Kv: empty field is saved

[Adam_Szabo]

I have a log source which has messages where the fields are in the fieldName='fieldValue' format.

I use the kv filter to parse it, and trim it by the apostrophes.

I noticed, however, that the empty fields are saved to Elasticsearch.
For example a field like authLevel=''
is saved as "authLevel": ""

As far as I know, empty values are not saved in Elaticsearch.
(And for another log source of mine it works fine and empty values are not saved. However, there I use Grok.)

If a field has no values, how is it stored in an inverted index?

That’s a trick question, because the answer is: it isn’t stored at all.
Dealing with Null Values | Elasticsearch: The Definitive Guide [2.x] | Elastic

This is the kv filter I use:
kv {
exclude_keys => [ "transferId" ]
trim_value => "'"
}

Why are the empty fields saved if I use kv?

[magnusbaeck (Magnus Bäck)]

This is more of an Elasticsearch question so you might get better answers in that group.

I think you are comparing apples to oranges. The documented you referenced talks about how different field values are represented in ES's inverted index, but you seem to expect that the fields won't be included in the documents when you later retrieve them. That's not the case. You'll retrieve the documents as you stored them.