Example: Enrich your data based on exact values

match enrich policies match enrich data to incoming documents based on an exact value, such as a email address or ID, using a term query.

The following example creates a match enrich policy that adds user name and contact information to incoming documents based on an email address. It then adds the match enrich policy to a processor in an ingest pipeline.

Use the create index API or index API to create a source index.

The following index API request creates a source index and indexes a new document to that index.

  1. PUT /users/_doc/1?refresh=wait_for
  2. {
  3.   "email": "mardy.brown@asciidocsmith.com",
  4.   "first_name": "Mardy",
  5.   "last_name": "Brown",
  6.   "city": "New Orleans",
  7.   "county": "Orleans",
  8.   "state": "LA",
  9.   "zip": 70116,
  10.   "web": "mardy.asciidocsmith.com"
  11. }

Use the put enrich policy API to create an enrich policy with the match policy type. This policy must include:

  • One or more source indices
  • A match_field, the field from the source indices used to match incoming documents
  • Enrich fields from the source indices you’d like to append to incoming documents
  1. PUT /_enrich/policy/users-policy
  2. {
  3.   "match": {
  4.     "indices": "users",
  5.     "match_field": "email",
  6.     "enrich_fields": ["first_name", "last_name", "city", "zip", "state"]
  7.   }
  8. }

Use the execute enrich policy API to create an enrich index for the policy.

  1. POST /_enrich/policy/users-policy/_execute

Use the put pipeline API to create an ingest pipeline. In the pipeline, add an enrich processor that includes:

  • Your enrich policy.
  • The field of incoming documents used to match documents from the enrich index.
  • The target_field used to store appended enrich data for incoming documents. This field contains the match_field and enrich_fields specified in your enrich policy.
  1. PUT /_ingest/pipeline/user_lookup
  2. {
  3.   "description" : "Enriching user details to messages",
  4.   "processors" : [
  5.     {
  6.       "enrich" : {
  7.         "policy_name": "users-policy",
  8.         "field" : "email",
  9.         "target_field": "user",
  10.         "max_matches": "1"
  11.       }
  12.     }
  13.   ]
  14. }

Use the ingest pipeline to index a document. The incoming document should include the field specified in your enrich processor.

  1. PUT /my-index-00001/_doc/my_id?pipeline=user_lookup
  2. {
  3.   "email": "mardy.brown@asciidocsmith.com"
  4. }

To verify the enrich processor matched and appended the appropriate field data, use the get API to view the indexed document.

  1. GET /my-index-00001/_doc/my_id

The API returns the following response:

  1. {
  2.   "found": true,
  3.   "_index": "my-index-00001",
  4.   "_type": "_doc",
  5.   "_id": "my_id",
  6.   "_version": 1,
  7.   "_seq_no": 55,
  8.   "_primary_term": 1,
  9.   "_source": {
  10.     "user": {
  11.       "email": "mardy.brown@asciidocsmith.com",
  12.       "first_name": "Mardy",
  13.       "last_name": "Brown",
  14.       "zip": 70116,
  15.       "city": "New Orleans",
  16.       "state": "LA"
  17.     },
  18.     "email": "mardy.brown@asciidocsmith.com"
  19.   }
  20. }