My thought was to have each server send its logs via NXLog to our central logstash server. I'm ok with that except for one question: Is it better to run the logstash server with one input on one port that ALL of these logs get shipped to, or is it better to run multiple inputs on different ports and have each of those types of logs get separated later via a type field, etc.?
If you can use the same codec for all messages I don't see why it matters. You should be able to tag the messages with a type on the NXLog side.
Then on the outputs, am I better off putting ALL of these logs into one elasticsearch index, or splitting them up, one index per type?
How many types do you think you'll have, eventually? There is a fixed per-shard overhead so if you have too many types and too many days of logs (assuming daily indexes) you might consume a lot of cluster capacity just for keeping the shards alive.
Fields with a given name can only have one mapping in an index, i.e. if the field foo is an integer for type A it must also be an integer for type B. If you have multiple indexes this limitation won't exist. On the other hand, I find it less confusing when fields behave the same regardless of the event type.