# Possibility of Duplicate Value in Field **URL:** \ **Category:** Elasticsearch\ **Tags:** ecs-elastic-common-schema\ **Created:** [November 3, 2022, 7:11am UTC](https://discuss.elastic.co/t/possibility-of-duplicate-value-in-field/318077 "2022-11-03T07:11:22Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![haikal.azaim](https://avatars.discourse-cdn.com/v4/letter/h/73ab20/32.png) [@haikal.azaim](https://discuss.elastic.co/u/haikal.azaim)\ **Post date:** [November 3, 2022, 7:11am UTC](https://discuss.elastic.co/t/possibility-of-duplicate-value-in-field/318077/1 "2022-11-03T07:11:22Z")
Hi, i am new to elastic and really enjoy exploring elastic stack so far. For the background, i still developing log normalization for my monitoring assets and classify them into specific event.category and specific event.kind. Now i am struggling to find out the possible root cause of why there is duplicate value in event.category? i already make sure there is no miss typing (typo) in it. ![duplicate value](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3d486ccc809e6b822a4b26a0493e74259dd0c729.jpeg) Hope the community can answer my question, thanks. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 3, 2022, 7:15am UTC](https://discuss.elastic.co/t/possibility-of-duplicate-value-in-field/318077/2 "2022-11-03T07:15:46Z")
Does any of those values has a space or other character that would not be visible in the UI in it? ---
**Author:** ![haikal.azaim](https://avatars.discourse-cdn.com/v4/letter/h/73ab20/32.png) [@haikal.azaim](https://discuss.elastic.co/u/haikal.azaim)\ **Post date:** [November 3, 2022, 8:22am UTC](https://discuss.elastic.co/t/possibility-of-duplicate-value-in-field/318077/3 "2022-11-03T08:22:44Z")
Hi Christian, appreciate your time to reply this. Already double checked on logstash conf and filebeat pipeline, there is no space or other character in it. A bit strange, when i filtered two "Audit" like below screenshot. ![discover](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6e8fd7d411af3d94d719e877868357b092f8ee62.jpeg) then filtered one by one, either first "Audit" and second "Audit" give the same result when i tried to populate the event.kind ![event.kind](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e0c3b1e8c300a58734fa332649d003e854618550.jpeg) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 3, 2022, 8:46am UTC](https://discuss.elastic.co/t/possibility-of-duplicate-value-in-field/318077/4 "2022-11-03T08:46:01Z")
Look at the raw JSON documents. Spaces are hard to spot in any other view. ---
**Author:** ![haikal.azaim](https://avatars.discourse-cdn.com/v4/letter/h/73ab20/32.png) [@haikal.azaim](https://discuss.elastic.co/u/haikal.azaim)\ **Post date:** [November 3, 2022, 9:12am UTC](https://discuss.elastic.co/t/possibility-of-duplicate-value-in-field/318077/5 "2022-11-03T09:12:13Z")
Apreciate your time to review this, Christian. You're correct, other guys miss spell with space added in another logstash. Also already solved all the strange things in above. thank you ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 1, 2022, 9:12am UTC](https://discuss.elastic.co/t/possibility-of-duplicate-value-in-field/318077/6 "2022-12-01T09:12:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.