If you look on the JSON tab of an expanded event in the Kibana Discovery pane is the message field in question an array? If so, what does your filter section look like? Are you using grok or mutate to add a field called [message]?
After reviewing logstash pipeline, i think it's because grokparsefailure. I'm using grok filter and mutate (remove) in the pipeline for this index. Maybe i will start to update the logstash pipeline. Thanks for the help