Elasticsearch 字段为空(null)记录查询

sql_example：
select msg,level  from jsonlog3-2019.06.26 where msg is NULL;
es_explain：
GET /jsonlog3-2019.06.26/_search
{
  "_source": ["msg","level"],
  "query": {
  "bool": {
  "must": [
    {"bool": {"must_not": [
    {"exists": {"field": "msg"}}
      ]}}
      ]
  }
}}
 
sql_example：
select msg,level  from jsonlog3-2019.06.26 where msg is not NULL;
es_explain：
GET /jsonlog3-2019.06.26/_search
{
  "_source": ["msg","level"],
  "query": {
  "bool": {
  "must": [
    {"bool": {"must": [
    {"exists": {"field": "msg"}}
      ]}}
      ]
  }
}}
 
OR
 
GET /qdtech-jsonlog3-2019.06.26/_search
{
  "_source": ["msg","level"],
  "query": {
    "constant_score": {
      "filter": {
        "exists": {
          "field": "msg"
        }
      }
    }
  }
}
 
注：es中字段不存在 和 字段为null 是同一个概念；