# \[Suggestion\] Runtime fields and enriching

**URL:** <https://discuss.elastic.co/t/suggestion-runtime-fields-and-enriching/272402>\
**Category:** Elasticsearch\
**Tags:** runtime-fields\
**Created:** [May 7, 2021, 10:13am UTC](https://discuss.elastic.co/t/suggestion-runtime-fields-and-enriching/272402 "2021-05-07T10:13:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nemhods](https://avatars.discourse-cdn.com/v4/letter/n/48db29/32.png) [@nemhods](https://discuss.elastic.co/u/nemhods)\
**Post date:** [May 7, 2021, 10:13am UTC](https://discuss.elastic.co/t/suggestion-runtime-fields-and-enriching/272402/1 "2021-05-07T10:13:27Z")

</div>

Hey,

I've been playing around with runtime fields, and the feature is looking promising.

Something that's not possible right now, but I think would be very helpful:  
The ability to use enrich policies with runtime fields. For example, I have an enrich policy that translates IPs to internal subnet names. It would be great to be able to apply this ad-hoc to any index that has internal IPs, using runtime fields.

This would come close to run-time joining of data using native Elasticsearch features, and would bring more feature parity with query languages like Splunks SPL or Microsofts Kusto.

Maybe more generically, the runtime fields feature could be extended to support applying any ingest processor at runtime, without having to reindex?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 10, 2021, 1:03am UTC](https://discuss.elastic.co/t/suggestion-runtime-fields-and-enriching/272402/2 "2021-05-10T01:03:26Z")

</div>

Thanks heaps for trying the feature out, and doubly so for providing the feedback!

I will pass this on, but I would also encourage you to create a GitHub issue with this, as that's more likely to get comments from the Product and Eng teams 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2021, 1:04am UTC](https://discuss.elastic.co/t/suggestion-runtime-fields-and-enriching/272402/3 "2021-06-07T01:04:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.