The HHVM logs event stream is relayed from the HHVM servers to fluorine.eqiad.wmnet but is currently not stored in logstash.
There are 2 reasonable ways to add these log events to logstash:
# Add HHVM to the existing log2udp packet processing done in logstash. This would be a fairly trivial change as I'm fairly certain that udp2log is already relaying these events to the logstash listener but the events are not being tagged for storage in Elasticsearch.
# Add puppet configuration to forward the rsyslog event stream to logstash either via an intermediate relay on fluorine or by direct packets from the HHVM app servers. I have already created rules in the MW-Vagrant role::elk logstash role that does this and the event stream seems to be imported nicely with few intermediate processing steps needed.
I'd eventually like to kill off the use of log2udp relaying entirely as a logstash event feed mechanism, so I think that looking into the rsyslog event forwarding would be the better option.