Content differences:
--- /etc/rsyslog.d/30-output-kafka.conf.orig
+++ /etc/rsyslog.d/30-output-kafka.conf
@@ -58,7 +58,10 @@
# Event Platform events carry a 'meta.stream' field. Produce these only to
# the '<datacenter>.<meta.stream>' topic (T291645). Logstash consumes this
# topic via an explicit kafka input rather than the 'rsyslog-*' pattern.
+ # We also need to unset the $!msg field here, which is left over from the
+ # failed mmjsonparse_kafka_raw parsing attempt.
if ($!meta!stream != "") then {
+ unset $!msg;
action(type="omkafka"
name="omkafka_event_platform"
broker=["kafka-logging1001.eqiad.wmnet:9093","kafka-logging1002.eqiad.wmnet:9093","kafka-logging1003.eqiad.wmnet:9093","kafka-logging1004.eqiad.wmnet:9093","kafka-logging1005.eqiad.wmnet:9093"]