Quanah, could you give some documentation or any pointer regarding the evolution of the log format?
One example would be the addition of "etime" and "qtime". Another would be logging the TLS protocol and TLS ciphers. There are likely other things that are present in 2.5+ depending on the operations involved.
--Quanah