IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Set up an enrich processor Example: Enrich your data based on geolocation »

› › ›

Enrich policy definition

edit

Enrich policy definition

edit

Enrich policies are defined as JSON objects like the following:

{
  "<enrich_policy_type>": {
    "indices": [ "..." ],
    "match_field": "...",
    "enrich_fields": [ "..." ],
    "query": {... }
  }
}

Parameters

edit

<enrich_policy_type>

(Required, enrich policy object) The enrich policy type determines how enrich data is matched to incoming documents.

Supported enrich policy types include:

geo_match: Matches enrich data to incoming documents based on a geographic location using a geo_shape query. For an example, see Example: Enrich your data based on geolocation.
match: Matches enrich data to incoming documents based on a precise value, such as an email address or ID, using a term query. For an example, see Example: Enrich your data based on exact values.

indices

(Required, String or array of strings) Source indices used to create the enrich index.

If multiple indices are provided, they must share a common match_field, which the enrich processor can use to match incoming documents.

match_field

(Required, string) Field in the source indices used to match incoming documents.

enrich_fields

(Required, Array of strings) Fields to add to matching incoming documents. These fields must be present in the source indices.

query

(Optional, Query DSL query object) Query used to filter documents in the enrich index for matching. Defaults to a match_all query.

« Set up an enrich processor Example: Enrich your data based on geolocation »