Eventtypes are saved search definitions that categorize events. When an event matches the search, it gets the eventtype label. This lets you group events by meaning rather than raw field values.
Tags are simple labels attached to specific field-value pairs. For example, you could tag host="webserver01" with "production" and "web_tier" to classify it.
Together, eventtypes and tags create a semantic layer on top of raw data, making searches more intuitive: `eventtype=failed_login tag=production`.
eventtype=failed_login | stats count by src_ip