Match an empty field in kibana

Elastic Stack Kibana
1

Hi I am trying to query kibana for empty value i.e. in the scenario where the field is present but the value sent is empty.
I used the operator "is" and matched it with different values such as ''/'*' but that returns 0 results.

1 Like
2

For a field called "title":

In lucene: -_exists_:title

In KQL not title:*

5 Likes
3

Hi Matt, thank you for your answer. I am trying to create dashboard in kibana and I want list of events where field was sent with an empty value.
So the options that I have is something as below
Filter by "field name" + Operator = 'is','is not','is one of','is not one of','exist','does not exist' + Value =
The issue that I have is I don't have value to / or not to match.
I am not using "Query DSL".

4

Ah I see, you're trying to create a filter not a query. What do you mean exactly when you say the field was sent with an empty value? Does the field not exist at all in the source doc? Does it have an empty string? A null value? does not exist should work if the field does not exist in the doc at all.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.