@rabbbit +1 for taking time to record his fix, I just spent like a week doing all kinds of crazy stuff like upgrading logstash to 1.5.1 and going crazy with the field data cache and breaker sizes and all other kinds of nonsense, which was all good for my education, but I just coulnd't understand why kibana3 was ok and kibana4 was not until reading. So, Thanks!