IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Enrich policy definition
editEnrich policy definition
editEnrich policies are defined as JSON objects like the following:
{ "<enrich_policy_type>": { "indices": [ "..." ], "match_field": "...", "enrich_fields": [ "..." ], "query": {... } } }
Parameters
edit-
<enrich_policy_type>
-
(Required, enrich policy object) The enrich policy type determines how enrich data is matched to incoming documents.
Supported enrich policy types include:
-
geo_match
-
Matches enrich data to incoming documents based on a geographic location using
a
geo_shape
query. For an example, see Example: Enrich your data based on geolocation. -
match
-
Matches enrich data to incoming documents based on a precise value, such as an
email address or ID, using a
term
query. For an example, see Example: Enrich your data based on exact values.
-
-
indices
-
(Required, String or array of strings) Source indices used to create the enrich index.
If multiple indices are provided, they must share a common
match_field
, which the enrich processor can use to match incoming documents. -
match_field
- (Required, string) Field in the source indices used to match incoming documents.
-
enrich_fields
- (Required, Array of strings) Fields to add to matching incoming documents. These fields must be present in the source indices.
-
query
-
(Optional, Query DSL query object)
Query used to filter documents in the enrich index for matching. Defaults to
a
match_all
query.