OpenSearch Enrichment Processor

Is your feature request related to a problem? Please describe.

Some users have use-cases which require querying an OpenSearch cluster to update and enrich events.

Data Prepper could provide a processor plugin which updates Events based on data from OpenSearch.

Describe the solution you'd like

Create a new processor - opensearch_enrichment. For each event passing through the processor, it queries OpenSearch for an existing document. It can then set fields in the Event from the document found.

A pipeline author can configure the processor with the following major options:

• OpenSearch cluster connection configurations
• A query (or possibly part of a query)
• A mechanism for mapping field values from the OpenSearch document into the Data Prepper event.

Configurations should use naming conventions similar to the existing opensearch sink plugin.

Describe alternatives you've considered (Optional)

Can stateful aggregation handle these use-cases?

Additional context

I created this ticket based on interest expressed in https://github.com/opensearch-project/OpenSearch/issues/1976.

Start by reviewing the existing opensearch sink plugin and the processor plugin entry points. Clarify the connection settings, query form, and event-to-document field mapping before implementation. Done means the new opensearch_enrichment processor can query OpenSearch for each event and update event fields from a matching document.