You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Combine data from multiple indices with `ENRICH`[esql-enrich-data]
8
11
12
+
This page provides an overview of the {{esql}} `ENRICH` command. For complete syntax details and examples, refer to the [`ENRICH` command reference](/reference/query-languages/esql/commands/enrich.md).
13
+
9
14
The {{esql}} [`ENRICH`](/reference/query-languages/esql/commands/enrich.md) processing command combines, at query-time, data from one or more source indexes with field-value combinations found in {{es}} enrich indexes.
10
15
11
16
For example, you can use `ENRICH` to:
12
-
13
17
* Identify web services or vendors based on known IP addresses
14
18
* Add product information to retail orders based on product IDs
15
19
* Supplement contact information based on an email address
16
20
17
-
[`ENRICH`](/reference/query-languages/esql/commands/enrich.md) is similar to [`LOOKUP join`](/reference/query-languages/esql/commands/lookup-join.md) in the fact that they both help you join data together. You should use `ENRICH` when:
21
+
## Compare `ENRICH` and `LOOKUP JOIN`
18
22
23
+
[`ENRICH`](/reference/query-languages/esql/commands/enrich.md) is similar to [`LOOKUP join`](/reference/query-languages/esql/commands/lookup-join.md) in the fact that they both help you join data together. You should use `ENRICH` when:
19
24
* Enrichment data doesn't change frequently
20
25
* You can accept index-time overhead
21
26
* You can accept having multiple matches combined into multi-values
22
27
* You can accept being limited to predefined match fields
23
28
* You do not need fine-grained security: There are no restrictions to specific enrich policies or document and field level security.
24
29
* You want to match using ranges or spatial relations
25
30
26
-
### How the `ENRICH` command works [esql-how-enrich-works]
31
+
## Syntax reference
32
+
33
+
For complete syntax details and examples, refer to the [ENRICH command reference](/reference/query-languages/esql/commands/enrich.md).
34
+
35
+
## How the `ENRICH` command works [esql-how-enrich-works]
27
36
28
37
The `ENRICH` command adds new columns to a table, with data from {{es}} indices. It requires a few special components:
29
38
@@ -43,8 +52,7 @@ An enrich policy contains:
43
52
* A *match field* from the source indices used to match incoming documents
44
53
**Enrich fields* containing enrich data from the source indices you want to add to incoming documents
45
54
46
-
After [creating a policy](#esql-create-enrich-policy), it must be [executed](#esql-execute-enrich-policy) before it can be used. Executing an enrich policy uses data from the policy’s source indices to create a streamlined system index called the *enrich index*. The `ENRICH` command uses this index to match and enrich an input table.
47
-
55
+
After [creating a policy](#esql-create-enrich-policy), it must be [executed](#esql-execute-enrich-policy) before it can be used. Executing an enrich policy uses data from the policy's source indices to create a streamlined system index called the *enrich index*. The `ENRICH` command uses this index to match and enrich an input table.
48
56
49
57
$$$esql-source-index$$$
50
58
@@ -60,14 +68,16 @@ Directly matching rows from input tables to documents in source indices could be
60
68
61
69
Enrich indices contain enrich data from source indices but have a few special properties to help streamline them:
62
70
63
-
* They are system indices, meaning they’re managed internally by {{es}} and only intended for use with enrich processors and the {{esql}} `ENRICH` command.
71
+
* They are system indices, meaning they're managed internally by {{es}} and only intended for use with enrich processors and the {{esql}} `ENRICH` command.
64
72
* They always begin with `.enrich-*`.
65
-
* They are read-only, meaning you can’t directly change them.
73
+
* They are read-only, meaning you can't directly change them.
66
74
* They are [force merged](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-forcemerge) for fast retrieval.
67
75
76
+
## Using `ENRICH` across clusters
68
77
78
+
You can use `ENRICH` with remote clusters. For detailed information about cross-cluster enrichment syntax and configuration, refer to [ENRICH across clusters](/reference/query-languages/esql/esql-cross-clusters.md#ccq-enrich).
