Troubleshooting log enrichment

Issue 1 symptom

The enrichment_audit field is not added to collected logs.


The criteria configured in enrichment policy does not match the logs.

Issue 2 symptom

Enrichment is not added to logs.


Check the enrichment_audit field in logs and check the status added to the field. For information about these status, see Creating enrichment policies.

Issue 3 symptom

Partial enrichment is added to logs


Ensure that the connection with the endpoint URL that you have configured to connect to the enrichment source is successful

Was this page helpful? Yes No Submitting... Thank you