kibanakibana-5kibana-7

How to find filed exist but empty in kibana KQL?


As title, i can't find a way to do it in kibana KQL. I have tried NOT field, it's not work.


Solution

  • if your field is a keyword type, the KQL query below will check for existing but empty field values:

    fieldname:""

    Note that this won't work for a text analysed type