Using the standard log search, I see my logs:
But when I try to set up a monitor, the search displays no logs of any kind - even without any criteria:
Have I misunderstood this functionality? Are logs a different type of entity that need to be converted / tagged in order to be considered as events? Or is there likely some other misconfiguration?
Logs and Events are different, both conceptually and in practice. Logs can contain information about events, but this information is local in context and incomplete. Events contain all the data necessary to describe an action taken on a system. For example, a log line from kubernetes might describe that a new container has been deployed. As an event, it would also contain context related to the whole system rather than just the program (e.g. kubectl). This would be data such as the cluster id, deployment name, deployment strategy, resources available on the host, request limits, cloud provider, data center, region, and so on.
You should either use a log monitor to do what you need, or instrument your system to send Events (such that they appear in the Event Explorer).