Equal field values show up as different

[DarkKooky]

Why do these values show up as different although equal and how should it be fixed?
If this could help:

• the stack consists of Elasticsearch, Kibana and Filebeat
• Filebeat's input comes from port 514
• the logs are processed through dissect and add_tags processors

[jughosta (Julia Rechkunova)]

Welcome to the community, @DarkKooky!

What if you filter for these values (via "+" button). Does it give different search results too?

[DarkKooky]

Yes it did show different Record counts.

I found my mistake which came from the dissect processor: I used " as delimiter which removed the quote from the field value.

Being a string, Kibana would still display the value between quotes but separate it from other values that do contain the ending quote.