Exists query

Returns documents that contain an indexed value for a field.

An indexed value may not exist for a document’s field due to a variety of reasons:

• The field in the source JSON is null or []
• The field has "index" : false and "doc_values" : false set in the mapping
• The length of the field value exceeded an ignore_above setting in the mapping
• The field value was malformed and ignore_malformed was defined in the mapping

 GET /_search {
  "query": {
    "exists": {
      "field": "user"
    }
  }
}

field

(Required, string) Name of the field you wish to search.

While a field is deemed non-existent if the JSON value is null or [], these values will indicate the field does exist:

• Empty strings, such as "" or "-"
• Arrays containing null and another value, such as [null, "foo"]
• A custom null-value, defined in field mapping

To find documents that are missing an indexed value for a field, use the must_not boolean query with the exists query.

The following search returns documents that are missing an indexed value for the user.id field.

 GET /_search {
  "query": {
    "bool": {
      "must_not": {
        "exists": {
          "field": "user.id"
        }
      }
    }
  }
}