Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fdataprime%2Flanguage-reference%2Fcommands-reference%2Fenrich.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fdataprime%2Flanguage-reference%2Fcommands-reference%2Fenrich.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# `enrich`

## Description

The `enrich` command adds contextual information to logs by performing lookups against a custom enrichment table. It merges additional columns from the lookup into each log document based on a matching key.

This is particularly useful for attaching static metadata (like user details, service mappings, or IP ownership) to incoming logs without modifying upstream systems. The enrichment is applied **at query time**, meaning you always work with the most recent version of the enrichment table.

Each lookup table must be created and uploaded beforehand as a **Custom Enrichment**. For setup and management instructions, see [Custom Enrichment](https://docs-docusaurus.kinsta.page/user-guides/enrichment_rules/custom_enrichment/.md).

Note

* All values in a lookup table are stored as strings. Use conversion

functions such as `toNumber()` or `toTimestamp()` if a different type is required.

* If a log already contains the enriched key, `enrich` will merge or update

only the matching sub-keys; unrelated fields remain unchanged.

## Syntax

```
enrich <value_to_lookup> into <enriched_key> using <lookup_table>
```

## Example

**Use case: Attach employee information to a user ID**

Suppose your logs contain user IDs, and you maintain an external lookup table with user details such as name and department. You can use `enrich` to join this contextual data dynamically into your logs, enabling richer queries and more meaningful analysis.

**Lookup table (\`my\_users\`):**

| ID  | Name  | Department |
| --- | ----- | ---------- |
| 111 | John  | Finance    |
| 222 | Emily | IT         |

### Example data

```
{ "userid": "111" },

{ "userid": "222" }
```

### Example query

```
enrich userid into user_enriched using my_users
```

### Example output

```
{

    "userid": "111",

    "user_enriched": {

    "ID": "111",

    "Name": "John",

    "Department": "Finance"

    }

},

{

    "userid": "222",

    "user_enriched": {

    "ID": "222",

    "Name": "Emily",

    "Department": "IT"

    }

}
```

The `enrich` command performs a lookup in `my_users` based on the `userid` value and attaches the corresponding data as a nested object under `user_enriched`. This approach ensures logs always reflect the latest lookup information without altering the source data.