What is the benefit of combining different web log files with different formats in terms of web application security? In other words, how does combining iis log file with apache log file help in identifying attacks?
What you are describing in your question is often called Informationfusion. By being able to connect different sources of logs you can more easily increase knowledge of the context of the requests and help to determine its interpretation.
The more logs you can put in context with other logs and information the more valuable they become.
For example say your webservers are all sent to a central logging device where their format is unified. Once your logs now are unified you can quite easily use commands like:
And your now sitting on your users ASN, IP-address, Nettrange, country and other nice stuff from all your webservers. Taking this a step further you now look for suspicious clients who are visiting your servers in patterns that is not normal, maybe looking for a focused attack.
Now with all your webserver logs you could also look more into any patterns that is seen on all or just some of your webservers much easier. Like this list from zeltser.com/log-management/security-incident-log-review-checklist:
If you convert IIS log files to Apache format, you can then run apache-scalp.googlecode.com on them.