# Errors with a "does not exist" query

**URL:** <https://discuss.elastic.co/t/errors-with-a-does-not-exist-query/282846>\
**Category:** Kibana\
**Created:** [August 30, 2021, 6:15pm UTC](https://discuss.elastic.co/t/errors-with-a-does-not-exist-query/282846 "2021-08-30T18:15:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![variable](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/variable/32/118277_2.png) [@variable](https://discuss.elastic.co/u/variable)\
**Post date:** [August 30, 2021, 6:15pm UTC](https://discuss.elastic.co/t/errors-with-a-does-not-exist-query/282846/1 "2021-08-30T18:15:48Z")

</div>

I am trying to determine if this is a bug before opening an Issue.

I am trying to create a query to return results when a field does not have any data.

These work and return results (but not what I'm looking for):

```auto
event.category:process and process.name:"rundll32.exe"
event.category:process and process.name:"rundll32.exe" and process.args:*
event.category:process and process.name:"rundll32.exe" and process.args_count>1
process.name:"rundll32.exe" and not process.args:*

```

I want to query when a process with a process name of `rundll32.exe` **doesn't have** any process arguments.

I've tried the following to only return processes but get an error each time:

```auto
event.category:process and process.name:"rundll32.exe" and not process.args:*
event.category:process and process.name:"rundll32.exe" and process.args_count<1

```

The error I get is:

```auto
Expected end of input but "n" found. process.name:"rundll32.exe" not process.args:* ----------------------------^

```

I have even tried to use a filter (`process.args` with a `does not exist` operator), same error.

This only appears to occur with the `logs-*` index pattern. The `winlogbeat-*` index pattern returns the expected results.

| Kibana Version | Platform | Data Source | Version |
| --- | --- | --- | --- |
| 7.14.0 | Elastic Cloud | Winlogbeat & Elastic Agent (w/Window int.) | 7.14.0 |

**Logs-\* (results, but not filtered to process)**  
`process.name:"rundll32.exe" and not process.args:*`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/c/1c0f718da77461b351ddfc71a51609613012c0ce.png)

**Logs-\* (error, trying to only return processes)**  
`event.category:process and process.name:"rundll32.exe" and not process.args:*`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/c/bcdbb4925c6dd2cc3c43673779e64f95e886454d.png)

**Winlogbeat (expected results, same query as Elastic Agent error)**  
`event.category:process and process.name:"rundll32.exe" and not process.args:*`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/b/8bc9b15b18c9a1bb9bd56d670fc7b12fea7e7e41.jpeg)

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [August 31, 2021, 6:40pm UTC](https://discuss.elastic.co/t/errors-with-a-does-not-exist-query/282846/2 "2021-08-31T18:40:17Z")

</div>

Hmm it looks like your error is coming from a query where you forgot to include "and" before "not".

Could you give this a try again?

```auto
event.category:process and process.name:"rundll32.exe" and not process.args:*

```

And see one more time if you get the same error about "expected end of input..."

---

<div class="post-metadata">

**Author:** ![variable](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/variable/32/118277_2.png) [@variable](https://discuss.elastic.co/u/variable)\
**Post date:** [August 31, 2021, 7:07pm UTC](https://discuss.elastic.co/t/errors-with-a-does-not-exist-query/282846/3 "2021-08-31T19:07:47Z")

</div>

> [@](#):
>
> I've tried the following to only return processes but get an error each time:
> 
> ```auto
> event.category:process and process.name:"rundll32.exe" and not process.args:*
> 
> ```

> [@](#):
>
> _Logs- (error, trying to only return processes)_\*  
> `event.category:process and process.name:"rundll32.exe" and not process.args:*`

I really don't understand...we have the same query that was getting errors yesterday - but now...not.

```auto
event.category:process and process.name:"rundll32.exe" and not process.args:*

```

I guess I'll just mark this as solved. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 28, 2021, 7:08pm UTC](https://discuss.elastic.co/t/errors-with-a-does-not-exist-query/282846/4 "2021-09-28T19:08:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.