# Kibana 7.12.0 add Enrich pipeline

**URL:** <https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796>\
**Category:** Kibana\
**Created:** [August 9, 2021, 11:12am UTC](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796 "2021-08-09T11:12:15Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![zhyp](https://avatars.discourse-cdn.com/v4/letter/z/91b2a8/32.png) [@zhyp](https://discuss.elastic.co/u/zhyp)\
**Post date:** [August 9, 2021, 11:12am UTC](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796/1 "2021-08-09T11:12:15Z")

</div>

Hi,  
I want to calculate the value of a field in index A.

1. Its data comes from two other index fields, index B and index C.

2. Calculation formula: index A.count = index B.count - index C.count.

3. Condition: index A.time = index B.time, index B.time = index C.time.

Can it be achieved? Or any suggestions? 🙂

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [August 9, 2021, 12:38pm UTC](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796/2 "2021-08-09T12:38:17Z")

</div>

Hi  
What's not clear to me is: Are you speaking of 1 index, or are this multiple indices?

Best,  
Matthias

---

<div class="post-metadata">

**Author:** ![zhyp](https://avatars.discourse-cdn.com/v4/letter/z/91b2a8/32.png) [@zhyp](https://discuss.elastic.co/u/zhyp)\
**Post date:** [August 10, 2021, 1:26am UTC](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796/3 "2021-08-10T01:26:06Z")

</div>

Hi  
They are multiple indexes.

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [August 10, 2021, 5:34am UTC](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796/4 "2021-08-10T05:34:35Z")

</div>

For this case you would need to build you own custom tool, merging the data and ingesting it into a new index in Elasticsearch

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [August 10, 2021, 5:37am UTC](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796/5 "2021-08-10T05:37:17Z")

</div>

Oh, maybe you could use the ingest pipeline enrich processor for that:

> **[Enrich processor | Elasticsearch Guide \[master\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/master/enrich-processor.html)**

---

<div class="post-metadata">

**Author:** ![zhyp](https://avatars.discourse-cdn.com/v4/letter/z/91b2a8/32.png) [@zhyp](https://discuss.elastic.co/u/zhyp)\
**Post date:** [August 10, 2021, 8:00am UTC](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796/6 "2021-08-10T08:00:03Z")

</div>

Hi  
Arithmetic operators do not seem to be supported.

---

<div class="post-metadata">

**Author:** ![Felix\_Roessel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felix_roessel/32/41623_2.png) [@Felix\_Roessel](https://discuss.elastic.co/u/Felix_Roessel)\
**Post date:** [August 10, 2021, 11:32am UTC](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796/7 "2021-08-10T11:32:00Z")

</div>

In 7.14 you can achieve this using lens formulas. Any plan to update?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 7, 2021, 11:32am UTC](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796/8 "2021-09-07T11:32:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.