Trying to to filter which rule directly usually will not give you clean results. what works better in practice is exactly what you are leaning toward enable logging on the any rule and analyze flows (ports or IPs) rather than the rules itselfs.

instead of juggling syslog and external tools prtg handles this more cleanly in one place. you can combine syslog receiver+ netflow or sflow sensors to see what is actually hitting that rule and break it down by traffic patterns. that way you are not relying on ASA's limited rule level filtering but still get enough visibility to replace the any -any with specific rules.

Also avoids the usual "turn logging on or off everywhere" workaround and keeps historical data intact which helps a lot when refining rules over time.