Really having a tough time, but all has been restaged. I have 8 clean webservers and a logging server (all Ubuntu-server). I am reading up on syslog-ng and the config, etc. but the 1st problem I am just getting right is apache. From what I am reading (correct if necessary), I need to configure apache (I would assume in each vhost file) to say write the log to syslog-ng. In the syslog-ng config I will play, set the filter, destination, etc. but let me start on the apache thing.

Currently as an example most of the sites log entries look like this;

CustomLog /var/log/apache2/ws8.domain.com-access_log combined
ErrorLog /var/log/apache2/ws8.domain.com-error_log

So I am guessing that must change to say to write to syslog-ng somehow right?

I have played on / off for months with no luck, so starting from scratch hoping to get this going soon! Thanks as always.

This can be easily done for ErrorLog that can use syslog for logging. You can read this for details.
For CustomLog you have to either use the perl scipt from the above link, or use snare for apache.

Regards