Before you make any of the changes below, the indexes where you want these events to go to need to already exit. For example let's assume we have created the "WinEvtApp" index for Windows event log Application channel events, and "WinEvtSec" index for the Security channel events.