# Enrich policy query option seems mis-documented

**URL:** <https://discuss.elastic.co/t/enrich-policy-query-option-seems-mis-documented/225362>\
**Category:** Elasticsearch\
**Created:** [March 27, 2020, 8:45am UTC](https://discuss.elastic.co/t/enrich-policy-query-option-seems-mis-documented/225362 "2020-03-27T08:45:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nemhods](https://avatars.discourse-cdn.com/v4/letter/n/48db29/32.png) [@nemhods](https://discuss.elastic.co/u/nemhods)\
**Post date:** [March 27, 2020, 8:45am UTC](https://discuss.elastic.co/t/enrich-policy-query-option-seems-mis-documented/225362/1 "2020-03-27T08:45:12Z")

</div>

Hi!

The documentation of the enrich policy definition ([Enrich policy definition | Elasticsearch Guide [7.16] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.x/enrich-policy-definition.html)) says that we're able to change the query _type_ through the "query" setting:

> (Optional, string) Query type used to filter documents in the enrich index for matching. Valid value is [`match_all`](https://www.elastic.co/guide/en/elasticsearch/reference/7.x/query-dsl-match-all-query.html) (default).

I've made the observation that this setting indeed expects a query object, and strings don't work:

```auto
    PUT _enrich/policy/asset-host-tags
    {
        "match": {
            "indices": ["assets"],
            "match_field": "host.name",
            "enrich_fields": ["tags"],
            "query": {
              "exists": {
                "field": "host.name"
              }
            }
        }
    }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2020, 8:45am UTC](https://discuss.elastic.co/t/enrich-policy-query-option-seems-mis-documented/225362/2 "2020-04-24T08:45:23Z")

</div>

Closed on April 24, 2020, 8:45am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.