A GELF message from node 10.xxx.xxx.xxx is missing short message field. How are you sending those logs (i.e. filebeat, Nxlog,etc…) , what type of log formate are you sending ( i.e, database, Apache, etc…) and what input are you using?
The input may be incorrect for that type of message being sent from that node. As for finding that message you can try looking it “_id” shown in the screen shot.
You can look in the default stream called “Processing and Indexing Failures” see if its in there, other then that, I dont know. Chances are it may have been drop.