Change up some of the CSV tests

Author: MattAlp

docs/reference/query-languages/esql/_snippets/functions/examples/network_direction.md

@@ -733,22 +733,35 @@ ip4:ip  | a:ip | b:ip | c:ip
 networkDirectionSimple
 required_capability: network_direction
 
-// tag::networkDirectionSimple[]
-FROM hosts |
-WHERE mv_count(ip0) == 1 AND mv_count(ip1) == 1 |
-EVAL direction = network_direction(ip0, ip1, ["loopback"]) |
-KEEP ip0, ip1, direction
-// end::networkDirectionSimple[]
+FROM hosts
+| WHERE mv_count(ip0) == 1 AND mv_count(ip1) == 1
+| EVAL direction = network_direction(ip0, ip1, ["loopback"])
+| KEEP ip0, ip1, direction
+| SORT direction
 ;
 
-// tag::networkDirectionSimple-result[]
 ip0:ip                    | ip1:ip                    | direction:keyword
-127.0.0.1                 | 127.0.0.1                 | internal
-::1                       | ::1                       | internal
+fe80::cae2:65ff:fece:feb9 | fe81::cae2:65ff:fece:feb9 | external
+fe80::cae2:65ff:fece:feb9 | 127.0.0.3                 | inbound
 127.0.0.1                 | ::1                       | internal
 127.0.0.1                 | 127.0.0.2                 | internal
+::1                       | ::1                       | internal
+127.0.0.1                 | 127.0.0.1                 | internal
 127.0.0.1                 | 128.0.0.1                 | outbound
-fe80::cae2:65ff:fece:feb9 | fe81::cae2:65ff:fece:feb9 | external
-fe80::cae2:65ff:fece:feb9 | 127.0.0.3                 | inbound
-// end::networkDirectionSimple-result[]
+;
+
+networkDirectionFromRow
+required_capability: network_direction
+
+// tag::networkDirectionFromRow[]
+ROW ip0 = "1.2.3.4"::ip, ip1 = "5.6.7.8"::ip, networks = ["loopback", "private"]
+| EVAL direction = network_direction(ip0, ip1, networks)
+| DROP networks
+// end::networkDirectionFromRow[]
+;
+
+// tag::networkDirectionFromRow-result[]
+ip0:ip  | ip1:ip  | direction:keyword
+1.2.3.4 | 5.6.7.8 | external
+// end::networkDirectionFromRow-result[]
 ;

docs/reference/query-languages/esql/kibana/definition/functions/network_direction.json

@@ -58,7 +58,7 @@ public class NetworkDirection extends EsqlScalarFunction {
     @FunctionInfo(
         returnType = "keyword",
         description = "Returns the direction type (inbound, outbound, internal, external) given a source IP address, destination IP address, and a list of internal networks.",
-        examples = @Example(file = "ip", tag = "networkDirectionSimple")
+        examples = @Example(file = "ip", tag = "networkDirectionFromRow")
     )
     public NetworkDirection(
         Source source,