# Enrich processor limitations **URL:** \ **Category:** Kibana\ **Created:** [January 13, 2022, 3:01pm UTC](https://discuss.elastic.co/t/enrich-processor-limitations/294295 "2022-01-13T15:01:35Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Janujc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/janujc/32/77336_2.png) [@Janujc](https://discuss.elastic.co/u/Janujc)\ **Post date:** [January 13, 2022, 3:01pm UTC](https://discuss.elastic.co/t/enrich-processor-limitations/294295/1 "2022-01-13T15:01:36Z")
Hey, I'm working with **enrich processor** to add data from my already existing logs to the ones that are being ingested. What makes it challenging is the fact that the logs that are the »source« of information are also continuously arriving in my index. In my current problem, I have _»process start «_ logs that signal the start of some process. After that process starts many _»events«_ can occur. _The process start log_ has certain information which I need to add to all the _»event logs«_ that are related to it and happen after. The picture below may make the situation a bit clearer (info field needs to be added to all event documents). ![enrich_processor](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dcea5294d6c853ab06effaf49ce51b893269b124.png) From my experience with the enrich processor, you can only add fields from the documents that are located in the enrich index. Enrich index has to be built each time a new »process start« log arrives for it to have up-to-date data which can be then used to enrich ingested documents. There is no mechanism to do that automatically, so I'd have to trigger it externally, and even then it might miss some events that arrive just after the _process start log_. Is it possible to enrich logs from a source index that can be changed more dynamically (or is automatically updated)? Is there a mechanism that would allow querying of the normal index and then retrieving the »information source« document from it? I could see transforms as a possible solution to this problem but I still haven't figured out how to make it work (if it's even possible). Basically, to just copy the whole _»event«_ document while adding information from the »process start« log. Any suggestions are greatly appreciated. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 13, 2022, 3:14pm UTC](https://discuss.elastic.co/t/enrich-processor-limitations/294295/2 "2022-01-13T15:14:55Z")
The enrich processor can only query the `.enrich-*` index, it is not possible to use any other index for it. The enrich processor works best with static data or data that does not change often, if your source data has frequently updates, then you will need to keep recreating the enrich index manually or automate it, which it is not ideal. How are you indexing the data? If you are using Logstash, than you can use the translate filter or memcached filter to create a more dynamically way of enrich. ---
**Author:** ![Janujc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/janujc/32/77336_2.png) [@Janujc](https://discuss.elastic.co/u/Janujc)\ **Post date:** [January 13, 2022, 3:28pm UTC](https://discuss.elastic.co/t/enrich-processor-limitations/294295/3 "2022-01-13T15:28:47Z")
I understand, enrich processor might be a dead-end then. We're currently not using Logstash and I would prefer if I can avoid adding it for just this thing. Are there any other options I could try out? Something that doesn't require adding any new components. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 13, 2022, 3:33pm UTC](https://discuss.elastic.co/t/enrich-processor-limitations/294295/4 "2022-01-13T15:33:26Z")
Unfortunately nothing that I'm aware of, the way to do enrichments using Elasticsearch ingest pipelines is through the enrich processor, which is still limited for some cases. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 10, 2022, 3:33pm UTC](https://discuss.elastic.co/t/enrich-processor-limitations/294295/5 "2022-02-10T15:33:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.