How to filter for field with value NULL?


I get some json logs which I ingest via logstash (json filter plugin).
The current version of the logs is setting null values for some json fields.
In Kibana's json view for an event it looks like this:


How can I filter on details.OUT.Quittungnachricht to search for values which are null?
Can you tell me how to do it via filter and how to do it via query?

Thanks a lot,

Use the exists query to find field with missing values.

Create a filter using exists operator

Then negate the filter after its created by clicking exclude results.

thanks. Strange thing, I thought I tried it before, but now it is working.

BUT filtering just by clicking the + / - in discovery panel does not work, if value is null.
It throws exceptions.

I created an issue at github:

Thanks for creating the issue

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.