When using multiline, after migrating to logstash 1.4.0, messages started to appear differently in Kibana : line feeds seemed to have been replaced with comas.
I found out in the JSON that "message" was not a single value but an Array. However in the multiline.rb around line 217, messages are supposed to be joined when it is an array !
This might be related to : I have this problem too, it is circumvented with a ruby filter.
Here is my logstash.conf :
And a sample event fragment :
Same issue here
Seems Fixed on 1.4.1