# Observability Engineer Lab 4.4: Enrich policy

**URL:** <https://discuss.elastic.co/t/observability-engineer-lab-4-4-enrich-policy/279536>\
**Category:** Elastic Training\
**Created:** [July 24, 2021, 3:22pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-4-4-enrich-policy/279536 "2021-07-24T15:22:56Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![StashLogs](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@StashLogs](https://discuss.elastic.co/u/StashLogs)\
**Post date:** [July 24, 2021, 3:22pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-4-4-enrich-policy/279536/1 "2021-07-24T15:22:56Z")

</div>

Hi,  
I was following the lab to enrich the geo city/zip code using the enrich policy creation steps. The city name that showed up for me showed the wrong zip code as the address index contains many states with the same city name. Is there a way to enhance the enrich policy i.e provide a query or multiple match fields?

thanks

---

<div class="post-metadata">

**Author:** ![dinyes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dinyes/32/42906_2.png) [@dinyes](https://discuss.elastic.co/u/dinyes)\
**Post date:** [July 26, 2021, 1:58pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-4-4-enrich-policy/279536/2 "2021-07-26T13:58:37Z")

</div>

This is more a limitation of the data we have available in the zip code data. It's not a complete data set at this time. A more robust query would absolutely be beneficial to the enrich policy, it's just that the data supporting such a query isn't complete.

---

<div class="post-metadata">

**Author:** ![StashLogs](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@StashLogs](https://discuss.elastic.co/u/StashLogs)\
**Post date:** [July 26, 2021, 5:23pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-4-4-enrich-policy/279536/3 "2021-07-26T17:23:15Z")

</div>

So, is there a way to write the enrich policy to match on multiple fields? Can you give an example?  
thanks

---

<div class="post-metadata">

**Author:** ![StashLogs](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@StashLogs](https://discuss.elastic.co/u/StashLogs)\
**Post date:** [July 29, 2021, 9:03pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-4-4-enrich-policy/279536/4 "2021-07-29T21:03:03Z")

</div>

ANy thoughts on the use of multiple fields in an enrich policy?

---

<div class="post-metadata">

**Author:** ![mimitsu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mimitsu/32/63074_2.png) [@mimitsu](https://discuss.elastic.co/u/mimitsu)\
**Post date:** [July 29, 2021, 9:25pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-4-4-enrich-policy/279536/5 "2021-07-29T21:25:20Z")

</div>

If you mean that you have `indexA` with `field1` and `field2` and `indexB` with `field1`,`field2`,`field3` and you want to add the `field3` values from `indexB` to `indexA` whenever both `field1` and `field2` values coincide, then I would create a `new_field` that concats the two fields (ie `new_field = field1 + field2`.

---

<div class="post-metadata">

**Author:** ![StashLogs](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@StashLogs](https://discuss.elastic.co/u/StashLogs)\
**Post date:** [July 29, 2021, 9:38pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-4-4-enrich-policy/279536/6 "2021-07-29T21:38:51Z")

</div>

Understood! thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 28, 2021, 9:39pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-4-4-enrich-policy/279536/7 "2021-08-28T21:39:43Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.