The mediawiki.runJobs errors are collected in logstash but the whole job description and errors are a single field `message`.
That does not let one figure out easily which jobs are most impacted or which error is trending. Example from logstash:
| Key | Value
|--|--
| message | RESFetchScoreJob Q1104427 revid=378517804 extra_params={"precache":"true"} requestId=V@TQWQpAEDcAAMWtvY4AAAEP (uuid=ee43ad0481aa4c1ab67877606030894c,timestamp=1474613338,QueuePartition=rdb1-6380) t=15055 error=
| url | /rpc/RunJobs.php?wiki=wikidatawiki&type=ORESFetchScoreJob&maxtime=60&maxmem=300M
| type | mediawiki
| channel | runJobs
| wiki | wikidatawiki
The `/rpc/RunJobs.php` invokes `JobRunner::executeJob()` which crafts the message via the public (non final) method `Job::toString()`. The default being to getting the class then append a concatenation f all parameters.
We should get logstash to extract useful values such as the job type, duration, args && parameters, duration.