Enrich policy definition

Enrich policies are defined as JSON objects like the following:

{
  "<enrich_policy_type>": {
    "indices": [ "..." ],
    "match_field": "...",
    "enrich_fields": [ "..." ],
    "query": {... }
  }
}

Parameters

<enrich_policy_type>

(Required, enrich policy object) The enrich policy type determines how enrich data is matched to incoming documents.

Supported enrich policy types include:

• geo_match

  Matches enrich data to incoming documents based on a geographic location using a geo_shape query. For an example, see Example: Enrich your data based on geolocation.

  match

  Matches enrich data to incoming documents based on a precise value, such as an email address or ID, using a term query. For an example, see Example: Enrich your data based on exact values.

indices

(Required, String or array of strings) Source indices used to create the enrich index.

If multiple indices are provided, they must share a common match_field, which the enrich processor can use to match incoming documents.

match_field

(Required, string) Field in the source indices used to match incoming documents.

enrich_fields

(Required, Array of strings) Fields to add to matching incoming documents. These fields must be present in the source indices.

query

(Optional, Query DSL query object) Query used to filter documents in the enrich index for matching. Defaults to a match_all query.