There isn't a right or wrong way of doing this. It really depends on which approach makes sense for you given your context.
With that being said though :), I would go for solution 2 and send the log level inside the body. The reason is that you are dealing with one type of resource here, a
LogMessage with two properties, the log level and the text message. It's more intuitive to send one type of resource to one base endpoint. In solution 1, you are sending one resource to many endpoints.
Another intuitive thing would be that, at some later moment, I'm expecting to see these log messages and inspect them to draw some conclusions about the process they are logging. Will you again think of creating different endpoints to retrieve different error levels? Or will you have only one endpoint that retrieves all types of log details? If you have one (and inevitabily you will need to provide one, because a client might want to see all logs from the past day no matter their severity, for example), in the results you will have to include the level property in the body of each
LogMessage resource, so that your clients can differentiate between the severity of the messages.
So for these reasons, I would prefer solution 2, even though, as I said, there aren't any hard rules for how to implement this.