Skip to content

Commit e33a94b

Browse files
authored
[ESQL] Clean up ESQL enrich landing page (elastic#134820) (elastic#134883)
This page needed some love, including more visible links to the syntax reference and enrich with CCS page
1 parent 5430e89 commit e33a94b

File tree

1 file changed

+31
-29
lines changed

1 file changed

+31
-29
lines changed

docs/reference/query-languages/esql/esql-enrich-data.md

Lines changed: 31 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,38 @@
11
---
2+
applies_to:
3+
stack:
4+
serverless: unavailable
25
navigation_title: "Combine data with ENRICH"
36
mapped_pages:
47
- https://www.elastic.co/guide/en/elasticsearch/reference/current/esql-enrich-data.html
58
---
69

710
# Combine data from multiple indices with `ENRICH` [esql-enrich-data]
811

12+
This page provides an overview of the {{esql}} `ENRICH` command. For complete syntax details and examples, refer to the [`ENRICH` command reference](/reference/query-languages/esql/commands/enrich.md).
13+
914
The {{esql}} [`ENRICH`](/reference/query-languages/esql/commands/enrich.md) processing command combines, at query-time, data from one or more source indexes with field-value combinations found in {{es}} enrich indexes.
1015

1116
For example, you can use `ENRICH` to:
12-
1317
* Identify web services or vendors based on known IP addresses
1418
* Add product information to retail orders based on product IDs
1519
* Supplement contact information based on an email address
1620

17-
[`ENRICH`](/reference/query-languages/esql/commands/enrich.md) is similar to [`LOOKUP join`](/reference/query-languages/esql/commands/lookup-join.md) in the fact that they both help you join data together. You should use `ENRICH` when:
21+
## Compare `ENRICH` and `LOOKUP JOIN`
1822

23+
[`ENRICH`](/reference/query-languages/esql/commands/enrich.md) is similar to [`LOOKUP join`](/reference/query-languages/esql/commands/lookup-join.md) in the fact that they both help you join data together. You should use `ENRICH` when:
1924
* Enrichment data doesn't change frequently
2025
* You can accept index-time overhead
2126
* You can accept having multiple matches combined into multi-values
2227
* You can accept being limited to predefined match fields
2328
* You do not need fine-grained security: There are no restrictions to specific enrich policies or document and field level security.
2429
* You want to match using ranges or spatial relations
2530

26-
### How the `ENRICH` command works [esql-how-enrich-works]
31+
## Syntax reference
32+
33+
For complete syntax details and examples, refer to the [ENRICH command reference](/reference/query-languages/esql/commands/enrich.md).
34+
35+
## How the `ENRICH` command works [esql-how-enrich-works]
2736

2837
The `ENRICH` command adds new columns to a table, with data from {{es}} indices. It requires a few special components:
2938

@@ -43,8 +52,7 @@ An enrich policy contains:
4352
* A *match field* from the source indices used to match incoming documents
4453
* *Enrich fields* containing enrich data from the source indices you want to add to incoming documents
4554

46-
After [creating a policy](#esql-create-enrich-policy), it must be [executed](#esql-execute-enrich-policy) before it can be used. Executing an enrich policy uses data from the policy’s source indices to create a streamlined system index called the *enrich index*. The `ENRICH` command uses this index to match and enrich an input table.
47-
55+
After [creating a policy](#esql-create-enrich-policy), it must be [executed](#esql-execute-enrich-policy) before it can be used. Executing an enrich policy uses data from the policy's source indices to create a streamlined system index called the *enrich index*. The `ENRICH` command uses this index to match and enrich an input table.
4856

4957
$$$esql-source-index$$$
5058

@@ -60,14 +68,16 @@ Directly matching rows from input tables to documents in source indices could be
6068

6169
Enrich indices contain enrich data from source indices but have a few special properties to help streamline them:
6270

63-
* They are system indices, meaning theyre managed internally by {{es}} and only intended for use with enrich processors and the {{esql}} `ENRICH` command.
71+
* They are system indices, meaning they're managed internally by {{es}} and only intended for use with enrich processors and the {{esql}} `ENRICH` command.
6472
* They always begin with `.enrich-*`.
65-
* They are read-only, meaning you cant directly change them.
73+
* They are read-only, meaning you can't directly change them.
6674
* They are [force merged](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-forcemerge) for fast retrieval.
6775

