How to do “where not exists” type filtering in Kibana/ELK?

Question

I am using ELK to create dashboards from my log files. I have a log file with entries that contain an id value and a \"success\"/\"failure\" value, displaying whether an operati

Answer 1

! (_exists_:NAME) is not working for me. I use suggestion from:

https://discuss.elastic.co/t/kibana-5-0-0--missing--is-not-working-anymore/64336

NOT _exists_:NAME

UPDATE The problem I faced is that ES syntax forbids spaces after negation operators. Use one of:

NOT _exists_:FIELD
!_exists_:FIELD
-_exists_:FIELD

Check tutorial: https://www.timroes.de/2016/05/29/elasticsearch-kibana-queries-in-depth-tutorial/

---

NOTE: In Elasticsearch 7.x, Kibana now has a pull down to select KQL or Lucene style queries in the search bar. Be mindful that syntax such as _exists_:FIELD is a Lucene syntax and you need to set the pulldown accordingly.