I get some json logs which I ingest via logstash (json filter plugin).
The current version of the logs is setting null values for some json fields.
In Kibana's json view for an event it looks like this:
How can I filter on details.OUT.Quittungnachricht to search for values which are null?
Can you tell me how to do it via filter and how to do it via query?
Thanks a lot,
Use the exists query to find field with missing values.
Create a filter using
Then negate the filter after its created by clicking
thanks. Strange thing, I thought I tried it before, but now it is working.
BUT filtering just by clicking the + / - in discovery panel does not work, if value is null.
It throws exceptions.
I created an issue at github: https://github.com/elastic/kibana/issues/44357
Thanks for creating the issue
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.