TLDR:

The way key-values passed to $logger->debug() and $logger->warning() are shown in Logstash will soon change. The proposed transition will be forward- and backward- compatible for at least 90 days, so you can always find your logs in one place, and will not need to update any queries (yet).

Today, metadata from Syslog, Monolog processors, and MediaWiki context arrays are mixed into one flat array. After the transition, rows in Logstash will preserve the context as its own array under a "context" key. Visual example at https://phabricator.wikimedia.org/T247675#7360872.

Background

Our wiring code for Logstash has diverged from upstream. The V0 format, which we have effectively forked, has various usability issues.

For these two reasons, the few of us looking after the debug/monolog code (incl Reedy, Daimona, and myself) would like to transition to use upstream's V2 format directly without some of the overrides we currently have.

If you use Logstash regularly and are worried this might affect your workflow, check out the transition plan [1] and comment on Phabricator (or email me) with any suggestions or concerns that I might have missed.

[1] https://phabricator.wikimedia.org/T247675#7360872

-- Timo