Docs and CSV test, singular

Author: MattAlp

docs/reference/query-languages/esql/_snippets/functions/description/network_direction.md

@@ -181,25 +181,6 @@ eth0           |gamma          |fe80::cae2:65ff:fece:feb9
 eth0           |epsilon        |[fe80::cae2:65ff:fece:feb9, fe80::cae2:65ff:fece:fec0, fe80::cae2:65ff:fece:fec1]|fe80::cae2:65ff:fece:fec1|fe80::cae2:65ff:fece:fec1
 ;
 
-networkDirectionSimple
-
-FROM hosts |
-WHERE mv_count(ip0) == 1 AND mv_count(ip1) == 1 |
-EVAL direction = network_direction(ip0, ip1, ["loopback"]) |
-KEEP ip0, ip1, direction
-;
-
-
-ip0:ip                    | ip1:ip                    | direction:keyword
-127.0.0.1                 | 127.0.0.1                 | internal
-::1                       | ::1                       | internal
-127.0.0.1                 | ::1                       | internal
-127.0.0.1                 | 127.0.0.2                 | internal
-127.0.0.1                 | 128.0.0.1                 | outbound
-fe80::cae2:65ff:fece:feb9 | fe81::cae2:65ff:fece:feb9 | external
-fe80::cae2:65ff:fece:feb9 | 127.0.0.3                 | inbound
-;
-
 cidrMatchSimple
 
 from hosts | where cidr_match(ip1, "127.0.0.2/32") | keep card, host, ip0, ip1;
@@ -748,3 +729,26 @@ row ip4 = to_ip("1.2.3.4")
 ip4:ip  | a:ip | b:ip | c:ip
 1.2.3.4 | null | null | null
 ;
+
+networkDirectionSimple
+required_capability: network_direction
+
+// tag::networkDirectionSimple[]
+FROM hosts |
+WHERE mv_count(ip0) == 1 AND mv_count(ip1) == 1 |
+EVAL direction = network_direction(ip0, ip1, ["loopback"]) |
+KEEP ip0, ip1, direction
+// end::networkDirectionSimple[]
+;
+
+// tag::networkDirectionSimple-result[]
+ip0:ip                    | ip1:ip                    | direction:keyword
+127.0.0.1                 | 127.0.0.1                 | internal
+::1                       | ::1                       | internal
+127.0.0.1                 | ::1                       | internal
+127.0.0.1                 | 127.0.0.2                 | internal
+127.0.0.1                 | 128.0.0.1                 | outbound
+fe80::cae2:65ff:fece:feb9 | fe81::cae2:65ff:fece:feb9 | external
+fe80::cae2:65ff:fece:feb9 | 127.0.0.3                 | inbound
+// end::networkDirectionSimple-result[]
+;

docs/reference/query-languages/esql/_snippets/functions/examples/network_direction.md

@@ -36,7 +36,7 @@
 import static org.elasticsearch.compute.ann.Fixed.Scope.THREAD_LOCAL;
 
 /**
- * Returns whether a connection is inbound given a source IP address, destination IP address, and a list of internal networks.
+ * Returns the direction type (inbound, outbound, internal, external) given a source IP address, destination IP address, and a list of internal networks.
  */
 public class NetworkDirection extends EsqlScalarFunction {
     public static final NamedWriteableRegistry.Entry ENTRY = new NamedWriteableRegistry.Entry(
@@ -51,7 +51,7 @@ public class NetworkDirection extends EsqlScalarFunction {
 
     @FunctionInfo(
         returnType = "keyword",
-        description = "Returns true if the direction of the source-to-destination-IPs is determined to be inbound, provided a list of internal networks.",
+        description = "Returns the direction type (inbound, outbound, internal, external) given a source IP address, destination IP address, and a list of internal networks.",
         examples = @Example(file = "ip", tag = "networkDirectionSimple")
     )
     public NetworkDirection(