Treat - as "missing"? - Githubissues

logsearch / logsearch-filters-seo

Apache License 2.0

2 stars 0 forks source link

Open mrdavidlaing opened 10 years ago

mrdavidlaing commented 10 years ago

Many source fields contain - in the source log files, to represent a lack of data for that field.

Can / should - be treated as missing?

mrdavidlaing commented 10 years ago

Missing is returned by elasticsearch when you do a facets query and the source event doesn't have the field.

- is an actual value that is present in the source log file; so from elasticsearch's perspective it isn't missing.

I propose that we don't try to "merge" these two concepts.