Skip to main content Link Menu Expand (external link) Document Search Copy Copied

Query - Field Null Check Filter

  1. sIsnull(field)
  2. Example


The sIsnull filter is used to match a ‘null’ field.

search sIsnull("@fields.nullfield")

In the above example, the search matches all records where the field ‘@fields.nullfield’ is ‘null’ valued. Note, the ‘null’ value must be a JSON valid ‘null’ value. Values such as the string “null”, or the values of non-existant keys do not match this selector.


Consider the following data set:


An example record, after JSON parsing:

  "@message": "",
  "@facility": "kern",
  "@level": "notice",
  "@tags": [
  "@source": "log-generator",
  "@sender": "",
  "@timestamp": 1662053991000,
  "@fields": {
    "numstr": "1",
    "divisors": 1,
    "id": 1,
    "isprime": "no",
    "odd": true,
    "nullfield": null
  "@type": "event"

The following example matches the 3 (out of 5) events where ‘@fields.nullfield’ is ‘null’ valued. The events where the value is the string literal “null” are not matched.

search sIsnull("@fields.nullfield")
let {id, isprime, odd, even, nullfield} = f("@fields")

Note that the search filter does not return a presentable value. It is almost always following by the data extraction command ‘let’.

Note: The table in the Fluency interface will show ‘null’ fields as empty.

Page last updated: 2022 Oct 02