I am new to ELK as a PHP developer,Now i wanna count the number of IP from logs in SQL Commands group by and count, When i ran the code below to ES in Dev Tools:

### 
POST /_sql?format=txt
{
  "query":"""SELECT 
    substring(message, 0, POSITION(';', message)-1) as ip
    FROM(
    SELECT SUBSTRING(message,POSITION('ip:',message)+3, 500) as message FROM "php-log-business-2024.06.24" WHERE tag in('access','wxaccess') and match(message,'request uri:') and HOUR_OF_DAY(CAST("@timestamp" as TIMESTAMP))=6 and match(message, '/little/farm/cropland')
    ) 
    
  """
}

Everything is fine, Visually inspecting the result, no null values were found

I modified slightly the previously code to the below:

POST /_sql?format=txt
{
  "query":"""SELECT 
    substring(message, 0, POSITION(';', message)-1) as ip
    FROM(
    SELECT SUBSTRING(message,POSITION('ip:',message)+3, 500) as message FROM "php-log-business-2024.06.24" WHERE tag in('access','wxaccess') and match(message,'request uri:') and HOUR_OF_DAY(CAST("@timestamp" as TIMESTAMP))=6 and match(message, '/little/farm/cropland')
    ) 
    where substring(message, 0, POSITION(';', message)-1) is null
  """
}
# Result:
      ip       
---------------
111.25.72.28   
111.59.242.126 
117.179.15.172 
27.40.77.243   
175.1.3.175    
1.204.126.160  
223.149.26.249 
223.91.92.123  
112.38.170.34  
27.186.107.110 
60.214.119.2   
27.186.107.110 
118.78.3.180   
223.104.149.156
14.112.29.254  
171.223.117.91 
39.144.169.93  
36.142.145.33  
42.231.56.217  
120.228.49.183 
117.188.51.255 
1.27.128.211   
117.188.51.255 
119.48.13.233  
...

A strange problam, actually the result visually is non null, But the equality operation euqals to True, Is there anyone know why this?

A correct result like SQL query