I've developed Fluentd plugins for parsing MariaDB Server logs. During the process of development I noticed the following:

• log formats are loosely defined in the documentation. There are no strict definition for file log formats, which makes developing a parser, a job of back engineering the log and testing it agains self generated log messages, instead of just implementing a spec. I think the documentation should include log format specification, like this:
  Error log:

  (date:<yyyy-MM-dd hh:mm:ss|yyyyMMdd hh:mm:ss>) <[(logger)]> (message)

• there are no common field names. For example, the audit log defines two field called "identification numbers". I'm not sure how to name each field(e.g.: id_1, id_2) and which of them is mapped to general query log(thread_id, server_id). or slow query log(Id)
• log are not following common structure. For example, general query log outputs multiline events and slow query log a single line events.
• some logs have header lines on top of the file, some don't.