602 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
@@ -169,10 +169,10 @@ describe('Task Runner', () => {
           "action": "execute",
         },
         "kibana": Object {
-          "namespace": undefined,
           "saved_objects": Array [
             Object {
               "id": "1",
+              "namespace": undefined,
               "type": "alert",
             },
           ],
@@ -229,10 +229,10 @@ describe('Task Runner', () => {
               "action": "execute",
             },
             "kibana": Object {
-              "namespace": undefined,
               "saved_objects": Array [
                 Object {
                   "id": "1",
+                  "namespace": undefined,
                   "type": "alert",
                 },
               ],
@@ -249,10 +249,10 @@ describe('Task Runner', () => {
               "alerting": Object {
                 "instance_id": "1",
               },
-              "namespace": undefined,
               "saved_objects": Array [
                 Object {
                   "id": "1",
+                  "namespace": undefined,
                   "type": "alert",
                 },
               ],
@@ -269,14 +269,15 @@ describe('Task Runner', () => {
               "alerting": Object {
                 "instance_id": "1",
               },
-              "namespace": undefined,
               "saved_objects": Array [
                 Object {
                   "id": "1",
+                  "namespace": undefined,
                   "type": "alert",
                 },
                 Object {
                   "id": "1",
+                  "namespace": undefined,
                   "type": "action",
                 },
               ],
@@ -344,10 +345,10 @@ describe('Task Runner', () => {
               "action": "execute",
             },
             "kibana": Object {
-              "namespace": undefined,
               "saved_objects": Array [
                 Object {
                   "id": "1",
+                  "namespace": undefined,
                   "type": "alert",
                 },
               ],
@@ -364,10 +365,10 @@ describe('Task Runner', () => {
               "alerting": Object {
                 "instance_id": "2",
               },
-              "namespace": undefined,
               "saved_objects": Array [
                 Object {
                   "id": "1",
+                  "namespace": undefined,
                   "type": "alert",
                 },
               ],
@@ -560,10 +561,10 @@ describe('Task Runner', () => {
               "action": "execute",
             },
             "kibana": Object {
-              "namespace": undefined,
               "saved_objects": Array [
                 Object {
                   "id": "1",
+                  "namespace": undefined,
                   "type": "alert",
                 },
               ],
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
index 2ba56396279ea2..190cdc184930ce 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
@@ -173,7 +173,7 @@ export class TaskRunner {
     const alertLabel = `${this.alertType.id}:${alertId}: '${name}'`;
     const event: IEvent = {
       event: { action: EVENT_LOG_ACTIONS.execute },
-      kibana: { namespace, saved_objects: [{ type: 'alert', id: alertId }] },
+      kibana: { saved_objects: [{ type: 'alert', id: alertId, namespace }] },
     };
     eventLogger.startTiming(event);
 
@@ -378,11 +378,10 @@ function generateNewAndResolvedInstanceEvents(params: GenerateNewAndResolvedInst
         action,
       },
       kibana: {
-        namespace: params.namespace,
         alerting: {
           instance_id: id,
         },
-        saved_objects: [{ type: 'alert', id: params.alertId }],
+        saved_objects: [{ type: 'alert', id: params.alertId, namespace: params.namespace }],
       },
       message,
     };
diff --git a/x-pack/plugins/event_log/README.md b/x-pack/plugins/event_log/README.md
index 027bbc694801f6..38364033cb70be 100644
--- a/x-pack/plugins/event_log/README.md
+++ b/x-pack/plugins/event_log/README.md
@@ -125,7 +125,6 @@ Here's the event written to the event log index:
       "duration": 1000000
     },
     "kibana": {
-      "namespace": "default",
