# AbuseCH and enrichment on custom pipeline

**URL:** <https://discuss.elastic.co/t/abusech-and-enrichment-on-custom-pipeline/322480>\
**Category:** Elastic Agent\
**Tags:** integrations\
**Created:** [January 4, 2023, 3:19pm UTC](https://discuss.elastic.co/t/abusech-and-enrichment-on-custom-pipeline/322480 "2023-01-04T15:19:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ramiwashere](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@ramiwashere](https://discuss.elastic.co/u/ramiwashere)\
**Post date:** [January 4, 2023, 3:19pm UTC](https://discuss.elastic.co/t/abusech-and-enrichment-on-custom-pipeline/322480/1 "2023-01-04T15:19:20Z")

</div>

Hi there,

I have a simple question about abuseCH integration and field enrichment of abuseCH to an other index.  
When a create my enrich policy, I don't have an error:

```auto
PUT /_enrich/policy/abusechurl-enrich-policy
 {
  "match": {
    "indices": "logs-ti_abusech.url-*",
    "match_field": "threat.indicator.ip",
    "enrich_fields": ["threat.indicator.ip", "abusech.url.blacklists.spamhaus_dbl", "abusech.url.blacklists.surbl", "threat.indicator.provider", "abusech.url.tags"]
  }
}

```

Then, when I want to create my enrichmnent processor on the other custom pipeline , here is the error:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4bcbeb8040843c53c4d09d424cb611c60f530d3c.png)

It looks like there is no index but the policy creation find the index.

Do anyone struggle on this steps and finally find the key ?  
Thank you

---

<div class="post-metadata">

**Author:** ![ebeahan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebeahan/32/78989_2.png) [@ebeahan](https://discuss.elastic.co/u/ebeahan)\
**Post date:** [January 5, 2023, 5:53pm UTC](https://discuss.elastic.co/t/abusech-and-enrichment-on-custom-pipeline/322480/2 "2023-01-05T17:53:12Z")

</div>

Have you executed the enrich policy before adding the enrichment process to the custom pipeline: [Set up an enrich processor | Elasticsearch Guide [8.5] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/enrich-setup.html#execute-enrich-policy)?

---

<div class="post-metadata">

**Author:** ![ramiwashere](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@ramiwashere](https://discuss.elastic.co/u/ramiwashere)\
**Post date:** [January 6, 2023, 1:29pm UTC](https://discuss.elastic.co/t/abusech-and-enrichment-on-custom-pipeline/322480/3 "2023-01-06T13:29:20Z")

</div>

Hello @ebeahan ,

Indeed, I didn't execute the policy.  
It work now 🙂

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 3, 2023, 1:30pm UTC](https://discuss.elastic.co/t/abusech-and-enrichment-on-custom-pipeline/322480/4 "2023-02-03T13:30:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.