Query Information

PPL Command/Query:

source=bounty-types | where NOT keyword_field LIKE '%ello%' | fields keyword_field

Expected Result:
Rows with keyword_field = null should be excluded.

Actual Result:
Output includes null row in addition to non-matching string rows.

Dataset Information

Dataset/Schema Type

• OpenTelemetry (OTEL)
• Simple Schema for Observability (SS4O)
• Open Cybersecurity Schema Framework (OCSF)
• Custom (details below)

Index Mapping

{
  "mappings": {
    "properties": {
      "keyword_field": { "type": "keyword" }
    }
  }
}

Sample Data

[
  { "keyword_field": "hello" },
  { "keyword_field": "world" },
  { "keyword_field": "" },
  { "keyword_field": "special chars..." },
  { "keyword_field": null }
]

Bug Description

Issue Summary:
NOT LIKE incorrectly includes null/missing values.

Steps to Reproduce:

1. Create index with keyword_field.
2. Insert sample rows including null.
3. Run the query above.
4. Observe null in output.

Impact:
Negated string filters produce incorrect result sets.