For example:
https://logstash.wikimedia.org/goto/35937df5bb390e3ff2cb06e42a83cac7 --- almost 2M messages in 3.3h
What is odd is that the log message is just %{message} as I understand it. If so, that would indicate a broken log line.
This originally happened at the beginning of April, on staging. It may well be that the bad code is already gone.