That could also be used by the elasticsearch version to directly put the events inside the cluster we use to query instead of going through logstash (though maybe we do want them in logstash anyways?)

For WMF we probably do want them going through logstash, so they wind up both unsanitized in Kibana and sanitized in the ES data used by ApiFeatureUsage.

ApiBase::logFeatureUsage() exists largely to allow for global analysis of deprecated feature usage without having to parse things out of the api.log ocean-sized firehose. The ApiFeatureUsage extension is an add-on to allow clients to get a summary of their own use of deprecated features.

For your proposed version that just shoves the events into MySQL, making it easier to go through the logging infrastructure seems like the wrong way to go. What you'd really want would probably be a hook in ApiBase::logFeatureUsage() so you can just directly insert the events into your database table without messing with trying to parse the log message at all.

1. MediaWiki core: ApiBase::logFeatureUsage() -> wfDebugLog( 'api-feature-usage' )
2. (WMF) wmf-config Monolog setup
3. (WMF) Logstash
4. (WMF) a sanitized version to the elasticsearch cluster used by CirrusSearch
5. ApiFeatureUsage extension: read from Elastic cluster

This will be resolved after T313731, after which it would be:

1. MediaWiki core: ApiBase::logFeatureUsage() -> onApiLogFeatureUsage hook
2. ApiFeatureUsage extension: read-write via a MediaWiki database table