- Post History
- Subscribe to RSS Feed
- Mark as New
- Mark as Read
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
01-13-2023 08:13 PM - edited 06-10-2025 04:23 AM
If you miss any content, please leave it as a comment and I will add it to this article.
Table of Contents |
My library Knowledge Sources To Go is very popular, but it was intended mainly as a thematically grouped guide to standard sources and was provided by me as a PDF file. For certain topics, however, there is so much content that I can no longer include it in that document, as it cannot continue to grow forever.
For this reason, I have decided to handle such topics in individual community articles like this one instead.
What is Health Log Analytics (HLA)?
Health Log Analytics collects logs streaming into your ServiceNow instance from endpoints or data lakes, such as Splunk and Elasticsearch. The instance receives the logs via the MID Server connector instance. In ServiceNow it identifies and triages anomalies in your log data using unsupervised machine-learning (ML) models. It then groups the anomalies together and applies further algorithms to help identify the root cause of the issue.
Entry point to the official product information pages
Entry point to the official product documentation.
Overview of that topic with answers to the most important questions
Product Architecture Blueprint
Describes the inherent functionality of the product and outlines the technical components in the form of a diagram.
Provides implementation steps to achieve a prescribed set of product outcomes
Trainings & Courses
Health Log Analytics Essentials
This learning path begins with a required Technical Overview, which is a highly detailed look at the data journey and HLA processing. The path continues with Fundamentals which includes instruction on setting up log ingestions, tagging, and parsing to alert creation in Operator Workspace for triage and outage prevention. You will see how data shipping agents are used to ingest logs into a MID Server. Demonstrations include inputting both Linux system logs and Windows event logs. You will see how Health Log Analytics uses machine learning to generate patterns in log data and proactively alert you when anomalies are detected.
This course provides additional topics for learners already familiar with Health Log Analytics. Choose only the HLA topics you need, or view them all for more ideas on tuning your implementation.
Articles & Blog Posts
2021-07-09, by Will Hallam
Parsing Filebeat Logs In Health Log Analytics
This article shows an example of how to further refine log entries from Filebeat in order to empower AIOps.
2021-12-02, by Will Hallam
Configuring a Cribl Logstream Destination for Health Log Analytics
2022-02-25 by ServiceNow Support
Walkthrough the product with installation and configuration instructions.
2022-11-15, by Will Hallam
Sending Pod Logs From EKS Clusters into HLA
Here's an example of how I set up logs to flow from an EKS cluster into Health Log Analytics.
Videos & Podcasts
2024-10-23 by ServiceNow Community
Activate Predictive AIOps using Health Log Analytics
Our Product Success team will demonstrate the setup and outcomes of Health Log Analytics to experience true predictive alert generation as part of our ITOM Health solution. Every ServiceNow ITOM customer will benefit from adding this key component to experience AIOps in action. Health Log Analytics (HLA) uses unsupervised machine learning to predict service issues before they happen. It identifies normal operating patterns in logs and other operational records, including distributed patterns that span multiple applications and infrastructure components. It then raises an actionable alert when it detects a significant antipattern indicating abnormal behavior, associating the alert with the corresponding application service.
2024-12-13 by ServiceNow Community
AIOps Power Hour - Health Log Analytics
If ServiceNow ITOM AIOps is new to you or you need a refresher, join this webinar to learn from ITOM experts as they dive deep into various AIOps topics. This session will focus on Health Log Analytics.
2025-02-13 by ServiceNow Community
This video demonstrates a powerful new feature in HLA just released in our February 2025 store update, version 35.0.26. Imagine being able to detect unknown errors and anomalies in your ServiceNow instance's systems log...that's exactly what this capability will allow you to do.
2025-03-25 by ServiceNow Community
Reduce Outages with Health Log Analytics
Join this session to learn from ITOM experts as they dive deep into ServiceNow's AIOps solution. Attendees
Troubleshooting
Known Error Portal
Pre-configured filter for the respective topic. Remove the query string or modify the filters on the left side if you want to narrow down the search results in a different way.
Selected Articles
-
- 1,981 Views

- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
Here are the Now Create Implementation Materials. These have been vetted by the HLA team at ServiceNow:
Customer Workshop Preparation
PreWorkshop Readiness Kickoff
Product Architecture
Project Workshop
Deployment Implementation Guide (good insights!)
- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
In ServiceNow Event Management, HLA (High-Level Architecture) is a framework used for processing and managing events efficiently. It ensures that raw events from various sources are processed in a structured way to generate meaningful alerts and incidents.
Key Components of HLA in Event Management
1. Event Ingestion (Event Sources & Connectors)
• Events are received from multiple monitoring tools (e.g., SolarWinds, Splunk, SCOM, Nagios, SNMP traps, etc.).
• These events are collected through Event Connectors, MID Servers, or direct API integrations.
2. Event Rules & Pre-Processing
• Event Filters: Filters out unnecessary or duplicate events to reduce noise.
• Event Transform Rules: Maps raw event fields to standardized ServiceNow event fields.
3. Alert Processing (Event to Alert Conversion)
• Events are converted into alerts based on predefined rules.
• Alerts are enriched with CI (Configuration Item) Mapping, priority, and severity.
• De-duplication: Merges multiple identical events into a single alert to avoid redundancy.
4. Alert Correlation & Aggregation
• Uses Correlation Rules to group related alerts and reduce the number of incidents created.
• Automated Alert Actions (e.g., closing alerts, triggering workflows, notifying teams).
5. Incident Creation & Automated Response
• High-priority alerts trigger incident creation automatically.
• Integration with ITSM (Incident, Change, and Problem Management) for workflow automation.
6. Dashboards & Reporting
• Provides Event Management Dashboards for monitoring live alerts.
• Helps in Root Cause Analysis (RCA) using Service Graph and Impact Analysis.