As always - it depends. If you have multiple types of files within a single directory, it's easier to specify separate stanzas for them and assign different sourcetypes than to overwrite sourcetypes later with transforms. It's more straightforward. Remember that you can't have two separate monitors defined on the same object (for example /var/log as a whole) with two different sets of settings (like two different whitelists).
On the other hand, if you have a single directory with multiple files of the same type (possibly with a deep and variable subdirectory structure), it's easier to specify a general directory input.
So there is no single good practice here.
