# How to filter for field with value NULL?

**URL:** https://discuss.elastic.co/t/how-to-filter-for-field-with-value-null/197079
**Category:** Kibana
**Created:** [August 28, 2019, 9:56am UTC](https://discuss.elastic.co/t/how-to-filter-for-field-with-value-null/197079 "2019-08-28T09:56:53Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [August 28, 2019, 9:56am UTC](https://discuss.elastic.co/t/how-to-filter-for-field-with-value-null/197079/1 "2019-08-28T09:56:53Z")

</div>

Hi,

I get some json logs which I ingest via logstash (json filter plugin).  
The current version of the logs is setting null values for some json fields.  
In Kibana's json view for an event it looks like this:

![image](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5e2997a13951c4a6ba55b670a7d10261533b2165.png)

How can I filter on details.OUT.Quittungnachricht to search for values which are **null**?  
Can you tell me how to do it via filter and how to do it via query?

Thanks a lot,  
Andreas

---

<div class="post-metadata">

### Author: ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)
#### Post date: [August 28, 2019, 5:50pm UTC](https://discuss.elastic.co/t/how-to-filter-for-field-with-value-null/197079/2 "2019-08-28T17:50:22Z")

</div>

Use the [exists](https://www.elastic.co/guide/en/elasticsearch/reference/7.x/query-dsl-exists-query.html) query to find field with missing values.

Create a filter using `exists` operator

 ![54%20AM](https://us1.discourse-cdn.com/elastic/original/3X/7/9/7972b7a16628e130c3bbd1df3d61fe6e5fba9e57.png)

Then negate the filter after its created by clicking `exclude results`.

 ![00%20AM](https://us1.discourse-cdn.com/elastic/original/3X/0/6/0610a8ccf9d2f1703d97aec6363df11202083136.png)

---

<div class="post-metadata">

### Author: ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [August 29, 2019, 7:06am UTC](https://discuss.elastic.co/t/how-to-filter-for-field-with-value-null/197079/3 "2019-08-29T07:06:43Z")

</div>

thanks. Strange thing, I thought I tried it before, but now it is working.

**BUT** filtering just by clicking the + / - in discovery panel does not work, if value is null.  
It throws exceptions.

I created an issue at github: [https://github.com/elastic/kibana/issues/44357](https://github.com/elastic/kibana/issues/44357)

---

<div class="post-metadata">

### Author: ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)
#### Post date: [August 29, 2019, 1:24pm UTC](https://discuss.elastic.co/t/how-to-filter-for-field-with-value-null/197079/4 "2019-08-29T13:24:07Z")

</div>

Thanks for creating the issue

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 26, 2019, 1:24pm UTC](https://discuss.elastic.co/t/how-to-filter-for-field-with-value-null/197079/5 "2019-09-26T13:24:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.