My question is regarding indexing IIS logs. We have about 50 websites on a single server. 4 websites make up 1 environment, I am trying to find the best way to keeps the logs organized so it's easy to search per environment.
I tried to divide the websites by sourcetype, but I don't think that's the best approach as it will get confusing when we have 15 environments. Am I able to create a new field, set in the inputs.conf, for example env=master and all the 4 websites that make up the 'master' environment will fall under the search env="master"?