Where to add a missing filter in this Kibana search

[tbragin (Tanya Bragin)]

I don't completely understand what you're trying to do - could you explain our use case in more detail?

The Missing Filter in Elasticsearch does the opposite of what you described - it returns documents that are missing a specific field.

In general, if you want to use a Missing Filter query DSL in Kibana, you should wrap the filter into a constant_score query. Instead of inserting this into the .kibana index directly, I'd recommend pasting the JSON directly the search bar in Discover and then saving that query using the UI (see screenshot) -- it's much less error prone. You can then examine the object and see its structure in Settings >> Objects, if you wish (see mine below).

{
  "index": "logstash-*",
  "query": {
    "constant_score": {
      "filter": {
        "missing": {
          "field": "bytes"
        }
      }
    }
  },
  "highlight": {
    "pre_tags": [
      "@kibana-highlighted-field@"
    ],
    "post_tags": [
      "@/kibana-highlighted-field@"
    ],
    "fields": {
      "*": {}
    },
    "fragment_size": 2147483647
  },
  "filter": []
}