As title, i can't find a way to do it in kibana KQL. I have tried NOT field, it's not work.
1 Answers
if your field is a keyword type, the KQL query below will check for existing but empty field values:
fieldname:""
Note that this won't work for a text analysed type
Related