Version 2.1 - New modifier to check if field is empty or null

[frack113]

Add a new modifer to check if the field data is empty or null. Some telemetry use - too

• name: ?
• type: boolean

    myfield|?: false

will cover

filter_null:
    myfield: null
filter_empty:
    myfield:  ''
    myfield: '-'
condition: not 1 of filter_*

[Res260]

What use case does this solve that |exists doesn't? IIRC most SIEMs I used cannot discriminate between a field existing and a field existing and having the null value. What are some examples of SIEMs that have this feature, and why would one want to use that instead of |exists?

[frack113]

Sorry , forget this one ... It took me less than a year to answer it 😄 Yes, it is not usefull