Use ES|QL parsing when your logs contain useful information inside a single message field and you need answers before an ingest pipeline or mapping change is ready. DISSECT is a good first choice for predictable delimiter-based strings.
FROM logs-*
| WHERE message LIKE "*checkout*"
| DISSECT message """%{service} %{level} %{request_id} %{duration_ms}ms %{details}"""
| EVAL duration_ms = TO_LONG(duration_ms)
| WHERE duration_ms > 500
| KEEP @timestamp, service, level, request_id, duration_ms, details
| SORT duration_ms DESC
| LIMIT 25Why this ES|QL pattern helps
Query-time parsing is useful during incident response, data exploration, and migration work. It lets you test the value of a field extraction before you commit to a permanent ingest pipeline. DISSECT is usually easier and faster for stable log formats, while GROK is better when the pattern needs regular expressions.
What to change for your data
- Replace
logs-*with the data stream or index that contains the raw message field. - Adapt the
DISSECTpattern to the exact order and separators in your log messages. - Use conversion functions such as
TO_LONGorTO_DATETIMEwhen extracted values should be treated as numbers or dates.
When to use it
This pattern is helpful for Elastic Observability troubleshooting, temporary field extraction, log format discovery, and support questions about parsing with ES|QL instead of changing Logstash or ingest pipelines immediately.
Source reference: Elastic documentation: ES|QL DISSECT command.