Ship the logs before you need them

The instinct is to set up log aggregation when there is a problem to investigate. By then the interesting logs have rotated away, and the incident is reconstructed from whatever survived on one machine.

# filebeat.yml — ship first, decide what to do with it later
filebeat.prospectors:
  - input_type: log
    paths:
      - /var/log/nginx/access.log
      - /var/www/shop/storage/logs/*.log
    fields: { service: shop, env: production }

output.logstash:
  hosts: ["logs.internal:5044"]

Shipping is cheap and the value is retrospective: the question you will want to answer is “when did this start”, and that requires data from before you knew there was a problem. Add the service and environment fields at the shipper rather than parsing them out later — they are free at the source and expensive to infer. Set a retention policy at the same time, or the disk becomes the next incident.