Auto-discovered access logs, error logs, journald, app stdout. Live tail across one host or a tag set, server-side regex filter, jump straight to the incident that brought you here.
Paths are read from the web-server config and the services that are actually installed, across eight sources — not typed in per host.
A vhost names its own access and error log. That association is made for you, with server-level logs as the fallback.
--since handled properly for syslog, auth and kernel..log file, for when the analysis happens elsewhere.journalctl -u nginx from the web UI is the same UX.Free tier: 7 days of archive; tail is unlimited.