# DISSECT

The DISSECT command is used to extract structured data from a string. It matches the string against a delimiter-based pattern and extracts the specified keys as columns.

## Syntax

`DISSECT input "pattern" [APPEND_SEPARATOR="<separator>"]`

### Parameters

#### input

The column containing the string you want to structure. If the column has multiple values, DISSECT will process each value.

#### pattern

A dissect pattern. If a field name conflicts with an existing column, the existing column is dropped. If a field name is used more than once, only the rightmost duplicate creates a column.

#### <separator>

A string used as the separator between appended values, when using the append modifier.

## Examples

Extracts the date, message, and IP address from a structured log string and keeps only those fields.

```esql
ROW a = "2023-01-23T12:15:00.000Z - some text - 127.0.0.1"
| DISSECT a """%{date} - %{msg} - %{ip}"""
| KEEP date, msg, ip
```

Parses a log string to extract the date, message, and IP address, then converts the extracted date string to a datetime type.

```esql
ROW a = "2023-01-23T12:15:00.000Z - some text - 127.0.0.1"
| DISSECT a """%{date} - %{msg} - %{ip}"""
| KEEP date, msg, ip
| EVAL date = TO_DATETIME(date)
```