76+
## Using `ENRICH` across clusters
6877

78+
You can use `ENRICH` with remote clusters. For detailed information about cross-cluster enrichment syntax and configuration, refer to [ENRICH across clusters](/reference/query-languages/esql/esql-cross-clusters.md#ccq-enrich).
6979

70-
### Set up an enrich policy [esql-set-up-enrich-policy]
80+
## Set up an enrich policy [esql-set-up-enrich-policy]
7181

7282
To start using `ENRICH`, follow these steps:
7383

@@ -81,19 +91,15 @@ Once you have enrich policies set up, you can [update your enrich data](#esql-up
8191

8292
::::{important}
8393
The `ENRICH` command performs several operations and may impact the speed of your query.
84-
8594
::::
8695

87-
88-
8996
### Prerequisites [esql-enrich-prereqs]
9097

9198
To use enrich policies, you must have:
9299

93100
* `read` index privileges for any indices used
94101
* The `enrich_user` [built-in role](/reference/elasticsearch/roles.md)
95102

96-
97103
### Add enrich data [esql-create-enrich-source-index]
98104

99105
To begin, add documents to one or more source indices. These documents should contain the enrich data you eventually want to add to incoming data.
@@ -102,18 +108,14 @@ You can manage source indices just like regular {{es}} indices using the [docume
102108

103109
You also can set up [{{beats}}](beats://reference/index.md), such as a [{{filebeat}}](beats://reference/filebeat/filebeat-installation-configuration.md), to automatically send and index documents to your source indices. See [Getting started with {{beats}}](beats://reference/index.md).
104110

105-
106111
### Create an enrich policy [esql-create-enrich-policy]
107112

108113
After adding enrich data to your source indices, use the [create enrich policy API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-enrich-put-policy) or [Index Management in {{kib}}](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-mgmt.html#manage-enrich-policies) to create an enrich policy.
109114

110115
::::{warning}
111-
Once created, you can’t update or change an enrich policy. See [Update an enrich policy](docs-content://manage-data/ingest/transform-enrich/set-up-an-enrich-processor.md#update-enrich-policies).
112-
116+
Once created, you can't update or change an enrich policy. See [Update an enrich policy](docs-content://manage-data/ingest/transform-enrich/set-up-an-enrich-processor.md#update-enrich-policies).
113117
::::
114118

115-
116-
117119
### Execute the enrich policy [esql-execute-enrich-policy]
118120

119121
Once the enrich policy is created, you need to execute it using the [execute enrich policy API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-enrich-execute-policy) or [Index Management in {{kib}}](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-mgmt.html#manage-enrich-policies) to create an [enrich index](docs-content://manage-data/ingest/transform-enrich/data-enrichment.md#enrich-index).
@@ -122,15 +124,13 @@ Once the enrich policy is created, you need to execute it using the [execute enr
122124
:alt: esql enrich policy
123125
:::
124126

125-
The *enrich index* contains documents from the policys source indices. Enrich indices always begin with `.enrich-*`, are read-only, and are [force merged](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-forcemerge).
127+
The *enrich index* contains documents from the policy's source indices. Enrich indices always begin with `.enrich-*`, are read-only, and are [force merged](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-forcemerge).
126128

127129
::::{warning}
128130
Enrich indices should only be used by the [enrich processor](/reference/enrich-processor/enrich-processor.md) or the [{{esql}} `ENRICH` command](/reference/query-languages/esql/commands/enrich.md). Avoid using enrich indices for other purposes.
129131

130132
::::
131133

132-
133-
134134
### Use the enrich policy [esql-use-enrich]
135135

136136
After the policy has been executed, you can use the [`ENRICH` command](/reference/query-languages/esql/commands/enrich.md) to enrich your data.
@@ -185,15 +185,13 @@ ROW a = "1"
185185

186186
In case of name collisions, the newly created columns will override existing columns.
187187

188-
189-
### Update an enrich index [esql-update-enrich-data]
188+
## Update an enrich index [esql-update-enrich-data]
190189

