Observability Engineer Lab 4.4: Enrich policy

Elastic Community and Ecosystem Elastic Training
1

Hi,
I was following the lab to enrich the geo city/zip code using the enrich policy creation steps. The city name that showed up for me showed the wrong zip code as the address index contains many states with the same city name. Is there a way to enhance the enrich policy i.e provide a query or multiple match fields?

thanks

2

This is more a limitation of the data we have available in the zip code data. It's not a complete data set at this time. A more robust query would absolutely be beneficial to the enrich policy, it's just that the data supporting such a query isn't complete.

3

So, is there a way to write the enrich policy to match on multiple fields? Can you give an example?
thanks

4

ANy thoughts on the use of multiple fields in an enrich policy?

5

If you mean that you have indexA with field1 and field2 and indexB with field1,field2,field3 and you want to add the field3 values from indexB to indexA whenever both field1 and field2 values coincide, then I would create a new_field that concats the two fields (ie new_field = field1 + field2.

6

Understood! thanks.

7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.