Function rewrite_from 

pub fn rewrite_from(query: &str, pattern: &str) -> String

Rewrite an ES|QL query’s source to pattern, used when --index or --data-view is given. A leading FROM <source> becomes FROM <pattern> with any | … pipeline kept; ROW/SHOW/METRICS pass through untouched; a query with no source command gets FROM <pattern> prepended.