Would it be better to capture the timestamp at which the error aggregating occurred, for matching against the log file, or is the fact that the log logs the raw event alongside its exception going to be enough to find the failure in the log?