Searching array for empty string causes tab lockup and shows garbage

[nisow95612]

Hello.
I have a keyword field in elastic. I index arrays of string into it.
I usually search with KQL like field: value and it works.
But how I search for empty string?

I tried field:, but that gives Search Error.
I tried field: "", but that makes kibana tab lock up.

[nisow95612]

Oh. After an hour it finished, but it show garbage like x<mark></mark><<mark></mark>m<mark></mark>a<mark></mark>r<mark></mark>k<mark></mark>><mark></mark><<mark></mark>/<mark></mark>m<mark></mark>a<mark></mark>r<mark></mark>k<mark></mark>><mark></mark><<mark>...

[cheshirecat (Krzysztof Smaga)]

Something like this? Query for an empty string.

[nisow95612]

My field is keyword type, so by that topic field: "" should work.

Er. It does not give error, but I wouldn't say it works:

Changed topic title to question why it causes tab lockup and much later show garbage.

[nisow95612]

Found it. I think its kibana bug.

Create index like this:

PUT /lab_1
{
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 0
  },
  "mappings": {
    "properties": {
      "trigger": {
        "type": "keyword"
      },
      "@timestamp": {
        "type": "date"
      }
    }
  }
}

Index two documents in it:

POST /lab_1/_doc/
{
  "trigger": [ "", "", "xyz" ],
  "@timestamp": "2022-08-08"
}

POST /lab_1/_doc/
{
  "trigger": [ "", "", "", "xyz" ],
  "@timestamp": "2022-08-08"
}

Create kibana index pattern for lab_* and search it for trigger: "".

First document will show like (empty), (empty), x<mark></mark>y<mark></mark>z
Second document will show like (empty), (empty), (empty), x<mark></mark><<mark></mark>m<mark></mark>a<mark></mark>r<mark></mark>k<mark></mark>><mark></mark><<mark></mark>/<mark></mark>m<mark></mark>a<mark></mark>r<mark></mark>k<mark></mark>><mark></mark>y<mark></mark><<mark></mark>m<mark></mark>a<mark></mark>r<mark></mark>k<mark></mark>><mark></mark><<mark></mark>/<mark></mark>m<mark></mark>a<mark></mark>r<mark></mark>k<mark></mark>><mark></mark>z

Can somebody please test this and report to github? I can't. Microsoft doesn't like my e-mail host.