# Elasticsearch filter plugin for data enrichment

**URL:** <https://discuss.elastic.co/t/elasticsearch-filter-plugin-for-data-enrichment/314944>\
**Category:** Elasticsearch\
**Created:** [September 22, 2022, 12:35pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-for-data-enrichment/314944 "2022-09-22T12:35:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hamza\_Khalid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hamza_khalid/32/103313_2.png) [@Hamza\_Khalid](https://discuss.elastic.co/u/Hamza_Khalid)\
**Post date:** [September 22, 2022, 12:35pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-for-data-enrichment/314944/1 "2022-09-22T12:35:27Z")

</div>

i have indexed 2 tables from mysql to elasticsearch:  
**user\_index:**  
{  
id : 1,  
name : user\_name,  
hobbies : 1,2  
}

**hobbies\_index:**  
{  
id : 1,  
name : hobby1  
}  
id : 2,  
name : hobby2  
}

i want to enrich my document as users being parent and hobbies being its child using elasticsearch filter plugin for logstash and get the output like this:

{  
id : 1,  
name : user\_name,  
hobbies : 1,2  
hobbies\_name : hobby1, hobby2  
}

**My config file**

```
input {
elasticsearch {
hosts => "hostname"  
index => "user_index*"
query => '{ "query": { "match_all": { } } }'
scroll => "5m"
docinfo => true
}
}

filter {
elasticsearch {
hosts => "hostname"
index => "hobbies_index"

query => "id:%{id}"
fields => { "name" => "hobbies_name" }
}  
}
output {
elasticsearch {
  hosts => ["hostname"]
  index => "test"
}

```

How do i correctly do this? please help i'm a newbie.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 20, 2022, 12:35pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-for-data-enrichment/314944/2 "2022-10-20T12:35:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.