DISSECT

Syntax
DISSECT input "pattern" [APPEND_SEPARATOR="<separator>"]
Parameters
input
The column that contains the string you want to structure.  If the column has
multiple values, DISSECT will process each value.
pattern
A dissect pattern.
<separator>
A string used as the separator between appended values, when using the append modifier.
DescriptionDISSECT enables you to extract
structured data out of a string. DISSECT matches the string against a
delimiter-based pattern, and extracts the specified keys as columns.Refer to Process data with DISSECT for the syntax of dissect patterns.ExamplesThe following example parses a string that contains a timestamp, some text, and
an IP address:
```esql
ROW a = "2023-01-23T12:15:00.000Z - some text - 127.0.0.1"
| DISSECT a "%{date} - %{msg} - %{ip}"
| KEEP date, msg, ip
```

By default, DISSECT outputs keyword string columns. To convert to another
type, use Type conversion functions:
```esql
ROW a = "2023-01-23T12:15:00.000Z - some text - 127.0.0.1"
| DISSECT a "%{date} - %{msg} - %{ip}"
| KEEP date, msg, ip
| EVAL date = TO_DATETIME(date)
```
