Exists query #

Returns documents that contain an indexed value for a specific field.

A document matches when the field has at least one non-null value — an empty string or an empty array does not count as existing.

Inside a nested query: supported — matches elements that carry the field.

How it works #

exists never touches the inverted index. It is answered from the stored-field / column layer, where every document either carries the key or does not:

• The field’s value must be present and non-null. An empty string ("") and an empty array ([]) both read as absent.
• Dotted paths (url.path) resolve in three steps: the flat key first, then descent into object values segment by segment, and finally — for an object parent such as plain url — a prefix rule: the parent exists when any flattened url.* sub-key is present.
• The check runs identically on the live layer and on built immutable segments (an earlier divergence — exists silently matching everything on built segments — is pinned by a differential test on both layers).

Scoring. A match contributes a constant score (the boost), never a relevance signal: the query answers shape, not content. It costs about as much as a filter and composes freely under bool filter, must_not and must.

Examples #

The following search returns every log line that carries a url.path — all 150 documents in the logs dataset, since the field is always present there.

The SQL twin quotes the dotted name ("url.path") — unquoted, the dot would parse as part of an expression and the reference is rejected.

POST /my-collection/_search
{
  "query": {
    "exists": {
      "field": "user"
    }
  }
}

Use cases #

• Data-quality audits. 24 of the 44 articles carry no author; exists on that keyword field returns the other 20 — the starting point of a “fix the missing metadata” ticket.
• Optional-field gating. Only evaluate a scored clause (or a highlight, or a sort) on documents that actually have the field, by intersecting with exists in a bool.filter.
• The negated form. bool.must_not.exists is the query twin of the missing aggregation — find the documents a field-based feature will silently skip.
• Object-shape probing. exists on the parent (url) answers “does this doc have any URL data at all?” without naming every sub-field.

Parameters for exists #

• field
  (Required, string) Field you wish to check for presence.

Related #

• missing aggregation — the inverse question, counted per bucket instead of matched per document.
• term / terms — once presence is settled, match the value.
• bool — combine with must_not for the not-exists form.
• nested — per-element existence inside arrays of objects.