fillnull

import { Aside } from ‘@astrojs/starlight/components’;

This command is production-ready but its parameters may change based on community feedback.

The fillnull command replaces null values in one or more fields with a specified value. This is essential for cleaning up data before aggregation, visualization, or export — null values can break charts and skew statistics.

The `fillnull` command runs on the coordinating node, not pushed down to data nodes.

Syntax

Three equivalent syntax forms are available:

fillnull with <value> [in <field-list>]

fillnull using <field> = <value> [, <field> = <value>]...

fillnull value=<value> [<field-list>]

Arguments

Required

Argument	Description
<value>	The replacement value for null fields.

Optional

Argument	Description
<field-list>	Fields in which to replace nulls. Comma-delimited with with/using syntax, space-delimited with value= syntax. When omitted, all fields are processed.
<field> = <value>	Per-field replacement values (only with using syntax).

Usage notes

• When applying the same value to all fields without specifying field names, all fields must be of the same type. For mixed types, use separate fillnull commands or specify fields explicitly.
• The replacement value type must match the field type. You cannot fill a string field with a numeric value or vice versa.
• The using syntax is the most flexible form because it lets you assign different default values to different fields in a single command.
• Use fillnull before stats or timechart to ensure null values do not create unwanted NULL categories in grouped results.

Examples

Fill missing service names with a default

Replace null service name values with unknown:

source = logs-otel-v1*
| fillnull with 'unknown' in `resource.attributes.service.name`
| stats count() as log_count by `resource.attributes.service.name`

Try in playground →

Fill multiple fields with the same value

Replace nulls in both severityText and resource.attributes.service.name:

source = logs-otel-v1*
| fillnull with 'N/A' in severityText, `resource.attributes.service.name`

Try in playground →

Per-field defaults with the using syntax

Assign different default values to different fields:

source = logs-otel-v1*
| fillnull using severityText = 'INFO', `resource.attributes.service.name` = 'unknown-service'

Try in playground →

Fill all fields using the value= syntax

Replace nulls across all string fields with a placeholder:

source = logs-otel-v1*
| fillnull value='<empty>'

Try in playground →

Clean data before visualization

Fill nulls before a timechart to prevent NULL categories from appearing in charts:

source = logs-otel-v1*
| fillnull with 'unknown' in `resource.attributes.service.name`
| timechart timefield=time span=5m count() by `resource.attributes.service.name`

Try in playground →

Extended examples

Clean OTel log data for a service health dashboard

Fill multiple fields with appropriate defaults before aggregating for a dashboard panel:

source = logs-otel-v1*
| fillnull using severityText = 'UNSET', `resource.attributes.service.name` = 'unknown'
| stats count() as total,
    sum(case(severityText = 'ERROR' OR severityText = 'FATAL', 1 else 0)) as errors
  by `resource.attributes.service.name`
| eval error_rate = round(errors * 100.0 / total, 2)
| sort - error_rate

Try in playground →

Fill missing trace context for log-trace correlation

When correlating logs with traces, fill missing trace IDs to identify uncorrelated logs:

source = logs-otel-v1*
| fillnull using traceId = 'no-trace', spanId = 'no-span'
| stats count() as log_count by traceId
| where traceId = 'no-trace'

Try in playground →

See also

• eval — create computed fields or conditional replacements with case()
• where — filter out null values with IS NOT NULL
• stats — aggregation (benefits from clean non-null data)
• timechart — time-based charts (null by fields create NULL categories)