Query field doesn't exist or have a special value

Elastic Stack Elasticsearch
1

Hello,

I'm using ELK 6.8.2.

I have a set of data where the field "system" can either have a value or doesn't exist at all.

The queries NOT _exists_: system and system: value works fine. However, as soon as I try to combine them at a single query NOT _exists_: system OR system: value, ES returns 0 results.

What's wrong with the query and how can I get the desired results?

2

When using multiple boolean operators, it's a good idea to use parentheses as these operators do not honor the usual precedence rules. Try writing your query like this:

(NOT _exists_: system) OR (system: value)
3

Thanks, it works!