See [[ https://logstash.wikimedia.org/goto/e9c8f497642ddffffe8e989a6e01250e | these logs ]] for an example.
Are these logs useful to keep for 90 days in Logstash?
They are not being produced as part of mwaddlink logging facilities,* some logs are multiline and broken into one line per log message (printed as plain text, instead of sent to the logger which would print them as single-line JSON)
* some logs are NOTICE level but obviously shouldn't be, e.g. but instead being generated by a [[ https://gerrit.wikimedia.org/r/plugins/gitiles/research/mwaddlink/+/refs/heads/main/app.py#215 | print statement ]] which makes me think these logs may be unintentionally generatedexception traces (probably same issue)
* a huge amount of noise is getting logged, such as performance profiling output or API responses.