As part of {T205849} and specifically {T205851} logstash traffic is moving from being sent over the network in a multitude of formats to being sent to local logging facilities (i.e. rsyslog and/or journald) using a single format, namely syslog + JSON payload, IOW what MediaWiki sends logstash now over plaintext UDP.
When re-using local logging facilities the message stream contains messages from other applications as well, so we'll have to explicitly tag JSON payloads to have a robust detection mechanism (i.e. prepending the syslog message with `@cee:` the [CEE cookie](https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmjsonparse.html)).
In terms of limitations the default rsyslog maximum message size is 8k, though it can be bumped.
To ease the transition the idea is to provide a local udp syslog endpoint: we already know how mediawiki behaves when writing logging to udp though the idea is to eventually move to unix socket `/dev/log` as it is standard syslog.