We have one site that has several 5+ apps on it. We are needing to send the logs from each app to a different index. Does anyone have a good suggestion on how to do this?
We had thought maybe something with the props and transform based on the App name, but we can't find a way to add that to the IIS logs.
We'll likely need some additional information. Assuming 5+ apps are in one monitored log, could you provide an example part of the log (sensitive information removed) and explain how a human would discern which app each event belongs to?
The only way we have figure out how to discern the app is the first folder grouping in the cs_uri_stem. So the cs_uri_stem of /vendorservices/VendorPayment/Payment/DollarAmountSearch.aspx
would be from the App "Vendor Services".