Search for a non empty field

Hi,

For each event I collect on logstash, I add a field called "tags" that always exists, and contains an array that may be empty.
On kibana, I want to search for events that do not contain an empty array. I tried with

_exists_:tags

but the results do not seem correct. Can someone please tell me how to search for empty and for non empty fields, for null and non null fields, depending on the field type (e.g., string, array)? I searched the documentation but did not find a direct answer.

Thanks

How is your tags field mapped? Documents where tags = [] should not match that query.

https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-exists-query.html

1 Like

I must have had some errors somewhere, I checked and using on kibana _exists_:tags and !_exists_:tags provides the correct results, even though the tags field is never null.

Thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.