Roughly half of messages sent to logstash are from AbuseFilter writing to the StashEdit log bucket. That cause logs to be emitted for each filterAction calls.
It does not seem to serve much purpose in production nowadays. Can we change them to debug and raise production login for StashEdit from debug to info?
A similar request for api-feature-usage T146472