# Update enrich index from logstash

**URL:** <https://discuss.elastic.co/t/update-enrich-index-from-logstash/312378>\
**Category:** Logstash\
**Created:** [August 18, 2022, 11:36am UTC](https://discuss.elastic.co/t/update-enrich-index-from-logstash/312378 "2022-08-18T11:36:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chapmantrain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chapmantrain/32/22646_2.png) [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\
**Post date:** [August 18, 2022, 11:36am UTC](https://discuss.elastic.co/t/update-enrich-index-from-logstash/312378/1 "2022-08-18T11:36:10Z")

</div>

I have a logstash jdbc pull that updates an index of device information at hourly intervals. That index is used by an enrich processor to add the device information, like sector, country, lat/long, to the data we ingest from those devices, like syslog data. I believe I need to execute an \_execute on the enrichment policy after each update but I do not think I can do that from logstash. My solution has been to set a crontab to fire a **PUT /\_enrich/policy/my-policy/\_execute** just after the logstash pull executes. Is that the proper solution or is there another way?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 18, 2022, 1:22pm UTC](https://discuss.elastic.co/t/update-enrich-index-from-logstash/312378/2 "2022-08-18T13:22:34Z")

</div>

I think that's the only way.

Once you update the source index for an enrich policy, the new `.enrich-*` index with the updated data will only be created after you run the `_execute` on your policy.

There is still nothing in Elasticsearch or Kibana that would allow you to automate this, so using a external request is the only solution, in your case your crontab job.

There is this old [feature request](https://github.com/elastic/elasticsearch/issues/50071) asking for the implementation of some kind of way to schedule the execution of enrich policies.

---

<div class="post-metadata">

**Author:** ![chapmantrain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chapmantrain/32/22646_2.png) [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\
**Post date:** [August 18, 2022, 4:12pm UTC](https://discuss.elastic.co/t/update-enrich-index-from-logstash/312378/3 "2022-08-18T16:12:22Z")

</div>

OK. Thanks for the quick response Leandro.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 15, 2022, 4:13pm UTC](https://discuss.elastic.co/t/update-enrich-index-from-logstash/312378/4 "2022-09-15T16:13:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.