but if you are sending logs to something like ELK or splunk, you should be able to use a subquery to determine that information