69
79
70
-
###Set up an enrich policy [esql-set-up-enrich-policy]
80
+
## Set up an enrich policy [esql-set-up-enrich-policy]
71
81
72
82
To start using `ENRICH`, follow these steps:
73
83
@@ -81,19 +91,15 @@ Once you have enrich policies set up, you can [update your enrich data](#esql-up
81
91
82
92
::::{important}
83
93
The `ENRICH` command performs several operations and may impact the speed of your query.
84
-
85
94
::::
86
95
87
-
88
-
89
96
### Prerequisites [esql-enrich-prereqs]
90
97
91
98
To use enrich policies, you must have:
92
99
93
100
*`read` index privileges for any indices used
94
101
* The `enrich_user`[built-in role](/reference/elasticsearch/roles.md)
95
102
96
-
97
103
### Add enrich data [esql-create-enrich-source-index]
98
104
99
105
To begin, add documents to one or more source indices. These documents should contain the enrich data you eventually want to add to incoming data.
@@ -102,18 +108,14 @@ You can manage source indices just like regular {{es}} indices using the [docume
102
108
103
109
You also can set up [{{beats}}](beats://reference/index.md), such as a [{{filebeat}}](beats://reference/filebeat/filebeat-installation-configuration.md), to automatically send and index documents to your source indices. See [Getting started with {{beats}}](beats://reference/index.md).
104
110
105
-
106
111
### Create an enrich policy [esql-create-enrich-policy]
107
112
108
113
After adding enrich data to your source indices, use the [create enrich policy API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-enrich-put-policy) or [Index Management in {{kib}}](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-mgmt.html#manage-enrich-policies) to create an enrich policy.
109
114
110
115
::::{warning}
111
-
Once created, you can’t update or change an enrich policy. See [Update an enrich policy](docs-content://manage-data/ingest/transform-enrich/set-up-an-enrich-processor.md#update-enrich-policies).
112
-
116
+
Once created, you can't update or change an enrich policy. See [Update an enrich policy](docs-content://manage-data/ingest/transform-enrich/set-up-an-enrich-processor.md#update-enrich-policies).
113
117
::::
114
118
115
-
116
-
117
119
### Execute the enrich policy [esql-execute-enrich-policy]
118
120
119
121
Once the enrich policy is created, you need to execute it using the [execute enrich policy API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-enrich-execute-policy) or [Index Management in {{kib}}](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-mgmt.html#manage-enrich-policies) to create an [enrich index](docs-content://manage-data/ingest/transform-enrich/data-enrichment.md#enrich-index).
@@ -122,15 +124,13 @@ Once the enrich policy is created, you need to execute it using the [execute enr
122
124
:alt: esql enrich policy
123
125
:::
124
126
125
-
The *enrich index* contains documents from the policy’s source indices. Enrich indices always begin with `.enrich-*`, are read-only, and are [force merged](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-forcemerge).
127
+
The *enrich index* contains documents from the policy's source indices. Enrich indices always begin with `.enrich-*`, are read-only, and are [force merged](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-forcemerge).
126
128
127
129
::::{warning}
128
130
Enrich indices should only be used by the [enrich processor](/reference/enrich-processor/enrich-processor.md) or the [{{esql}} `ENRICH` command](/reference/query-languages/esql/commands/enrich.md). Avoid using enrich indices for other purposes.
129
131
130
132
::::
131
133
132
-
133
-
134
134
### Use the enrich policy [esql-use-enrich]
135
135
136
136
After the policy has been executed, you can use the [`ENRICH` command](/reference/query-languages/esql/commands/enrich.md) to enrich your data.
@@ -185,15 +185,13 @@ ROW a = "1"
185
185
186
186
In case of name collisions, the newly created columns will override existing columns.
187
187
188
-
189
-
### Update an enrich index [esql-update-enrich-data]
188
+
## Update an enrich index [esql-update-enrich-data]
190
189
191
190
Once created, you cannot update or index documents to an enrich index. Instead, update your source indices and [execute](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-enrich-execute-policy) the enrich policy again. This creates a new enrich index from your updated source indices. The previous enrich index will be deleted with a delayed maintenance job that executes by default every 15 minutes.
