Further refactoring back to keyword return type

Author: MattAlp

modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/NetworkDirectionProcessor.java

@@ -29,11 +29,6 @@ public class NetworkDirectionProcessor extends AbstractProcessor {
 
     public static final String TYPE = "network_direction";
 
-    public static final String DIRECTION_INTERNAL = "internal";
-    public static final String DIRECTION_EXTERNAL = "external";
-    public static final String DIRECTION_INBOUND = "inbound";
-    public static final String DIRECTION_OUTBOUND = "outbound";
-
     private final String sourceIpField;
     private final String destinationIpField;
     private final String targetField;
@@ -126,16 +121,7 @@ private String getDirection(IngestDocument d) throws Exception {
         boolean sourceInternal = NetworkDirectionUtils.isInternal(networks, sourceIpAddrString);
         boolean destinationInternal = NetworkDirectionUtils.isInternal(networks, destIpAddrString);
 
-        if (sourceInternal && destinationInternal) {
-            return DIRECTION_INTERNAL;
-        }
-        if (sourceInternal) {
-            return DIRECTION_OUTBOUND;
-        }
-        if (destinationInternal) {
-            return DIRECTION_INBOUND;
-        }
-        return DIRECTION_EXTERNAL;
+        return NetworkDirectionUtils.getDirection(sourceInternal, destinationInternal);
     }
 
     @Override

server/src/main/java/org/elasticsearch/common/network/NetworkDirectionUtils.java

@@ -30,6 +30,11 @@ public class NetworkDirectionUtils {
     private static final String PRIVATE_NAMED_NETWORK = "private";
     private static final String PUBLIC_NAMED_NETWORK = "public";
 
+    public static final String DIRECTION_INTERNAL = "internal";
+    public static final String DIRECTION_EXTERNAL = "external";
+    public static final String DIRECTION_INBOUND = "inbound";
+    public static final String DIRECTION_OUTBOUND = "outbound";
+
     public static boolean isInternal(List<String> networks, String ip) {
         for (String network : networks) {
             if (inNetwork(InetAddresses.forString(ip), network)) {
@@ -54,6 +59,19 @@ public static boolean inNetwork(InetAddress address, String network) {
         };
     }
 
+    public static String getDirection(boolean sourceInternal, boolean destinationInternal) {
+        if (sourceInternal && destinationInternal) {
+            return DIRECTION_INTERNAL;
+        }
+        if (sourceInternal) {
+            return DIRECTION_OUTBOUND;
+        }
+        if (destinationInternal) {
+            return DIRECTION_INBOUND;
+        }
+        return DIRECTION_EXTERNAL;
+    }
+
     private static boolean isLoopback(InetAddress ip) {
         return ip.isLoopbackAddress();
     }

x-pack/plugin/esql/src/main/generated/org/elasticsearch/xpack/esql/expression/function/scalar/ip/NetworkDirectionEvaluator.java

@@ -50,7 +50,7 @@ public class NetworkDirection extends EsqlScalarFunction {
     private final Expression internalNetworks;
 
     @FunctionInfo(
-        returnType = "boolean",
+        returnType = "keyword",
         description = "Returns true if the direction of the source-to-destination-IPs is determined to be inbound, provided a list of internal networks.",
         examples = @Example(file = "ip", tag = "cdirMatchMultipleArgs") // TODO make an example
     )
@@ -126,7 +126,7 @@ public EvalOperator.ExpressionEvaluator.Factory toEvaluator(ToEvaluator toEvalua
     }
 
     @Evaluator
-    static boolean process(@Fixed(includeInToString=false, scope=THREAD_LOCAL) BytesRef scratch, BytesRef sourceIp, BytesRef destinationIp, @Position int position, BytesRefBlock internalNetworks) {
+    static BytesRef process(@Fixed(includeInToString=false, scope=THREAD_LOCAL) BytesRef scratch, BytesRef sourceIp, BytesRef destinationIp, @Position int position, BytesRefBlock internalNetworks) {
         // Pulling the bytes out directly using InetAddress.getByAddress() requires error handling TODO
         InetAddress sourceIpAddress = InetAddresses.forString(sourceIp.utf8ToString());
         InetAddress destinationIpAddress = InetAddresses.forString(destinationIp.utf8ToString());
@@ -149,14 +149,11 @@ static boolean process(@Fixed(includeInToString=false, scope=THREAD_LOCAL) Bytes
             }
         }
 
-        if (sourceInternal == false) {
-            return destinationInternal;
-        }
-        return false;
+        return new BytesRef(NetworkDirectionUtils.getDirection(sourceInternal, destinationInternal));
     }
 
     @Override
     public DataType dataType() {
-        return DataType.BOOLEAN;
+        return DataType.KEYWORD;
     }
 }

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/ip/NetworkDirection.java

@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+package org.elasticsearch.xpack.esql.expression.function.scalar.ip;
+
+import org.elasticsearch.xpack.esql.core.expression.Expression;
+import org.elasticsearch.xpack.esql.core.tree.Source;
+import org.elasticsearch.xpack.esql.expression.function.AbstractScalarFunctionTestCase;
+
+import java.util.List;
+
+public class NetworkDirectionTests extends AbstractScalarFunctionTestCase {
+    @Override
+    protected Expression build(Source source, List<Expression> args) {
+        return null;
+    }
+}