For the "when to use" question, I think this is really a workflow thing.
Tags allow people to identify key-value pairs (aka fieldname fieldvalue pairs) that categorize items. This can be done incrementally and collectively. For example, if you notice a host should be tagged as a webserver and it is not, you can add it at the time that you are viewing it. If the tags are shared (not private), this means that some grouping of people can be collaboratively creating these groupings, building shared knowledge.
Eventtypes allow people to create labels based on search expressions. This means you have one definition of what that label that is centrally managed in a single configuration. In cases where that search expression will cover the entire category now and in the future, it can be simpler and more managable, but if if the category definition is an arbitrary list of values, it would be a poor workflow fit for maintenance reasons.
There are probably other differentiators in the messy details, but I think this is the main distinction.
... View more
