Content differences:
--- /etc/rsyslog.d/30-output-kafka.conf.orig
+++ /etc/rsyslog.d/30-output-kafka.conf
@@ -58,7 +58,10 @@
# Event Platform events carry a 'meta.stream' field. Produce these only to
# the '<datacenter>.<meta.stream>' topic (T291645). Logstash consumes this
# topic via an explicit kafka input rather than the 'rsyslog-*' pattern.
+ # We also need to unset the $!msg field here, which is left over from the
+ # failed mmjsonparse_kafka_raw parsing attempt.
if ($!meta!stream != "") then {
+ unset $!msg;
action(type="omkafka"
name="omkafka_event_platform"
broker=["kafka-logging2001.codfw.wmnet:9093","kafka-logging2002.codfw.wmnet:9093","kafka-logging2003.codfw.wmnet:9093","kafka-logging2004.codfw.wmnet:9093","kafka-logging2005.codfw.wmnet:9093"]