User Problem:

In ES|QL, users can add full strings to a WHERE clause, but this is limited when dealing with unstructured data (e.g., logs). Users often need to select specific parts of a message field rather than the entire string to refine their query. Without this functionality, users must manually extract and edit the desired text, slowing down their workflow.

This is how it works today where it is possible:

Describe the feature:

[NEEDS DESIGN CHECK]

Enable users to select part of a message field within a cell in Discover. Upon selection, a pop-over menu should appear with options to:

•	Add the selected text to the ES|QL query as a WHERE clause.
•	Apply a GROK pattern for parsing unstructured data.

This will significantly enhance usability when working with complex logs or messages, allowing for more efficient data parsing and querying.