Maik Skoddow
Tera Patron
Tera Patron
find_real_file.png
I recommend bookmarking this article so that you are automatically notified by email when changes are made by me.
If you miss any content, please leave it as a comment and I will add it to this article.
 
Table of Contents

My library Knowledge Sources To Go is very popular, but it was intended mainly as a thematically grouped guide to standard sources and was provided by me as a PDF file. For certain topics, however, there is so much content that I can no longer include it in that document, as it cannot continue to grow forever.

For this reason, I have decided to handle such topics in individual community articles like this one instead.

 

 

What is Health Log Analytics (HLA)?

 

Health Log Analytics collects logs streaming into your ServiceNow instance from endpoints or data lakes, such as Splunk and Elasticsearch. The instance receives the logs via the MID Server connector instance. In ServiceNow it identifies and triages anomalies in your log data using unsupervised machine-learning (ML) models. It then groups the anomalies together and applies further algorithms to help identify the root cause of the issue.

 

MaikSkoddow_0-1673668068338.png

 

 

Product information

Entry point to the official product information pages

 

Product Documentation

Entry point to the official product documentation.

 

What is log analytics?

Overview of that topic with answers to the most important questions

 

Product Architecture Blueprint

Describes the inherent functionality of the product and outlines the technical components in the form of a diagram.

 

Deployment Guide

Provides implementation steps to achieve a prescribed set of product outcomes

 

 

 

Trainings & Courses

 

Health Log Analytics Essentials

This learning path begins with a required Technical Overview, which is a highly detailed look at the data journey and HLA processing. The path continues with Fundamentals which includes instruction on setting up log ingestions, tagging, and parsing to alert creation in Operator Workspace for triage and outage prevention. You will see how data shipping agents are used to ingest logs into a MID Server. Demonstrations include inputting both Linux system logs and Windows event logs. You will see how Health Log Analytics uses machine learning to generate patterns in log data and proactively alert you when anomalies are detected.

 

Health Log Analytics Extras

This course provides additional topics for learners already familiar with Health Log Analytics. Choose only the HLA topics you need, or view them all for more ideas on tuning your implementation.

 

 

 

Articles & Blog Posts

 

2021-07-09, by Will Hallam

Parsing Filebeat Logs In Health Log Analytics

This article shows an example of how to further refine log entries from Filebeat in order to empower AIOps.

 

2021-12-02, by Will Hallam

Configuring a Cribl Logstream Destination for Health Log Analytics

 

2022-02-25 by ServiceNow Support

Health Log Analytics 

Walkthrough the product with installation and configuration instructions.

 

2022-11-15, by Will Hallam

Sending Pod Logs From EKS Clusters into HLA

Here's an example of how I set up logs to flow from an EKS cluster into Health Log Analytics.

 

 

 

Videos & Podcasts

 

2024-10-23 by ServiceNow Community

Activate Predictive AIOps using Health Log Analytics 

Our Product Success team will demonstrate the setup and outcomes of Health Log Analytics to experience true predictive alert generation as part of our ITOM Health solution. Every ServiceNow ITOM customer will benefit from adding this key component to experience AIOps in action. Health Log Analytics (HLA) uses unsupervised machine learning to predict service issues before they happen. It identifies normal operating patterns in logs and other operational records, including distributed patterns that span multiple applications and infrastructure components. It then raises an actionable alert when it detects a significant antipattern indicating abnormal behavior, associating the alert with the corresponding application service.

 

2024-12-13 by ServiceNow Community

AIOps Power Hour - Health Log Analytics 

If ServiceNow ITOM AIOps is new to you or you need a refresher, join this webinar to learn from ITOM experts as they dive deep into various AIOps topics. This session will focus on Health Log Analytics.

 

2025-02-13 by ServiceNow Community

Systems Log Retriever demo 

This video demonstrates a powerful new feature in HLA just released in our February 2025 store update, version 35.0.26. Imagine being able to detect unknown errors and anomalies in your ServiceNow instance's systems log...that's exactly what this capability will allow you to do.

 

2025-03-25 by ServiceNow Community

Reduce Outages with Health Log Analytics 

Join this session to learn from ITOM experts as they dive deep into ServiceNow's AIOps solution. Attendees

 

 

 

Troubleshooting

 

Known Error Portal

 

Pre-configured filter for the respective topic. Remove the query string or modify the filters on the left side if you want to narrow down the search results in a different way.

 

 

Selected Articles

 

-

 

 

Comments
mvanatta1
Tera Contributor

Here are the Now Create Implementation Materials.  These have been vetted by the HLA team at ServiceNow:

Customer Workshop Preparation
PreWorkshop Readiness Kickoff
Product Architecture
Project Workshop
Deployment Implementation Guide (good insights!)

mominumarfi
Tera Contributor

In ServiceNow Event Management, HLA (High-Level Architecture) is a framework used for processing and managing events efficiently. It ensures that raw events from various sources are processed in a structured way to generate meaningful alerts and incidents.

Key Components of HLA in Event Management
1. Event Ingestion (Event Sources & Connectors)
• Events are received from multiple monitoring tools (e.g., SolarWinds, Splunk, SCOM, Nagios, SNMP traps, etc.).
• These events are collected through Event Connectors, MID Servers, or direct API integrations.
2. Event Rules & Pre-Processing
• Event Filters: Filters out unnecessary or duplicate events to reduce noise.
• Event Transform Rules: Maps raw event fields to standardized ServiceNow event fields.
3. Alert Processing (Event to Alert Conversion)
• Events are converted into alerts based on predefined rules.
• Alerts are enriched with CI (Configuration Item) Mapping, priority, and severity.
• De-duplication: Merges multiple identical events into a single alert to avoid redundancy.
4. Alert Correlation & Aggregation
• Uses Correlation Rules to group related alerts and reduce the number of incidents created.
• Automated Alert Actions (e.g., closing alerts, triggering workflows, notifying teams).
5. Incident Creation & Automated Response
• High-priority alerts trigger incident creation automatically.
• Integration with ITSM (Incident, Change, and Problem Management) for workflow automation.
6. Dashboards & Reporting
• Provides Event Management Dashboards for monitoring live alerts.
• Helps in Root Cause Analysis (RCA) using Service Graph and Impact Analysis.

Version history
Last update:
‎06-10-2025 04:23 AM
Updated by:
Contributors