topic Re: Log ingest rules with 'log source origin' in Log Analytics

Log ingest rules with 'log source origin'

Carl_Me — Fri, 28 Nov 2025 18:05:32 GMT

I have IIS servers with many "log.source" files that are automatically discovered by OneAgent.

I'm trying to find a solution to ingest these logs, but I have far too many different "log.source" files.

I thought about using the "Log Source Origin" matcher with "IIS Log Detector," but it didn't find anything.

My OneAgent version is up to date.

How can we use the "Log Source Origin" matcher?

Another question about the "set-app-log-content-access" option in OneAgent. When should we enable it? Because apparently, I have logs being ingested without having this function enabled...

Thanks!

Re: Log ingest rules with 'log source origin'

rastislav_danis — Mon, 01 Dec 2025 11:29:50 GMT

You can match logs via process group or use log.source with asterisks.

Re: Log ingest rules with 'log source origin'

HansLougas — Wed, 10 Dec 2025 15:40:36 GMT

hey @Carl_Me !

If you look at your logs, they should all have the attribute process.technology matching "IIS". Does this help you?

Re: Log ingest rules with 'log source origin'

Carl_Me — Wed, 10 Dec 2025 19:10:25 GMT

Yes 🙂 Thanks