Searching for null value in kibana

[venkatkumar229 (Venkat Kumar)]

Hi Team,

I am trying to search a field with null value which is inside a list.

my search filed data ex:

doc 1:
"response": {"AttrList":[{},{"Id":"DUE_DATE","value":"10.05.2021"}]}

doc2:
"response": {"AttrList":[{},{"Id":"DUE_DATE","value":""}]}

I want to search in kibana where the "DUE_DATE" is not having any value. I have tried like below. But it is giving me all the documents with and without date field. I need to get only doc2. Can someone please help me in searching.

query which i have tried:
response: "\{\"Id\":\"DUE_DATE\"\,\"value\":\"\"\}"

[LizaD (Liza Dayoub)]

Hi @venkatkumar229, try using exists query, in this case does not exist, here is some documentation: Exists query | Elasticsearch Guide [7.14] | Elastic

[venkatkumar229 (Venkat Kumar)]

Hi Liza,

I have tried as you mentioned in KQL but it's not giving me any result. Could you please help me with the exact query.

i have tried like below:
response: "\{\"Id\":\"DUE_DATE\"\,_exists_:\"value\":\"\"\}"

[LizaD (Liza Dayoub)]

Hi @venkatkumar229,

Here are some examples: 1) if you are using KQL which is the Kibana search box, you can use something like this: not DUE_DATE:* or 2) you can add a filter in Kibana NOT DUE_DATE: "exists" or 3) In Elasticsearch Query DSL ```
GET /_search
{
"query": {
"bool": {
"must_not": {
"exists": {
"field": "DUE_DATE"
}
}
}
}
}

[venkatkumar229 (Venkat Kumar)]

Hi Lisa,

Thanks for the response. The above query is giving me the records where I don't have DUE_DATE attribute instead of giving me DUE_DATE records with empty value.

I have tried something like this in the kibana search bar and it is giving me the records where DUE_DATE is empty like below.

"response": {"AttrList":[{},{"Id":"DUE_DATE","value":""}]}

Query I tried:
response:"{\"Id\":\"DUE_DATE\",\"value\":\"*\"}"