Many times, we need to face the disturbing null value, passing a null value es query to check out the null data or not search this field too, the slightest mistake will lead to a new bug, which is indeed a problem!
null_value means you can not index or search for null values. When the field is set to null, [], and [null] (null representation of these are equivalent), it is considered that there is no value field.
null_value means it will not be represented as an inverted index data structure, they do not exist in the index reverse, so the search will not have any meaning.
Is it search no way to it?
es provide us with missing query, on behalf of missing fields or null values, but has been removed in version 6.x. Instead exists inquiry, its semantic equivalent in SQL column is not null (have value). They all belong to the polymerization operation.
Clearly, the world is not simple, often lack data fields, or contains explicit null or empty array. In order to deal with these situations, we es recommended to us some of the ways to deal with null or missing values.
Fortunately, ES may be provided an option to replace the explicit null (when set to string, number, Boolean, or date field designated map) we choose a placeholder values when insert / update data is encountered when a null value, that value will be used, this explicit null value will be indexed and searchable.
When you select the appropriate null values, ensure that:
It matches the type of field. Null string can not be used in the field of the date type
which is different from the normal field may contain, in order to avoid confusion with real-valued null
PUT my_index { "mappings": { "_doc": { "properties": { "status_code": { "type": "keyword", "null_value": "NULL" } } } } } PUT my_index/_doc/1 { "status_code": null } PUT my_index/_doc/2 { "status_code": [] } GET my_index/_search { "query": { "term": { "status_code": "NULL" } } }