Test functions without an index using ROW
ROW builds an in-memory row: ideal for validating a DISSECT pattern, a conversion, or a CIDR_MATCH before applying it to millions of documents.
Prerequisites
Elasticsearch 8.12+, Kibana
SQL
ROW ip = "203.0.113.42",
message = "user=jdoe action=login result=ok"
| EVAL est_interne = CIDR_MATCH(TO_IP(ip), "10.0.0.0/8", "192.168.0.0/16")
| DISSECT message "user=%{utilisateur} action=%{action} result=%{resultat}"
| EVAL action_maj = TO_UPPER(action)
| KEEP ip, est_interne, utilisateur, action_maj, resultatResult
ip | est_interne | utilisateur | action_maj | resultat -------------+-------------+-------------+------------+--------- 203.0.113.42 | false | jdoe | LOGIN | ok 1 ligne en 0.018 s — motif DISSECT valide, pret pour le vrai index
ROWPrototypageDebugDISSECT