9

How do I query ElasticSearch through Kibana to select items that have field X?

For example, I have a mapping with fields {"a": {"type": "string"}, "b": {"type": "string"}}, and two documents

{"a": "lalala"}
{"a": "enoheo", "b": "nthtnhnt"}

I want to find the second document without knowing what its b actually is.

2 Answers 2

15

It's been a while since these answers were given. In case anyone needs a more updated answer, the docs now give this example for selecting results that have a certain field.

In query-string syntax:

where the field title has any non-null value:

_exists_:title

https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_field_names

Sign up to request clarification or add additional context in comments.

Comments

8

Use the exists filter, like:

POST /test_index/_search
{
    "filter": {
        "exists": {
           "field": "b"
        }
    }
}

EDIT: If you need a Lucene query-string query, this should do it:

POST /test_index/_search
{
   "query": {
      "query_string": {
         "query": "b:*"
      }
   }
}

Here is some code I used to test it:

http://sense.qbox.io/gist/ad336a0888a279bfdace03e217bf1915adbf0fe2

3 Comments

I want it to work with Kibana with the Lucene query string, not the query DSL.
What about the negative case? How would you use the lucene query-string to test that a field does not exist?
For the negative case, putting a minus in front of the query seems to work: "-b:*"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.