Equal field values show up as different

Elastic Stack Kibana
1

Why do these values show up as different although equal and how should it be fixed?
If this could help:

  • the stack consists of Elasticsearch, Kibana and Filebeat
  • Filebeat's input comes from port 514
  • the logs are processed through dissect and add_tags processors

Capture d’écran 2023-05-15 114841

2

Welcome to the community, @DarkKooky!

What if you filter for these values (via "+" button). Does it give different search results too?

3

Yes it did show different Record counts.

I found my mistake which came from the dissect processor: I used " as delimiter which removed the quote from the field value.

Being a string, Kibana would still display the value between quotes but separate it from other values that do contain the ending quote.