2(+) Apps 1 Site

[cboillot]

We have one site that has several 5+ apps on it. We are needing to send the logs from each app to a different index. Does anyone have a good suggestion on how to do this?

We had thought maybe something with the props and transform based on the App name, but we can't find a way to add that to the IIS logs.

[jacobpevans]

We'll likely need some additional information. Assuming 5+ apps are in one monitored log, could you provide an example part of the log (sensitive information removed) and explain how a human would discern which app each event belongs to?

[cboillot]

The only way we have figure out how to discern the app is the first folder grouping in the cs_uri_stem. So the cs_uri_stem of /vendorservices/VendorPayment/Payment/DollarAmountSearch.aspx would be from the App "Vendor Services".