192
191
192
+
## Update an enrich policy [esql-update-enrich-policies]
193
193
194
-
### Update an enrich policy [esql-update-enrich-policies]
195
-
196
-
Once created, you can’t update or change an enrich policy. Instead, you can:
194
+
Once created, you can't update or change an enrich policy. Instead, you can:
197
195
198
196
1. Create and [execute](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-enrich-execute-policy) a new enrich policy.
199
197
2. Replace the previous enrich policy with the new enrich policy in any in-use enrich processors or {{esql}} queries.
@@ -204,18 +202,22 @@ Once created, you can’t update or change an enrich policy. Instead, you can:
204
202
The {{esql}} `ENRICH` command supports all three enrich policy types:
205
203
206
204
`geo_match`
207
-
: Matches enrich data to incoming documents based on a [`geo_shape` query](/reference/query-languages/query-dsl/query-dsl-geo-shape-query.md). For an example, see[Example: Enrich your data based on geolocation](docs-content://manage-data/ingest/transform-enrich/example-enrich-data-based-on-geolocation.md).
205
+
: Matches enrich data to incoming documents based on a [`geo_shape` query](/reference/query-languages/query-dsl/query-dsl-geo-shape-query.md). For an example, refer to[Example: Enrich your data based on geolocation](docs-content://manage-data/ingest/transform-enrich/example-enrich-data-based-on-geolocation.md).
208
206
209
207
`match`
210
-
: Matches enrich data to incoming documents based on a [`term` query](/reference/query-languages/query-dsl/query-dsl-term-query.md). For an example, see[Example: Enrich your data based on exact values](docs-content://manage-data/ingest/transform-enrich/example-enrich-data-based-on-exact-values.md).
208
+
: Matches enrich data to incoming documents based on a [`term` query](/reference/query-languages/query-dsl/query-dsl-term-query.md). For an example, refer to[Example: Enrich your data based on exact values](docs-content://manage-data/ingest/transform-enrich/example-enrich-data-based-on-exact-values.md).
211
209
212
210
`range`
213
-
: Matches a number, date, or IP address in incoming documents to a range in the enrich index based on a [`term` query](/reference/query-languages/query-dsl/query-dsl-term-query.md). For an example, see[Example: Enrich your data by matching a value to a range](docs-content://manage-data/ingest/transform-enrich/example-enrich-data-by-matching-value-to-range.md).
211
+
: Matches a number, date, or IP address in incoming documents to a range in the enrich index based on a [`term` query](/reference/query-languages/query-dsl/query-dsl-term-query.md). For an example, refer to[Example: Enrich your data by matching a value to a range](docs-content://manage-data/ingest/transform-enrich/example-enrich-data-by-matching-value-to-range.md).
214
212
215
213
While all three enrich policy types are supported, there are some limitations to be aware of:
216
214
217
215
* The `geo_match` enrich policy type only supports the `intersects` spatial relation.
218
216
* It is required that the `match_field` in the `ENRICH` command is of the correct type. For example, if the enrich policy is of type `geo_match`, the `match_field` in the `ENRICH` command must be of type `geo_point` or `geo_shape`. Likewise, a `range` enrich policy requires a `match_field` of type `integer`, `long`, `date`, or `ip`, depending on the type of the range field in the original enrich index.
219
217
* However, this constraint is relaxed for `range` policies when the `match_field` is of type `KEYWORD`. In this case the field values will be parsed during query execution, row by row. If any value fails to parse, the output values for that row will be set to `null`, an appropriate warning will be produced and the query will continue to execute.
220
218
221
-
219
+
## Related pages
220
+
221
+
*[`ENRICH` command reference](/reference/query-languages/esql/commands/enrich.md): Complete syntax documentation and examples
222
+
*[`ENRICH` across clusters](/reference/query-languages/esql/esql-cross-clusters.md#ccq-enrich) - Cross-cluster enrichment configuration
223
+
*[LOOKUP JOIN command](/reference/query-languages/esql/commands/lookup-join.md) - Alternative approach for joining data
0 commit comments