https://logstash.wikimedia.org/#/dashboard/elasticsearch/default
And after e.g. focussing on type=restbase
These both have an empty "message" column for messages from restbase. When inspecting an individual entry, it seems restbase uses an "info" field instead. And also a "res.body.title" and "res.body.err.message".
Can we transform these somehow to at least also have a "message" field populated? Should probably be an alias to one of these. Or the result of concatenating them.