Returns documents that have at least one non-null value in the original field:

GET /_search
{
    "query": {
        "exists" : { "field" : "user" }
    }
}

For instance, these documents would all match the above query:

{ "user": "jane" }
{ "user": "" } 
{ "user": "-" } 
{ "user": ["jane"] }
{ "user": ["jane", null ] } 

These documents would not match the above query:

{ "user": null }
{ "user": [] } 
{ "user": [null] } 
{ "foo":  "bar" } 

null_value mapping

If the field mapping includes the null_value setting then explicit null values are replaced with the specified null_value. For instance, if the user field were mapped as follows:

PUT /example
{
  "mappings": {
    "properties": {
      "user": {
        "type": "keyword",
        "null_value": "_null_"
      }
    }
  }
}

then explicit null values would be indexed as the string _null_, and the following docs would match the exists filter:

{ "user": null }
{ "user": [null] }

However, these docs—without explicit null values—would still have no values in the user field and thus would not match the exists filter:

{ "user": [] }
{ "foo": "bar" }

GET /_search
{
    "query": {
        "bool": {
            "must_not": {
                "exists": {
                    "field": "user"
                }
            }
        }
    }
}