mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-06-29 09:54:06 -04:00
1256a49c3a
This copies the first line of the description of each command to just under the syntax so that it's "in order", before the `Parameters` section. That way if you are reading from top to bottom you see: ``` syntax short description parameter names and descriptions long description examples ``` I've also removed the `Description` section entirely if the description was just one sentence. So in some cases that just isn't `long description`.
62 lines
1.6 KiB
Text
62 lines
1.6 KiB
Text
[discrete]
|
|
[[esql-dissect]]
|
|
=== `DISSECT`
|
|
|
|
`DISSECT` enables you to <<esql-process-data-with-dissect-and-grok,extract
|
|
structured data out of a string>>.
|
|
|
|
**Syntax**
|
|
|
|
[source,esql]
|
|
----
|
|
DISSECT input "pattern" [APPEND_SEPARATOR="<separator>"]
|
|
----
|
|
|
|
*Parameters*
|
|
|
|
`input`::
|
|
The column that contains the string you want to structure. If the column has
|
|
multiple values, `DISSECT` will process each value.
|
|
|
|
`pattern`::
|
|
A <<esql-dissect-patterns,dissect pattern>>.
|
|
|
|
`<separator>`::
|
|
A string used as the separator between appended values, when using the <<esql-append-modifier,append modifier>>.
|
|
|
|
*Description*
|
|
|
|
`DISSECT` enables you to <<esql-process-data-with-dissect-and-grok,extract
|
|
structured data out of a string>>. `DISSECT` matches the string against a
|
|
delimiter-based pattern, and extracts the specified keys as columns.
|
|
|
|
Refer to <<esql-process-data-with-dissect>> for the syntax of dissect patterns.
|
|
|
|
*Examples*
|
|
|
|
// tag::examples[]
|
|
The following example parses a string that contains a timestamp, some text, and
|
|
an IP address:
|
|
|
|
[source.merge.styled,esql]
|
|
----
|
|
include::{esql-specs}/docs.csv-spec[tag=basicDissect]
|
|
----
|
|
[%header.monospaced.styled,format=dsv,separator=|]
|
|
|===
|
|
include::{esql-specs}/docs.csv-spec[tag=basicDissect-result]
|
|
|===
|
|
|
|
By default, `DISSECT` outputs keyword string columns. To convert to another
|
|
type, use <<esql-type-conversion-functions>>:
|
|
|
|
[source.merge.styled,esql]
|
|
----
|
|
include::{esql-specs}/docs.csv-spec[tag=dissectWithToDatetime]
|
|
----
|
|
[%header.monospaced.styled,format=dsv,separator=|]
|
|
|===
|
|
include::{esql-specs}/docs.csv-spec[tag=dissectWithToDatetime-result]
|
|
|===
|
|
|
|
// end::examples[]
|