You can do a "join" directly without enrich. Transform source
can take an array of indices or patterns. All you need is a "primary key", so a field that exists in both indices under the same name(if that's not the case you can help yourself with aliases or runtime fields).
In the aggregation part you can copy over the fields you want from your "enrichment index" using either a top_metrics
aggregation or scripted_metric
.
The benefit of the "transform only" approach: An update on either index triggers the update.
Example: Is is possible to partially update a dest doc with transforms? - #4 by Hendrik_Muhs