The problem with your initial filter call was with this section:
Ditto will take everything between the delimiters as what you want to filter by. Thus, it saw the space and quotes as part of the text.
In your second filter call you removed the spaces and quotes, thus it worked.
Regarding how filtering works (and I need to fix this in the documentation):
"Filtering REMOVES all items that make the filter statement true. Thus if joe is != foo it will be removed if it was mode 1. However, by setting mode 2 Ditto would only show the items removed."