ElasticSearch/Lucene query string — select "field X exists"

Question

How do I query ElasticSearch through Kibana to select items that have field X?

For example, I have a mapping with fields {"a": {"type": "string"}, "b": {"type": "string"}}, and two documents

{"a": "lalala"}
{"a": "enoheo", "b": "nthtnhnt"}

I want to find the second document without knowing what its b actually is.

Solution 1

Use the exists filter, like:

POST /test_index/_search
{
    "filter": {
        "exists": {
           "field": "b"
        }
    }
}

EDIT: If you need a Lucene query-string query, this should do it:

POST /test_index/_search
{
   "query": {
      "query_string": {
         "query": "b:*"
      }
   }
}

Here is some code I used to test it:

http://sense.qbox.io/gist/ad336a0888a279bfdace03e217bf1915adbf0fe2

Solution 2

It's been a while since these answers were given. In case anyone needs a more updated answer, the docs now give this example for selecting results that have a certain field.

In query-string syntax:

where the field title has any non-null value:

_exists_:title

https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_field_names

Comments

[Mischa Arefiev]

I want it to work with Kibana with the Lucene query string, not the query DSL.

[Nathan Reese]

What about the negative case? How would you use the lucene query-string to test that a field does not exist?