Cannot use “OR” with “NOT _exists_” in Kibana 6.8.0 search bar

问题

I am trying to create one query in the Kibana search bar to retrieve some specific documents. The goal is to get the documents that either have the field "myDate" before 2019-10-08 or "myDate" does not exist. I have documents that meet one or the other condition.

I started by creating this query :

    myDate:<=2019-10-08 OR NOT _exists_:myDate

But no documents were returned.

Since it did not work, I tried some other ways i found online :

    myDate:<=2019-10-08 OR NOT (_exists_:myDate)
    myDate:<=2019-10-08 OR !(_exists_:myDate)
    myDate:<=2019-10-08 OR NOT (myDate:*)

But still, no results.

When I use either "part" of the "OR" condition, it works perfectly : I get either the documents who have myDate<=2019-10-08 or the ones that do not have a "myDate" field filled.

But when I try with both conditions, I get no document.

I have to use only the search bar to find these documents, neither an elasticsearch rest query nor by using kibana filters.

Thank you for your help :)

回答1:

Below query works. Use Inspect button in kibana to see what query is actually being fired and make sure you are using correct index pattern as well.

(myDate:<=2019-12-31) OR (NOT _exists_:myDate)

Take a look at Query DSL documentation for Boolean operators for more better understanding with different use cases

来源：https://stackoverflow.com/questions/58286243/cannot-use-or-with-not-exists-in-kibana-6-8-0-search-bar