Browse Source

ESQL: Add ENRICH vs LOOKUP JOIN to ENRICH docs (#125489)

This was initially part of
https://github.com/elastic/elasticsearch/pull/124531 but got lost during
the manual backport.
Alexander Spies 6 months ago
parent
commit
9293f35533
1 changed files with 9 additions and 0 deletions
  1. 9 0
      docs/reference/esql/esql-enrich-data.asciidoc

+ 9 - 0
docs/reference/esql/esql-enrich-data.asciidoc

@@ -15,6 +15,15 @@ For example, you can use `ENRICH` to:
 * Add product information to retail orders based on product IDs
 * Supplement contact information based on an email address
 
+<<esql-enrich>> is similar to <<esql-lookup-join,LOOKUP join>> in the fact that they both help you join data together. You should use `ENRICH` when:
+
+* Enrichment data doesn't change frequently
+* You can accept index-time overhead
+* You are working with structured enrichment patterns
+* You can accept having multiple matches combined into multi-values
+* You can accept being limited to predefined match fields
+* `ENRICH` has a simplified security model. There are no restrictions to specific enrich policies or document and field level security.
+
 [discrete]
 [[esql-how-enrich-works]]
 ==== How the `ENRICH` command works