Find documents with empty string value on elasticsearch

Question

I\'ve been trying to filter with elasticsearch only those documents that contains an empty string in its body. So far I\'m having no luck.

Before I go on, I should

Answer 1

I am trying to find the empty fields (in indexes with dynamic mapping) and set them to a default value and the below worked for me

Note this is in elastic 7.x

POST /_update_by_query
{
  "script": {
    "lang": "painless",
    "source": """
      if (ctx._source.== "") {
        ctx._source.= "0";
      } else {
        ctx.op = "noop";
      }
    """
  }
}

I followed one of the responses from the thread and came up with below it will do the same

GET index_pattern*/_update_by_query
{
  "script": {
    "source": "ctx._source.field_name='0'",
    "lang": "painless"
  },
  "query": {
    "bool": {
      "must": [
        {
          "exists": {
            "field": "field_name"
          }
        }
      ],
      "must_not": [
        {
          "wildcard": {
            "field_name": "*"
          }
        }
      ]
    }
  }  
}

I am also trying to find the documents in the index that dont have the field and add them with a value

one of the responses from this thread helped me to come up with below

GET index_pattern*/_update_by_query
{
  "script": {
    "source": "ctx._source.field_name='0'",
    "lang": "painless"
  },
  "query": {
    "bool": {
      "must_not": [
        {
          "exists": {
            "field": "field_name"
          }
        }
      ]
    }
  }
}

Thanks to every one who contributed to this thread I am able to solve my problem