diff --git a/lib/logstorage/filter_in.go b/lib/logstorage/filter_in.go
index 8b9e14caa..a230d3708 100644
--- a/lib/logstorage/filter_in.go
+++ b/lib/logstorage/filter_in.go
@@ -496,33 +496,27 @@ func getCommonTokensAndTokenSets(values []string) ([]string, [][]string) {
 	return commonTokens, tokenSets
 }
 
+// getCommonTokens returns common tokens seen at every set of tokens inside tokenSets.
+//
+// The returned common tokens preserve the original order seen in tokenSets.
 func getCommonTokens(tokenSets [][]string) []string {
 	if len(tokenSets) == 0 {
 		return nil
 	}
 
-	m := make(map[string]struct{}, len(tokenSets[0]))
-	for _, token := range tokenSets[0] {
-		m[token] = struct{}{}
-	}
+	commonTokens := append([]string{}, tokenSets[0]...)
 
 	for _, tokens := range tokenSets[1:] {
-		if len(m) == 0 {
+		if len(commonTokens) == 0 {
 			return nil
 		}
-		for token := range m {
-			if !slices.Contains(tokens, token) {
-				delete(m, token)
+		dst := commonTokens[:0]
+		for _, token := range commonTokens {
+			if slices.Contains(tokens, token) {
+				dst = append(dst, token)
 			}
 		}
+		commonTokens = dst
 	}
-	if len(m) == 0 {
-		return nil
-	}
-
-	tokens := make([]string, 0, len(m))
-	for token := range m {
-		tokens = append(tokens, token)
-	}
-	return tokens
+	return commonTokens
 }