One of the things to come out of the first A/B test in discovery was that the format for our logs is hard to analyse. The suggested fix is outlined at https://docs.google.com/document/d/1oJQb0EcMPlCBU7R1Gc3lOP9jeZwU12zneRWREhX-FZU/edit# but, TL;DR:
- Drop xff and group;
- Replace group with an x_analytics-like, key=value pair format so we can test multiple parameters at once;
- Remove JSON-style formatting and use tab-separation if possible, with query data (other than the specified fields) stored as JSON blobs /in/ a field;
- Sanitise the user_agent and query fields to remove tabs and quotes, if at all possible.