Enrich processor in Elasticsearch

Introduction

The enrich processor helps add extra information to your documents automatically. It looks up data from another source and adds it to your data.

You want to add user details to logs based on user ID.

You need to add product info to sales records without changing the original data source.

You want to enrich error logs with server names from a separate list.

You want to add location details to IP addresses in your documents.

Syntax

Elasticsearch

{
  "enrich": {
    "policy_name": "policy_name_here",
    "field": "field_to_match",
    "target_field": "field_to_add_data",
    "max_matches": 1
  }
}

policy_name is the name of the enrich policy you created.

field is the field in your document to match with the enrich index.

Examples

This adds user details to documents by matching the user_id field.

Elasticsearch

{
  "enrich": {
    "policy_name": "user_policy",
    "field": "user_id",
    "target_field": "user_details"
  }
}

This adds product info to documents by matching product_code, limiting to one match.

Elasticsearch

{
  "enrich": {
    "policy_name": "product_policy",
    "field": "product_code",
    "target_field": "product_info",
    "max_matches": 1
  }
}

Sample Program

This example creates an enrich policy to add user name and email from the users index. Then it simulates adding this info to a document with user_id 123.

Elasticsearch

PUT /users/_doc/1
{
  "user_id": "123",
  "name": "John Doe",
  "email": "[e-mail]"
}

PUT /_enrich/policy/user_policy
{
  "match": {
    "indices": ["users"],
    "match_field": "user_id",
    "enrich_fields": ["name", "email"]
  }
}

POST /_enrich/policy/user_policy/_execute

POST /_ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "enrich": {
          "policy_name": "user_policy",
          "field": "user_id",
          "target_field": "user_info"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "user_id": "123"
      }
    }
  ]
}

Important Notes

You must create and execute the enrich policy before using the enrich processor.

The enrich processor works during ingest, so it adds data as documents are indexed.

Use max_matches to control how many matches to add; default is 1.

Summary

The enrich processor adds extra data to documents by matching fields.

It uses enrich policies created from other data sources.

This helps keep your data enriched without changing original sources.