Field value duplication

[Haleb]

Hi, I created custom input using HEC in distributed environment. When searching, I see that the values ​​for the fields are duplicated, that is, for one event I have two values.

Haleb_0-1720427767155.png

Any ideas why this might be happening?

[gcusello]

Hi @Haleb ,

as @PickleRick said, it's hard to help you without any information about your architecture.

Anyway, how are you sending logs?

are you using one or two receivers?

how many inputs did you enabled?

are you using a Load Balancer?

Ciao.

Giuseppe

[PickleRick]

It's hard to be sure not knowing your config and data but the typical case is that you're using both indexed fields as well as search-time json extractions.