diff --git a/docs/reference/esql/esql-enrich-data.asciidoc b/docs/reference/esql/esql-enrich-data.asciidoc index ad34e29f1a55b..9325dcef12f40 100644 --- a/docs/reference/esql/esql-enrich-data.asciidoc +++ b/docs/reference/esql/esql-enrich-data.asciidoc @@ -15,6 +15,15 @@ For example, you can use `ENRICH` to: * Add product information to retail orders based on product IDs * Supplement contact information based on an email address +<> is similar to <> in the fact that they both help you join data together. You should use `ENRICH` when: + +* Enrichment data doesn't change frequently +* You can accept index-time overhead +* You are working with structured enrichment patterns +* You can accept having multiple matches combined into multi-values +* You can accept being limited to predefined match fields +* `ENRICH` has a simplified security model. There are no restrictions to specific enrich policies or document and field level security. + [discrete] [[esql-how-enrich-works]] ==== How the `ENRICH` command works