Filter Kibana for a field in doc that does not exist in all douments

[sanjaysubramanian]

Lets say I have 5 docs in my BANDS index.

Doc [1]
{
"score" : 100,
"band" : "Cream",
"genre" : "Blues"
}

Doc [2]
{
"score" : 90,
"band" : "Beatles",
"genre" : "Pop"
}

Doc [3]
{
"score" : 99,
"band" : "Eric Clapton",
"genre" : "Blues"
}

Doc [4]
{
"score" : 91,
"band" : "Tungsten"
}

Doc [5]
{
"score" : 91,
"band" : "Cosmic Journey"
}

Now I want to search (using a filter on the Kibana web console) for docs in which the field "genre" does not exist. I expect two docs in the result set. How do I do that ?

Doc [4]
{
"score" : 91,
"band" : "Tungsten"
}

Doc [5]
{
"score" : 91,
"band" : "Cosmic Journey"
}

[flash1293 (Joe Reuter)]

You can do that by putting an "exists" clause in the "must_not" part of a bool query:

{ "query": {
    "bool": {
      "must": [],
      "filter": [],
      "should": [],
      "must_not": [
        {
          "exists": {
            "field": "genre"
          }
        }
      ]
    }
  }
}

[sanjaysubramanian]

Thanks @flash1293 Joe Reuter
I could send in the query you proposed via Postman to hit ElasticSearch.
However I also tried the following in the search textbox on the Kibana Web console

not genre:* and that gave me the docs that do not contain the genre key in the doc

[flash1293 (Joe Reuter)]

Hi @sanjaysubramanian,

I thought you were talking about the dev console, but it seems you mean the search bar on top of Discover/Visualize/Dashboard? If it is set to KQL, then not genre:* is indeed the right way to do this. For Lucene, you can use _exists_:genre

[sanjaysubramanian]

@flash1293
Hi Joe
Apologies for the confusion. Yes the search bar on the top of Kibana Discover
Thank you for confirming my answer
warmly
sanjay