Configuring a Cribl Logstream Destination for Health Log Analytics

[Will Hallam]

NOTE: This procedure enables TLS with built-in/self-signed certificates.  For production deployment you should follow your company’s standard PKI practices regarding certificate configuration.  The instructions in this article are provided as-is, with no implied or explicit support or guarantees.

Prerequisites

1. HLA is provisioned on your ServiceNow instance, per https://docs.servicenow.com/bundle/rome-it-operations-management/page/product/health-log-analytics-a...
2. A MID server is configured on your instance; a MID used for HLA should be dedicated to that purpose

In the ServiceNow instance:

1. Navigate to Health Log Analytics->Data Inputs
2. Click “New”
3. Select “TCP”
4. Populate the following fields:
   1. Name: a meaningful name for the data input
   2. Port: an available listening port on the selected MID server
   3. MID: the MID server to receive the log data
   4. Application service: the targeted application service (create one if needed)
   5. Advanced: check this box
   6. Use SSL/TLS: check this box
5. Click Submit

 

In the Cribl UI:

1. Navigate to Destinations
2. Select “TCP JSON”
3. Populate the following fields:
   1. Output ID: a meaningful name for the destination
   2. Address: the IP address for the MID selected above
   3. Port: the port selected in the Data Input
   4. TLS Settings (Client Side)->Enabled: Yes
   5. Validate server certs: set to "No" if using self-signed certificates
4. Click Save

To send data to the new Destination, add a Route with the Output set to “tcpjson:<Destination Name>” and associate it with an applicable Pipeline.