       "saved_objects": [
         {
           "type": "action",
diff --git a/x-pack/plugins/event_log/generated/mappings.json b/x-pack/plugins/event_log/generated/mappings.json
index ab1b4096d17f2c..9c1dff60f9727a 100644
--- a/x-pack/plugins/event_log/generated/mappings.json
+++ b/x-pack/plugins/event_log/generated/mappings.json
@@ -72,10 +72,6 @@
                     "type": "keyword",
                     "ignore_above": 1024
                 },
-                "namespace": {
-                    "type": "keyword",
-                    "ignore_above": 1024
-                },
                 "alerting": {
                     "properties": {
                         "instance_id": {
@@ -86,7 +82,7 @@
                 },
                 "saved_objects": {
                     "properties": {
-                        "store": {
+                        "namespace": {
                             "type": "keyword",
                             "ignore_above": 1024
                         },
diff --git a/x-pack/plugins/event_log/generated/schemas.ts b/x-pack/plugins/event_log/generated/schemas.ts
index b731093b33b06e..5e93f320c009f2 100644
--- a/x-pack/plugins/event_log/generated/schemas.ts
+++ b/x-pack/plugins/event_log/generated/schemas.ts
@@ -56,7 +56,6 @@ export const EventSchema = schema.maybe(
     kibana: schema.maybe(
       schema.object({
         server_uuid: ecsString(),
-        namespace: ecsString(),
         alerting: schema.maybe(
           schema.object({
             instance_id: ecsString(),
@@ -65,7 +64,7 @@ export const EventSchema = schema.maybe(
         saved_objects: schema.maybe(
           schema.arrayOf(
             schema.object({
-              store: ecsString(),
+              namespace: ecsString(),
               id: ecsString(),
               type: ecsString(),
             })
diff --git a/x-pack/plugins/event_log/scripts/mappings.js b/x-pack/plugins/event_log/scripts/mappings.js
index 9e721b06ec3351..de3c9d631fbca6 100644
--- a/x-pack/plugins/event_log/scripts/mappings.js
+++ b/x-pack/plugins/event_log/scripts/mappings.js
@@ -20,17 +20,12 @@ exports.EcsKibanaExtensionsMappings = {
         },
       },
     },
-    // relevant kibana space
-    namespace: {
-      type: 'keyword',
-      ignore_above: 1024,
-    },
     // array of saved object references, for "linking" via search
     saved_objects: {
       type: 'nested',
       properties: {
-        // 'kibana' for typical saved object, 'task_manager' for TM, etc
-        store: {
+        // relevant kibana space
+        namespace: {
           type: 'keyword',
           ignore_above: 1024,
         },
@@ -61,9 +56,8 @@ exports.EcsEventLogProperties = [
   'error.message',
   'user.name',
   'kibana.server_uuid',
-  'kibana.namespace',
   'kibana.alerting.instance_id',
-  'kibana.saved_objects.store',
+  'kibana.saved_objects.namespace',
   'kibana.saved_objects.id',
   'kibana.saved_objects.name',
   'kibana.saved_objects.type',
diff --git a/x-pack/plugins/event_log/server/routes/_mock_handler_arguments.ts b/x-pack/plugins/event_log/server/routes/_mock_handler_arguments.ts
index 6640683bf6005e..19933649277aa3 100644
--- a/x-pack/plugins/event_log/server/routes/_mock_handler_arguments.ts
+++ b/x-pack/plugins/event_log/server/routes/_mock_handler_arguments.ts
@@ -50,9 +50,9 @@ export function fakeEvent(overrides = {}) {
         duration: 1000000,
       },
       kibana: {
-        namespace: 'default',
         saved_objects: [
           {
+            namespace: 'default',
             type: 'action',
             id: '968f1b82-0414-4a10-becc-56b6473e4a29',
           },
diff --git a/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts b/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts
index c440971225d78f..d664357c3ba126 100644
--- a/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts
+++ b/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts
@@ -220,9 +220,9 @@ export default function({ getService }: FtrProviderContext) {
           duration: 1000000,
         },
         kibana: {
-          namespace: 'default',
           saved_objects: [
             {
+              namespace: 'default',
               type: 'event_log_test',
               id,
             },