How should I choose my log type?

You should always choose the type by log format, not the log source.

For example:

  • If you have 5 Apache servers, you will choose type as apache_access, and not apache_access1, apache_access2... and so on.
  • By the same token, if you have an apache server and a nginx server, you don't want to choose serverlogs as the type for both.

Most log shippers allow you to add additional parameters. You can use the parameters to identify an environment or source by name if needed, and use type only for identifying log format.