It's not about the #logs. Do you try to ingest all #security logs? There's a better way.
Start with the threats. What are the biggest threats you face? How would those threats materialize into #risk?
Once you understand this, go looking for the logs. Which log sources contain IOCs for these threats? They may not be so-called security logs.
Tune aggressively. Stay focused. Continue to threat model.
Also, it's about the #logs.

