IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Data processing with DISSECT and GROK Using ES|QL »
Elastic Docs ›Elasticsearch Guide [8.13] ›ES|QL ›ES|QL reference

Data enrichment

edit

Data enrichment

edit

The ES|QL ENRICH processing command combines, at query-time, data from one or more source indexes with field-value combinations found in Elasticsearch enrich indexes.

For example, you can use ENRICH to:

  • Identify web services or vendors based on known IP addresses
  • Add product information to retail orders based on product IDs
  • Supplement contact information based on an email address

How the ENRICH command works

edit

The ENRICH command adds new columns to a table, with data from Elasticsearch indices. It requires a few special components:

esql enrich
Enrich policy

A set of configuration options used to add the right enrich data to the input table.

An enrich policy contains:

  • A list of one or more source indices which store enrich data as documents
  • The policy type which determines how the processor matches the enrich data to incoming documents
  • A match field from the source indices used to match incoming documents
  • Enrich fields containing enrich data from the source indices you want to add to incoming documents

After creating a policy, it must be executed before it can be used. Executing an enrich policy uses data from the policy’s source indices to create a streamlined system index called the enrich index. The ENRICH command uses this index to match and enrich an input table.

Source index
An index which stores enrich data that the ENRICH command can add to input tables. You can create and manage these indices just like a regular Elasticsearch index. You can use multiple source indices in an enrich policy. You also can use the same source index in multiple enrich policies.
Enrich index

A special system index tied to a specific enrich policy.

Directly matching rows from input tables to documents in source indices could be slow and resource intensive. To speed things up, the ENRICH command uses an enrich index.

Enrich indices contain enrich data from source indices but have a few special properties to help streamline them:

  • They are system indices, meaning they’re managed internally by Elasticsearch and only intended for use with enrich processors and the ES|QL ENRICH command.
  • They always begin with .enrich-*.
  • They are read-only, meaning you can’t directly change them.
  • They are force merged for fast retrieval.

Set up an enrich policy

edit

To start using ENRICH, follow these steps:

  1. Check the prerequisites.
  2. Add enrich data.
  3. Create an enrich policy.
  4. Execute the enrich policy.
  5. Use the enrich policy

Once you have enrich policies set up, you can update your enrich data and update your enrich policies.

The ENRICH command performs several operations and may impact the speed of your query.

Prerequisites

edit

To use enrich policies, you must have:

  • read index privileges for any indices used
  • The enrich_user built-in role

Add enrich data

edit

To begin, add documents to one or more source indices. These documents should contain the enrich data you eventually want to add to incoming data.

You can manage source indices just like regular Elasticsearch indices using the document and index APIs.

You also can set up Beats, such as a Filebeat, to automatically send and index documents to your source indices. See Getting started with Beats.

Create an enrich policy

edit

After adding enrich data to your source indices, use the create enrich policy API or Index Management in Kibana to create an enrich policy.

Once created, you can’t update or change an enrich policy. See Update an enrich policy.

Execute the enrich policy

edit

Once the enrich policy is created, you need to execute it using the execute enrich policy API or Index Management in Kibana to create an enrich index.

esql enrich policy

The enrich index contains documents from the policy’s source indices. Enrich indices always begin with .enrich-*, are read-only, and are force merged.

Enrich indices should only be used by the enrich processor or the ES|QL ENRICH command. Avoid using enrich indices for other purposes.

Use the enrich policy

edit

After the policy has been executed, you can use the ENRICH command to enrich your data.

esql enrich command

The following example uses the languages_policy enrich policy to add a new column for each enrich field defined in the policy. The match is performed using the match_field defined in the enrich policy and requires that the input table has a column with the same name (language_code in this example). ENRICH will look for records in the enrich index based on the match field value.

ROW language_code = "1"
| ENRICH languages_policy
language_code:keyword language_name:keyword

1

English

To use a column with a different name than the match_field defined in the policy as the match field, use ON <column-name>:

ROW a = "1"
| ENRICH languages_policy ON a
a:keyword language_name:keyword

1

English

By default, each of the enrich fields defined in the policy is added as a column. To explicitly select the enrich fields that are added, use WITH <field1>, <field2>, ...:

ROW a = "1"
| ENRICH languages_policy ON a WITH language_name
a:keyword language_name:keyword

1

English

You can rename the columns that are added using WITH new_name=<field1>:

ROW a = "1"
| ENRICH languages_policy ON a WITH name = language_name
a:keyword name:keyword

1

English

In case of name collisions, the newly created columns will override existing columns.

Update an enrich index

edit

Once created, you cannot update or index documents to an enrich index. Instead, update your source indices and execute the enrich policy again. This creates a new enrich index from your updated source indices. The previous enrich index will deleted with a delayed maintenance job. By default this is done every 15 minutes.

Update an enrich policy

edit

Once created, you can’t update or change an enrich policy. Instead, you can:

  1. Create and execute a new enrich policy.
  2. Replace the previous enrich policy with the new enrich policy in any in-use enrich processors or ES|QL queries.
  3. Use the delete enrich policy API or Index Management in Kibana to delete the previous enrich policy.

Limitations

edit

The ES|QL ENRICH command only supports enrich policies of type match. Furthermore, ENRICH only supports enriching on a column of type keyword.

« Data processing with DISSECT and GROK Using ES|QL »