Which log shipper? I believe most folks are sending their logs all on via their forwarder and then doing separation in their aggregation tool.