For HHVM, the hhvm-fatal-error.php entries to syslog were rewritten to appear as MediaWiki. But the PHP7 equivalent appears to not be doing that yet or not anymore.
This means they can be included in Logstash dashboards that include a type:mediawiki filter (where developers will discover it naturally as part of routine monitoring, and also during train/SWAT deployments). Using a different type is not feasible even as workaround because Kibana doesn't support that unless you bypass the UI and use JSON queries directly.
If I recall correctly, this rewrite would be in the puppetised logstash/filter file.
- Hotfix the Scap canary logstash-checker to include syslog/php7-fpm.
- Fix sending of, or Logstash ingestion of, PHP7 fatal-error messages to correctly arrive under type:mediawiki channel:fatal.