How to filter for field with value NULL?

Hi,

I get some json logs which I ingest via logstash (json filter plugin).
The current version of the logs is setting null values for some json fields.
In Kibana's json view for an event it looks like this:

image

How can I filter on details.OUT.Quittungnachricht to search for values which are null?
Can you tell me how to do it via filter and how to do it via query?

Thanks a lot,
Andreas

Use the exists query to find field with missing values.

Create a filter using exists operator

Then negate the filter after its created by clicking exclude results.

1 Like

thanks. Strange thing, I thought I tried it before, but now it is working.

BUT filtering just by clicking the + / - in discovery panel does not work, if value is null.
It throws exceptions.

I created an issue at github: https://github.com/elastic/kibana/issues/44357

Thanks for creating the issue

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.