channel=authentication
level=INFO

MediaWiki\Auth\AuthManager::autoCreateUser: creating new user ({username}) - from: {from}

In this case, this is a message in the "authentication" diagnostic channel. It is neither an "error"-level message, nor a message in the "error" channel.

@KSarabia-WMF I suspect something is broken on your team's Logstash dashboard. If not addressed, this will yield many more non-issues and tasks being reported, hence taking a moment to point it out.

I generally recommend that teams create their Logsash dashboard such that it dispays exceptions (typically reduced to keywords of interest based on the stack trace), and perhaps also include specific diagnostic channels owned by extensions your team maintains. When triaging, these would also typically be limited to WARNING and above, unless you're browsing the unfiltered "Logtash: mediawiki" dashboard to trace a specific request ID.

When an uncaught error or runtime PHP Warning ocurrs, these are automatically formatted as exceptions and sent to the "error" channel. Only these are considered production errors. When developers format custom messages into their own local diagnostic channels for debugging or monitoring, these are used when debugging other issues, they are not production errors. These are useful to review periodically from your own code to ensure it is working as expected, but usually not of interest to other teams.

For more information, review https://wikitech.wikimedia.org/wiki/OpenSearch_Dashboards and https://www.mediawiki.org/wiki/Manual:Structured_logging

The "creating new user" debug message is expected and normal during the account creation process.

It does not appear to have started or increased in the last 90 days:

We adjusted the dashboard to filter out more irrelevant warnings like INFO and NOTICE