# Filter for a minus value in kibana

**URL:** <https://discuss.elastic.co/t/filter-for-a-minus-value-in-kibana/201652>\
**Category:** Kibana\
**Created:** [September 30, 2019, 1:51pm UTC](https://discuss.elastic.co/t/filter-for-a-minus-value-in-kibana/201652 "2019-09-30T13:51:47Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![smerzlyakov](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\
**Post date:** [September 30, 2019, 1:51pm UTC](https://discuss.elastic.co/t/filter-for-a-minus-value-in-kibana/201652/1 "2019-09-30T13:51:47Z")

</div>

I try to filter for a "-" in winlog.event\_data.SidHistory field (logs from winlogbeat). I have 7.2 ELK Stack.  
Filtering with filters from graphical interface simply doesn't work

 ![00](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6ebcddc8b7630e946c66d59da7004d6a849549c7.png)  
I try to escape - with \ and it seems, that it works:  
NOT winlog.event\_data.SidHistory:"-"  
 ![30](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b4a1393dfdbf2d7e5188d30639562a7633839255.png)  
But if i add something to query - it doesn't work again:  
winlog.event\_id:"4738" AND NOT winlog.event\_data.SidHistory:"-"  
 ![19](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1a1ebd52e55b9f0ea58d876f46ab237e4ed2404e.png)  
So, why??)

---

<div class="post-metadata">

**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\
**Post date:** [September 30, 2019, 9:19pm UTC](https://discuss.elastic.co/t/filter-for-a-minus-value-in-kibana/201652/2 "2019-09-30T21:19:14Z")

</div>

Kibana will show "-" for empty or null. If you get a chance to expand the table and click on the JSON tab, can you check what the raw value for the field is? We may be able to use the "is empty" filter.

---

<div class="post-metadata">

**Author:** ![smerzlyakov](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\
**Post date:** [October 1, 2019, 8:13am UTC](https://discuss.elastic.co/t/filter-for-a-minus-value-in-kibana/201652/3 "2019-10-01T08:13:48Z")

</div>

I check the answer in JSON (Inspect-\>Response) and it is "-" value.  
 ![03](https://us1.discourse-cdn.com/elastic/original/3X/1/b/1bc82a0e1996b1788128d35ca7dd2299cb808570.png)  
By the way, i use all possible filters and it still doesn't work. Also i use (Zoom out) icon - so i think it must exclude SidHistory, whatever value it has..

 ![37](https://us1.discourse-cdn.com/elastic/original/3X/7/0/70ba6919d0975221b09b729861343e63fde20bba.png)

---

<div class="post-metadata">

**Author:** ![smerzlyakov](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\
**Post date:** [October 2, 2019, 5:08pm UTC](https://discuss.elastic.co/t/filter-for-a-minus-value-in-kibana/201652/4 "2019-10-02T17:08:06Z")

</div>

Hello, @jbudz  
Do you have any comments?

---

<div class="post-metadata">

**Author:** ![smerzlyakov](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\
**Post date:** [October 10, 2019, 9:58am UTC](https://discuss.elastic.co/t/filter-for-a-minus-value-in-kibana/201652/5 "2019-10-10T09:58:59Z")

</div>

@elastic, do you have any solution?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2019, 9:59am UTC](https://discuss.elastic.co/t/filter-for-a-minus-value-in-kibana/201652/6 "2019-11-07T09:59:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.