This message was deleted.

Not sure for the second part, I see what you're saying. For the first query, does

IS NULL

return something different from

= NULL

?

= NULL

should always be false, NULL doesn't = anything, not even NULL.

try is null and is not null instead of = null

select JSON_VALUE(event,'$.layer') from "kttm-nested-v2-2019-08-25" where JSON_VALUE(event,'$.layer') is not null

there is also a bug with null value filtering that can occur if you ingest a value of

"null"

(not

null

, but the string) described by https://github.com/apache/druid/pull/13714, and i’ve recently discovered another bug with null value filtering when the nested field is mixed types and the value is being coerced to a numeric type (e.g.

JSON_VALUE(nested, '$.x' RETURNING BIGINT)

)

Thanks, Is null/is not null helps