From a0acecdf48d06d246c135604f89db52a59dd196f Mon Sep 17 00:00:00 2001 From: Alexander Spies Date: Mon, 24 Mar 2025 13:52:02 +0100 Subject: [PATCH] Add ENRICH vs LOOKUP JOIN to ENRICH docs This was initially part of https://github.com/elastic/elasticsearch/pull/124531 but got lost during the manual backport. --- docs/reference/esql/esql-enrich-data.asciidoc | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docs/reference/esql/esql-enrich-data.asciidoc b/docs/reference/esql/esql-enrich-data.asciidoc index ad34e29f1a55b..9325dcef12f40 100644 --- a/docs/reference/esql/esql-enrich-data.asciidoc +++ b/docs/reference/esql/esql-enrich-data.asciidoc @@ -15,6 +15,15 @@ For example, you can use `ENRICH` to: * Add product information to retail orders based on product IDs * Supplement contact information based on an email address +<> is similar to <> in the fact that they both help you join data together. You should use `ENRICH` when: + +* Enrichment data doesn't change frequently +* You can accept index-time overhead +* You are working with structured enrichment patterns +* You can accept having multiple matches combined into multi-values +* You can accept being limited to predefined match fields +* `ENRICH` has a simplified security model. There are no restrictions to specific enrich policies or document and field level security. + [discrete] [[esql-how-enrich-works]] ==== How the `ENRICH` command works