Treat - as "missing"?

[mrdavidlaing]

Many source fields contain - in the source log files, to represent a lack of data for that field.

Can / should - be treated as missing?

[mrdavidlaing]

Missing is returned by elasticsearch when you do a facets query and the source event doesn't have the field.

- is an actual value that is present in the source log file; so from elasticsearch's perspective it isn't missing.

I propose that we don't try to "merge" these two concepts.