# How to enrich query using external lookup or DB table? **URL:** \ **Category:** Elasticsearch\ **Created:** [July 10, 2020, 12:46pm UTC](https://discuss.elastic.co/t/how-to-enrich-query-using-external-lookup-or-db-table/240699 "2020-07-10T12:46:34Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\ **Post date:** [July 10, 2020, 12:46pm UTC](https://discuss.elastic.co/t/how-to-enrich-query-using-external-lookup-or-db-table/240699/1 "2020-07-10T12:46:35Z")
hi I couldn't find a proper example of enriching outcome of a search query using external lookup/DB-table I'm looking for something like.. ```auto | lookup ip within {external lookup file or DB table} | if ip is present, find its corresponding hostname ; else default it to "uknown_host" | print ip, hostname ``` how to achieve this in elasticsearch? PS: I don't want to index the external lookup-file nor DB table to Elastic ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 10, 2020, 12:56pm UTC](https://discuss.elastic.co/t/how-to-enrich-query-using-external-lookup-or-db-table/240699/2 "2020-07-10T12:56:44Z")
I do not think you can do that in Elasticsearch so you would need to do it in the application once the response is returned. ---
**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\ **Post date:** [July 10, 2020, 1:08pm UTC](https://discuss.elastic.co/t/how-to-enrich-query-using-external-lookup-or-db-table/240699/3 "2020-07-10T13:08:55Z")
Couldn't get you. You mean to say we need to write an external application or module to do this? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 10, 2020, 1:20pm UTC](https://discuss.elastic.co/t/how-to-enrich-query-using-external-lookup-or-db-table/240699/4 "2020-07-10T13:20:11Z")
Yes. ---
**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\ **Post date:** [July 10, 2020, 2:15pm UTC](https://discuss.elastic.co/t/how-to-enrich-query-using-external-lookup-or-db-table/240699/5 "2020-07-10T14:15:32Z")
oh, that's a shame. Hopefully someone would have done this? thought such enrichment is available in all big data solution products will raise as a feature request then. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 10, 2020, 3:27pm UTC](https://discuss.elastic.co/t/how-to-enrich-query-using-external-lookup-or-db-table/240699/6 "2020-07-10T15:27:24Z")
Why not doing that at index time instead? If you want to search/display a hostname instead of an IP address, just index that information at index time within the same document and you're done. ---
**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\ **Post date:** [July 10, 2020, 5:06pm UTC](https://discuss.elastic.co/t/how-to-enrich-query-using-external-lookup-or-db-table/240699/7 "2020-07-10T17:06:40Z")
because the data in enrichment is dynamic. it is like a whole cmdb which we don't want to index on daily basis. More-over at the time of indexing, we don't know what all extra elements we require as the stakeholders/use-cases vary. Can I suggest a feature request for implementing a "lookup/enrich" functionality on the fly? thanks in advance ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 10, 2020, 5:33pm UTC](https://discuss.elastic.co/t/how-to-enrich-query-using-external-lookup-or-db-table/240699/8 "2020-07-10T17:33:59Z")
That won't happen IMO. You can solve that in your application as @Christian_Dahlqvist wrote. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 7, 2020, 5:34pm UTC](https://discuss.elastic.co/t/how-to-enrich-query-using-external-lookup-or-db-table/240699/9 "2020-08-07T17:34:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.