I've just skillfully shot myself in the foot by forcing everyone to send logs as GELF to our graylog instance. Works OK for systemd but not so for

tail

of an nginx access log. If I don't parse and send logline directly (rename: log short_message) it's OK, but if I parse before sending there's nothing obvious to use as the short_message key.