Logging directly to logstash via the redis syslog input is more robust and matches current MediaWiki practice.
Note that this will need a better implementation of Monolog's syslog output than in provided by Monolog 1.12.0. MediaWiki made their own but a shared library or a patch to Monolog would probably be best.