Ask HN: What's your preferred log analyzer for clustered webservers?

My company just tried out a log analyzer that didn't work out in the usuability department (had to write an exclusion regular expression to filter results for each query) and we're working on finding a new one.

Therefore I'd like to ask the Hacker News community which log analyzers you've used in the past for clustered webserver environments and what the upsides / downsides of those tools are.

In case it matters, we're using all IIS servers in our cluster.