Need to know which filter is useful in my case?

Elastic Stack Elasticsearch
1

Hi Experts,

I have logs and most of them have "baseId" filed in it . But some logs don't have this field at all .I want to search those logs which does not have baseid in it . So out of exist , Missing filter , which will be the best option and why ?

Thanks
VG

2

IIRC missing will be removed.

So a bool query with a must not clause and exist query should work well.

3

so something like

{ "filter" : {"bool" : {"must_not" : {"exists":{"field":"baseEventIds"}}}}}

So I will be using must_not as I want those logs which must not have baseEventids field in it ?

4

You don't need the filter part. Depending on the context that might be a post_filter which isn't really what you want (probably).

If you are in 1.x you'd do a filtered query I believe.