opensearch-project / opensearch-project/data-prepper

[Feature]Enrich ingest pipeline functionality

Open
#3,167 7 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement question
Dominant language
Java
Stars
374
Forks
354
Avg merge
3d 18h
Merged PRs (30d)
8

Description

Is your feature request related to a problem? Please describe.
We want to build a SIEM based on opensearch. So we ingest a ton of data, but that data needs to be expanded based on data from i.e. our CMDB or personnel records. This makes correlation and deciding on threat impact a lot easier.

Elastic has the enrich ingest pipeline processor to do something like this: https://www.elastic.co/guide/en/elasticsearch/reference/7.17/ingest-enriching-data.html

Describe the solution you'd like
Implement something similar to what Elastic has so data can be enriched at ingest time based on source indexes that will be kept up to date.

Describe alternatives you've considered
I can script this out, do this in a logstash pipeline, but then I need to implement it many times. The ingest pipelines seem to be the best solution.

Additional context
none

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked Elastic enrich ingest pipeline documentation and the existing ingest pipeline functionality in Data Prepper. Define how source indexes, lookup updates, matching, and enrichment should work at ingest time, then compare the design with the stated CMDB and personnel-record use cases. Done means an agreed implementation scope and behavior for enriching incoming data from maintained source indexes.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, data-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.