# Enrich index from two sources

**URL:** <https://discuss.elastic.co/t/enrich-index-from-two-sources/318846>\
**Category:** Kibana\
**Tags:** ingest-pipeline\
**Created:** [November 14, 2022, 9:43am UTC](https://discuss.elastic.co/t/enrich-index-from-two-sources/318846 "2022-11-14T09:43:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kmz161](https://avatars.discourse-cdn.com/v4/letter/k/838e76/32.png) [@kmz161](https://discuss.elastic.co/u/kmz161)\
**Post date:** [November 14, 2022, 9:43am UTC](https://discuss.elastic.co/t/enrich-index-from-two-sources/318846/1 "2022-11-14T09:43:20Z")

</div>

Hello!

I need enrich one index from two another indexes simultaneously. I know how enrich index from one source using ingest pipeline. But I don't find examples for two sources. How I can realize it?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 14, 2022, 12:31pm UTC](https://discuss.elastic.co/t/enrich-index-from-two-sources/318846/2 "2022-11-14T12:31:08Z")

</div>

You need to provide more context.

You can use multiple index as the source of an [enrich policy](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest-enriching-data.html#how-enrich-works), but they need to share the same `match_field`.

If the `match_field` needs to be different, then you will need to use two enrich processors.

---

<div class="post-metadata">

**Author:** ![kmz161](https://avatars.discourse-cdn.com/v4/letter/k/838e76/32.png) [@kmz161](https://discuss.elastic.co/u/kmz161)\
**Post date:** [November 14, 2022, 1:09pm UTC](https://discuss.elastic.co/t/enrich-index-from-two-sources/318846/3 "2022-11-14T13:09:19Z")

</div>

I need enrich my index successively.  
Original index contains IP address, second index contains username (enrich by IP) and third index contains tasks information (enrich by username). How I can do it?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 14, 2022, 1:27pm UTC](https://discuss.elastic.co/t/enrich-index-from-two-sources/318846/4 "2022-11-14T13:27:05Z")

</div>

> [@kmz161](#):
>
> I know how enrich index from one source using ingest pipeline

You will need to create two enrich processors, the first one will enrich by IP and the second one will enrich by username, it is the same process, you just change the source index and the match\_field

One thing that you need to be aware is that if the data in your source index, any of them, is update frequently, your enrich index will not pick up the updates unless you run an `_execute` in the enrich policy.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2022, 12:06pm UTC](https://discuss.elastic.co/t/enrich-index-from-two-sources/318846/5 "2022-12-12T12:06:10Z")

</div>



---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 9, 2023, 12:06pm UTC](https://discuss.elastic.co/t/enrich-index-from-two-sources/318846/6 "2023-01-09T12:06:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.