As part of {T205849} and specifically {T205851} logstash traffic is moving from being sent over the network in a multitude of formats to being sent to local logging facilities (i.e. rsyslog and/or journald) using a single format, namely syslog + JSON payload, IOW what MediaWiki sends logstash now over plaintext UDP.
When re-using local logging facilities the message stream contains messages from other applications as well, so we'll have to explicitly tag JSON payloads to have a robust detection mechanism (i.e. prepending the syslog message with `@cee:` the [CEE cookie](https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmjsonparse.html)).
In terms of limitations the default rsyslog maximum message size is 8k, though it can be bumped. Today's limit is the udp MTU i.e. 1472 bytes.
To ease the transition the idea is to provide a local udp syslog endpoint: we already know how mediawiki behaves when writing logging to udp though the idea is to eventually move to unix socket `/dev/log` as it is standard syslog.