3

As title, i can't find a way to do it in kibana KQL. I have tried NOT field, it's not work.

Chandler.Huang
  • 873
  • 3
  • 12
  • 24

1 Answers1

3

if your field is a keyword type, the KQL query below will check for existing but empty field values:

fieldname:""

Note that this won't work for a text analysed type

glenacota
  • 2,314
  • 1
  • 11
  • 18