As part of T205849: Begin the implementation of Q1's Logging Infrastructure design (2018-19 Q2 Goal) and specifically T205851: Migrate >=90% of existing Logstash traffic to the logging pipeline logstash traffic is moving from being sent over the network in a multitude of formats to being sent to local logging facilities (i.e. rsyslog and/or journald) using a single format, namely syslog + JSON payload, IOW what MediaWiki sends logstash now over plaintext UDP.
When re-using local logging facilities the message stream contains messages from other applications as well, so we'll have to explicitly tag JSON payloads to have a robust detection mechanism (i.e. prepending the syslog message with @cee: the CEE cookie).
In terms of limitations the default rsyslog maximum message size is 8k, though it can be bumped. Today's limit is the udp MTU i.e. 1472 bytes.
To ease the transition the idea is to provide a local udp syslog endpoint: we already know how mediawiki behaves when writing logging to udp though the idea is to eventually move to unix socket /dev/log as it is standard syslog.
Additional context/information: https://wikitech.wikimedia.org/wiki/Logstash/SRE_onboard