IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs› Elasticsearch Guide [7.10]› Ingest node› Enrich your data
« Set up an enrich processor Example: Enrich your data based on geolocation »

Enrich policy definitionedit

Enrich policies are defined as JSON objects like the following:

{
  "<enrich_policy_type>": {
    "indices": [ "..." ],
    "match_field": "...",
    "enrich_fields": [ "..." ],
    "query": {... }
  }
}

Parametersedit

<enrich_policy_type>

(Required, enrich policy object) The enrich policy type determines how enrich data is matched to incoming documents.

Supported enrich policy types include:

geo_match
Matches enrich data to incoming documents based on a geographic location using a geo_shape query. For an example, see Example: Enrich your data based on geolocation.
match
Matches enrich data to incoming documents based on a precise value, such as an email address or ID, using a term query. For an example, see Example: Enrich your data based on exact values.
indices

(Required, String or array of strings) Source indices used to create the enrich index.

If multiple indices are provided, they must share a common match_field, which the enrich processor can use to match incoming documents.

match_field
(Required, string) Field in the source indices used to match incoming documents.
enrich_fields
(Required, Array of strings) Fields to add to matching incoming documents. These fields must be present in the source indices.
query
(Optional, Query DSL query object) Query used to filter documents in the enrich index for matching. Defaults to a match_all query.
« Set up an enrich processor Example: Enrich your data based on geolocation »