# Enrichment via Elasticsearch Lookup

**URL:** <https://discuss.elastic.co/t/enrichment-via-elasticsearch-lookup/301295>\
**Category:** Logstash\
**Created:** [April 1, 2022, 9:08am UTC](https://discuss.elastic.co/t/enrichment-via-elasticsearch-lookup/301295 "2022-04-01T09:08:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shinobu](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@shinobu](https://discuss.elastic.co/u/shinobu)\
**Post date:** [April 1, 2022, 9:08am UTC](https://discuss.elastic.co/t/enrichment-via-elasticsearch-lookup/301295/1 "2022-04-01T09:08:59Z")

</div>

Hello,  
I tried to enrich alerting information with data from a logindex.

In Logstash I configured the following as a filter:

```auto
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "logfile"
    query => "Hostname:%{test_host} and ClientIP:172.18.0.0/14"    
    fields => { "Hostname" => "lookedupHostname" }
    result_size => 1
    enable_sort => false
  }

```

When I tried the Query in Kibana Discover I got the expected results, but the enrichment plugin fails to lookup information based on the query. It appears to struggle with the cidr notation for some reason.

When I remove the ClientIP part from the query it successfully resolves the lookup. The result here looks different than I would expect. The variable "test\_host" and the value in the created lookup "lookedupHostname" would be the same, since I specified to store the lookedup field, but they are different.

Any ideas what the issues are and how to resolve them?  
Thank you in advance.

---

<div class="post-metadata">

**Author:** ![shinobu](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@shinobu](https://discuss.elastic.co/u/shinobu)\
**Post date:** [April 1, 2022, 10:37am UTC](https://discuss.elastic.co/t/enrichment-via-elasticsearch-lookup/301295/2 "2022-04-01T10:37:05Z")

</div>

It appears that the query does not matter. No matter what parameter I use for the lookup, it always returns the same result.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2022, 10:38am UTC](https://discuss.elastic.co/t/enrichment-via-elasticsearch-lookup/301295/3 "2022-04-29T10:38:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.