Equal field values show up as different

Why do these values show up as different although equal and how should it be fixed?
If this could help:

  • the stack consists of Elasticsearch, Kibana and Filebeat
  • Filebeat's input comes from port 514
  • the logs are processed through dissect and add_tags processors

Capture d’écran 2023-05-15 114841

Welcome to the community, @DarkKooky!

What if you filter for these values (via "+" button). Does it give different search results too?

Yes it did show different Record counts.

I found my mistake which came from the dissect processor: I used " as delimiter which removed the quote from the field value.

Being a string, Kibana would still display the value between quotes but separate it from other values that do contain the ending quote.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.