opensearch-project / opensearch-project/data-prepper

Support event enrichment from S3 query in a new processor

Open
#5,986 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Java
Stars
374
Forks
354
Avg merge
3d 18h
Merged PRs (30d)
8

Description

Is your feature request related to a problem? Please describe.
After the ML batch inference job completes, the Data Prepper pipeline merges the inference results with source data to generate complete documents for AOS index ingestion, as demonstrated below in the Bedrock example with its input, output, and merged format structures.

Image

Describe the solution you'd like
To make a general solution that covers more cases and extensible to future use cases, a new processor “Event Enricher” is proposed in this design, which enables correlation and enrichment of events by searching and combining data from multiple sources, primarily OpenSearch and Amazon S3 in the first release. This processor is particularly useful for scenarios where you need to merge related events or enrich current events with historical data.

A common use case is enriching ML batch inferencing results with their original inputs. For example, when processing Ml batch job output files (identified by a .out suffix) from S3, the processor can automatically locate the corresponding input file using the configured source path prefix and merge the data based on a correlation field (like recordId).

The processor also supports searching OpenSearch indices using either simple query strings or more complex query templates (DSL format) to find and merge related events. This is valuable for scenarios like calculating duration between start/end events or enriching current events with historical context. This functionality and use case refers to the newly released filer plugin in ElasticSearch. https://www.elastic.co/docs/reference/logstash/plugins/plugins-filters-elasticsearch

Describe alternatives you've considered (Optional)
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read the ML batch inference pull request #5507 and the Bedrock example first to understand the stated enrichment use case. Then clarify the Event Enricher scope for S3 queries, correlation fields, source-path matching, and merged output; done should cover the described S3 enrichment scenario and leave the broader OpenSearch support defined.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
backend, data
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.