Possibility of Duplicate Value in Field

Elastic Stack Elasticsearch
1

Hi, i am new to elastic and really enjoy exploring elastic stack so far.

For the background, i still developing log normalization for my monitoring assets and classify them into specific event.category and specific event.kind.
Now i am struggling to find out the possible root cause of why there is duplicate value in event.category? i already make sure there is no miss typing (typo) in it.

duplicate value
duplicate value982×303 19.1 KB

Hope the community can answer my question, thanks.

2

Does any of those values has a space or other character that would not be visible in the UI in it?

3

Hi Christian,

appreciate your time to reply this.

Already double checked on logstash conf and filebeat pipeline, there is no space or other character in it.

A bit strange, when i filtered two "Audit" like below screenshot.

discover
discover694×722 48.2 KB

then filtered one by one, either first "Audit" and second "Audit" give the same result when i tried to populate the event.kind

event.kind
event.kind883×761 82 KB

4

Look at the raw JSON documents. Spaces are hard to spot in any other view.

5

Apreciate your time to review this, Christian.

You're correct, other guys miss spell with space added in another logstash.
Also already solved all the strange things in above.

thank you