Query for an empty string?

Elastic Stack Kibana
1

I am trying to query for an empty string and am having little luck. I have a set of logs with the field 'CharacterId', some of which have a value and others that do not. [http://i.imgur.com/xMmxKFZ.png]Here is an example.(http://i.imgur.com/xMmxKFZ.png). Basically I need to differentiate between the two for visualization purposes but am unable to filter them in this manner. I have tried:

  • CharacterId:""
  • CharacterId: " "
  • -CharacterId:""
  • "CharacterId:"""
  • CharacterId:[]
  • CharacterId:
  • _exists_:CharacterId
  • !(_exists_:CharacterId)

Any tips on how to filter by this field being empty or not?

1 Like
2

Hi @rthompson,

in order to be able to perform that kind of query, the field has to be indexed as the keyword type. Otherwise it would be analyzed by Elasticsearch's full-text analyzer, which tokenizes the string, and therefore makes queries for whitespace impossible. For fields of type keyword the query field:"" should match all documents with an empty string in that field.

4 Likes
3

Thanks @weltenwort! Querying by keyword allows me to filter them appropriately:

  • CharacterId.keyword:""
  • !(CharacterId.keyword:"")
2 Likes
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.