Filter for a minus value in kibana

[smerzlyakov (Stas)]

I try to filter for a "-" in winlog.event_data.SidHistory field (logs from winlogbeat). I have 7.2 ELK Stack.
Filtering with filters from graphical interface simply doesn't work

I try to escape - with \ and it seems, that it works:
NOT winlog.event_data.SidHistory:"-"

But if i add something to query - it doesn't work again:
winlog.event_id:"4738" AND NOT winlog.event_data.SidHistory:"-"

So, why??)

[jbudz (Jon Budzenski)]

Kibana will show "-" for empty or null. If you get a chance to expand the table and click on the JSON tab, can you check what the raw value for the field is? We may be able to use the "is empty" filter.

[smerzlyakov (Stas)]

I check the answer in JSON (Inspect->Response) and it is "-" value.

By the way, i use all possible filters and it still doesn't work. Also i use (Zoom out) icon - so i think it must exclude SidHistory, whatever value it has..

[smerzlyakov (Stas)]

Hello, @jbudz
Do you have any comments?

[smerzlyakov (Stas)]

@elastic, do you have any solution?