We've had a few issues lately where Wikidata Query Service was overloading logstash. While we already have some mechanisms in place to limit the amount of logging generated by wdqs, they are not robust enough.
Having a rate limite on the logstash appender should ensure that we don't overload logstash. It will have to drop logging events, so we will loose informatin, but that is better than overloading logstash, still loosing information and worse: loosing information from other unrelated applications.
Rate limiting should be applied to most (if not all) appenders. Overloading journald is also an issue, as seen during T207817.
Note that we still need to tune logging to ensure that this limit is not reached. This rate limit is a last barrier if all other means have failed.