How to parse mix json logs

Elastic Stack Logstash
2

You can parse a message like that using

    dissect { mapping => { "message" => "%{ts} %{+ts} | %{restOfLine}" } }
    json { source => "restOfLine" }
    date { match => [ "ts", "ISO8601" ] }

How to query the number of documents that contain a given field is an elasticsearch (or kibana) question, not a logstash question.