TLDR:
The way key-values passed to $logger->debug() and $logger->warning() are
shown in Logstash will soon change. The proposed transition will be
forward- and backward- compatible for at least 90 days, so you can always
find your logs in one place, and will not need to update any queries (yet).
Today, metadata from Syslog, Monolog processors, and MediaWiki context
arrays are mixed into one flat array. After the transition, rows in
Logstash will preserve the context as its own array under a "context" key.
Visual example at https://phabricator.wikimedia.org/T247675#7360872.
Background
Our wiring code for Logstash has diverged from upstream. The V0 format,
which we have effectively forked, has various usability issues.
For these two reasons, the few of us looking after the debug/monolog code
(incl Reedy, Daimona, and myself) would like to transition to use
upstream's V2 format directly without some of the overrides we currently
have.
If you use Logstash regularly and are worried this might affect your
workflow, check out the transition plan [1] and comment on Phabricator (or
email me) with any suggestions or concerns that I might have missed.
[1] https://phabricator.wikimedia.org/T247675#7360872
-- Timo
The way key-values passed to $logger->debug() and $logger->warning() are
shown in Logstash will soon change. The proposed transition will be
forward- and backward- compatible for at least 90 days, so you can always
find your logs in one place, and will not need to update any queries (yet).
Today, metadata from Syslog, Monolog processors, and MediaWiki context
arrays are mixed into one flat array. After the transition, rows in
Logstash will preserve the context as its own array under a "context" key.
Visual example at https://phabricator.wikimedia.org/T247675#7360872.
Background
Our wiring code for Logstash has diverged from upstream. The V0 format,
which we have effectively forked, has various usability issues.
For these two reasons, the few of us looking after the debug/monolog code
(incl Reedy, Daimona, and myself) would like to transition to use
upstream's V2 format directly without some of the overrides we currently
have.
If you use Logstash regularly and are worried this might affect your
workflow, check out the transition plan [1] and comment on Phabricator (or
email me) with any suggestions or concerns that I might have missed.
[1] https://phabricator.wikimedia.org/T247675#7360872
-- Timo