# Filter documents if a field exists and report on the value of that field

**URL:** <https://discuss.elastic.co/t/filter-documents-if-a-field-exists-and-report-on-the-value-of-that-field/75653>\
**Category:** Kibana\
**Created:** [February 20, 2017, 12:10am UTC](https://discuss.elastic.co/t/filter-documents-if-a-field-exists-and-report-on-the-value-of-that-field/75653 "2017-02-20T00:10:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Matt\_Simcox](https://avatars.discourse-cdn.com/v4/letter/m/c77e96/32.png) [@Matt\_Simcox](https://discuss.elastic.co/u/Matt_Simcox)\
**Post date:** [February 20, 2017, 12:10am UTC](https://discuss.elastic.co/t/filter-documents-if-a-field-exists-and-report-on-the-value-of-that-field/75653/1 "2017-02-20T00:10:39Z")

</div>

Hi,

I have documents that may or may not contain certain fields in ES. I need to create a visualisation in kibana that restricts to only documents that:

1. Contain a particular field.
2. Report on the value of that field over time.

An example of the document is below:

The fields or relevance are:

```
"PURCHASE": 1,
"LOADED": 3,
"BILLS": 2,

```

The values of these fields over time change per document, but the fields might not always be present.

I've found the _exists_:PURCHASE style syntax so I can restrict only to PURCHASE, however it returns how many documents the PURCHASE tag appears in not the value.

If possible I'd also like to combine these into a line graph to compare the changing values of these fields over time.

I'm struggling to find an example of how to do this.

{  
"\_index": "index-2017.02.16",  
"\_type": "restart\_log",  
"\_id": "AVpY1KMb8AbTx8cdxH9I",  
"\_score": null,  
"\_source": {  
"offset": 812,  
"input\_type": "log",  
"source": "C:\logs\restarts.log",  
"message": "2017-02-17\_09:18:20.587,BILLS=2,PURCHASE=1,LOADED=3",  
"type": "switch\_restart\_log",  
"tags": [  
"beats\_input\_codec\_plain\_applied"  
],  
"PURCHASE": 1,  
"LOADED": 3,  
"BILLS": 2,  
"@timestamp": "2017-02-16T22:18:20.587Z",  
"@version": "1",  
"beat": {  
"hostname": "sydwpayapp04",  
"name": "sydwpayapp04",  
"version": "5.0.1"  
},  
"host": "sydwpayapp04",  
"poolStats": "BILLS=2,PURCHASE=1,LOADED=3",  
"time": "2017-02-17\_09:18:20.587"  
},  
"fields": {  
"@timestamp": [  
1487283500587  
]  
},  
"sort": [  
1487283500587  
]  
}

Regards,

Matt

---

<div class="post-metadata">

**Author:** ![Matt\_Simcox](https://avatars.discourse-cdn.com/v4/letter/m/c77e96/32.png) [@Matt\_Simcox](https://discuss.elastic.co/u/Matt_Simcox)\
**Post date:** [February 20, 2017, 12:30am UTC](https://discuss.elastic.co/t/filter-documents-if-a-field-exists-and-report-on-the-value-of-that-field/75653/2 "2017-02-20T00:30:59Z")

</div>

In typical me fashion I work it out 10 minutes after posting. Just in case it helps anyone out there:

I filtered with:

_exists_:BILLPAY OR _exists_:LOADMONEY OR _exists_:PURCHASE

which restricted down to only the documents I needed and then added the three metrics to the Y axis on a line graph visualisation.

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [February 20, 2017, 11:08am UTC](https://discuss.elastic.co/t/filter-documents-if-a-field-exists-and-report-on-the-value-of-that-field/75653/3 "2017-02-20T11:08:33Z")

</div>

Thanks for sharing your solution, @Matt_Simcox! This might be useful to other users that have the same question.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2017, 11:08am UTC](https://discuss.elastic.co/t/filter-documents-if-a-field-exists-and-report-on-the-value-of-that-field/75653/4 "2017-03-20T11:08:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.