Exists queryedit

Returns documents that contain an indexed value for a field.

An indexed value may not exist for a document’s field due to a variety of reasons:

  • The field in the source JSON is null or []
  • The field has "index" : false set in the mapping
  • The length of the field value exceeded an ignore_above setting in the mapping
  • The field value was malformed and ignore_malformed was defined in the mapping

Example requestedit

GET /_search
{
  "query": {
    "exists": {
      "field": "user"
    }
  }
}

Top-level parameters for existsedit

field

(Required, string) Name of the field you wish to search.

While a field is deemed non-existent if the JSON value is null or [], these values will indicate the field does exist:

  • Empty strings, such as "" or "-"
  • Arrays containing null and another value, such as [null, "foo"]
  • A custom null-value, defined in field mapping

Notesedit

Find documents missing indexed valuesedit

To find documents that are missing an indexed value for a field, use the must_not boolean query with the exists query.

The following search returns documents that are missing an indexed value for the user.id field.

GET /_search
{
  "query": {
    "bool": {
      "must_not": {
        "exists": {
          "field": "user.id"
        }
      }
    }
  }
}