# Enrich processor is sometimes not enriching

**URL:** <https://discuss.elastic.co/t/enrich-processor-is-sometimes-not-enriching/321188>\
**Category:** Elasticsearch\
**Tags:** ingest-pipeline\
**Created:** [December 14, 2022, 7:42am UTC](https://discuss.elastic.co/t/enrich-processor-is-sometimes-not-enriching/321188 "2022-12-14T07:42:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![siginigin](https://avatars.discourse-cdn.com/v4/letter/s/4bbf92/32.png) [@siginigin](https://discuss.elastic.co/u/siginigin)\
**Post date:** [December 14, 2022, 7:42am UTC](https://discuss.elastic.co/t/enrich-processor-is-sometimes-not-enriching/321188/1 "2022-12-14T07:42:30Z")

</div>

Hi,

I have pipeline with enrich processor for user enriching and another pipeline with enrich processor for vulnerability enriching. Both pipelines are in parent logs\_syslog pipeline.

I noticed some events are not enriched.  
In case of user enrichment I have following policy:

```auto
{
  "match": {
    "indices": "ldap",
    "match_field": "user.sam_account_name",
    "enrich_fields": [
      "user.cn", 
      "user.description", 
      "user.object_sid", 
      "user.group", 
      "user.mail",
      "user.principal_name",
      "fingerprint"
    ]
  }
}

```

Sometimes lot of enrich\_fields are missing, for example there is only group added, sometimes no fields, even if the user has all fields and other events are enriched successfully.

In case of vulnerability I have following policy:

```auto
{
  "match": {
    "indices": "latest_vulnerabilities",
    "match_field": "server.ip",
    "enrich_fields": [
      "vulnerability.severity_num.max"
    ]
  }
}

```

Enrich pipeline contains processors for enriching source.ip and destination.ip. In the result, specific source or destination ip is sometimes enriched, sometimes not.

So I think this is pretty simple setup.

I check the enrichment index and it seems it has all relevant data. Testing with \_simulate is same, sometimes it returns data, sometimes it doesn't.

I noticed when I POST \_execute to policy, I'm able to see the data with "Test pipeline", but after a while (2-3 tests) it will again disappear.

What can be reason of such behavior?

Thank you for help.

---

<div class="post-metadata">

**Author:** ![Keith\_Massey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/keith_massey/32/83666_2.png) [@Keith\_Massey](https://discuss.elastic.co/u/Keith_Massey)\
**Post date:** [December 16, 2022, 2:06pm UTC](https://discuss.elastic.co/t/enrich-processor-is-sometimes-not-enriching/321188/2 "2022-12-16T14:06:55Z")

</div>

That sounds odd. You say you can reproduce this with the \_simulate API -- is it possible to post everything you need in order to do that? I'd like to try to reproduce it.  
Also, are there any error messages or stack traces in your Elasticsearch logs?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 13, 2023, 2:07pm UTC](https://discuss.elastic.co/t/enrich-processor-is-sometimes-not-enriching/321188/3 "2023-01-13T14:07:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.