191190
Once created, you cannot update or index documents to an enrich index. Instead, update your source indices and [execute](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-enrich-execute-policy) the enrich policy again. This creates a new enrich index from your updated source indices. The previous enrich index will be deleted with a delayed maintenance job that executes by default every 15 minutes.
192191

192+
## Update an enrich policy [esql-update-enrich-policies]
193193

194-
### Update an enrich policy [esql-update-enrich-policies]
195-
196-
Once created, you can’t update or change an enrich policy. Instead, you can:
194+
Once created, you can't update or change an enrich policy. Instead, you can:
197195

198196
1. Create and [execute](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-enrich-execute-policy) a new enrich policy.
199197
2. Replace the previous enrich policy with the new enrich policy in any in-use enrich processors or {{esql}} queries.
@@ -204,18 +202,22 @@ Once created, you can’t update or change an enrich policy. Instead, you can:
204202
The {{esql}} `ENRICH` command supports all three enrich policy types:
205203

206204
`geo_match`
207-
: Matches enrich data to incoming documents based on a [`geo_shape` query](/reference/query-languages/query-dsl/query-dsl-geo-shape-query.md). For an example, see [Example: Enrich your data based on geolocation](docs-content://manage-data/ingest/transform-enrich/example-enrich-data-based-on-geolocation.md).
205+
: Matches enrich data to incoming documents based on a [`geo_shape` query](/reference/query-languages/query-dsl/query-dsl-geo-shape-query.md). For an example, refer to [Example: Enrich your data based on geolocation](docs-content://manage-data/ingest/transform-enrich/example-enrich-data-based-on-geolocation.md).
208206

209207
`match`
210-
: Matches enrich data to incoming documents based on a [`term` query](/reference/query-languages/query-dsl/query-dsl-term-query.md). For an example, see [Example: Enrich your data based on exact values](docs-content://manage-data/ingest/transform-enrich/example-enrich-data-based-on-exact-values.md).
208+
: Matches enrich data to incoming documents based on a [`term` query](/reference/query-languages/query-dsl/query-dsl-term-query.md). For an example, refer to [Example: Enrich your data based on exact values](docs-content://manage-data/ingest/transform-enrich/example-enrich-data-based-on-exact-values.md).
211209

212210
`range`
213-
: Matches a number, date, or IP address in incoming documents to a range in the enrich index based on a [`term` query](/reference/query-languages/query-dsl/query-dsl-term-query.md). For an example, see [Example: Enrich your data by matching a value to a range](docs-content://manage-data/ingest/transform-enrich/example-enrich-data-by-matching-value-to-range.md).
211+
: Matches a number, date, or IP address in incoming documents to a range in the enrich index based on a [`term` query](/reference/query-languages/query-dsl/query-dsl-term-query.md). For an example, refer to [Example: Enrich your data by matching a value to a range](docs-content://manage-data/ingest/transform-enrich/example-enrich-data-by-matching-value-to-range.md).
214212

215213
While all three enrich policy types are supported, there are some limitations to be aware of:
216214

217215
* The `geo_match` enrich policy type only supports the `intersects` spatial relation.
218216
* It is required that the `match_field` in the `ENRICH` command is of the correct type. For example, if the enrich policy is of type `geo_match`, the `match_field` in the `ENRICH` command must be of type `geo_point` or `geo_shape`. Likewise, a `range` enrich policy requires a `match_field` of type `integer`, `long`, `date`, or `ip`, depending on the type of the range field in the original enrich index.
219217
* However, this constraint is relaxed for `range` policies when the `match_field` is of type `KEYWORD`. In this case the field values will be parsed during query execution, row by row. If any value fails to parse, the output values for that row will be set to `null`, an appropriate warning will be produced and the query will continue to execute.
220218

221-
219+
## Related pages
220+
221+
* [`ENRICH` command reference](/reference/query-languages/esql/commands/enrich.md): Complete syntax documentation and examples
222+
* [`ENRICH` across clusters](/reference/query-languages/esql/esql-cross-clusters.md#ccq-enrich) - Cross-cluster enrichment configuration
223+
* [LOOKUP JOIN command](/reference/query-languages/esql/commands/lookup-join.md) - Alternative approach for joining data

0 commit comments

Comments
 (0)