Hello!
I need enrich one index from two another indexes simultaneously. I know how enrich index from one source using ingest pipeline. But I don't find examples for two sources. How I can realize it?
You need to provide more context.
You can use multiple index as the source of an enrich policy, but they need to share the same match_field.
If the match_field needs to be different, then you will need to use two enrich processors.
I need enrich my index successively.
Original index contains IP address, second index contains username (enrich by IP) and third index contains tasks information (enrich by username). How I can do it?
You will need to create two enrich processors, the first one will enrich by IP and the second one will enrich by username, it is the same process, you just change the source index and the match_field
One thing that you need to be aware is that if the data in your source index, any of them, is update frequently, your enrich index will not pick up the updates unless you run an _execute in the enrich policy.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.