--- sourceDocument: Brazil Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Explore # Exploring Log Export Service (LES) {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Exploring Log Export Service (LES) Log Export Service (LES) offers ServiceNow customers scalable, near real-time integration with external analytic tools to enhance security threat detection, application performance optimization, and user experience monitoring. LES uses the Hermes Messaging Service, built on Apache Kafka, to stream log events efficiently from your ServiceNow instance to your preferred analytics platforms, whether cloud-based or on-premises. Show full answer Show less ## Key Features * **Multiple Connectivity Options:** LES supports three ways to connect and export log data: * **Dedicated MID Server:** Installed on-premises or in the cloud, it continuously pulls log events from Hermes and pushes them to analytic tools via REST. * **Kafka Connector:** A connector from your log analytics solution (e.g., Splunk) that links directly with Hermes Messaging Service to stream logs. * **Direct Kafka System Connection:** Your Kafka system can connect natively to Hermes using Kafka protocols to pull log events. * **Guided Setup and Configuration:** The LES application from ServiceNow Store provides guided setups for configuring Kafka consumers and MID Server consumers, creating log source configurations, and managing log destinations. * **Log Management and Reporting:** LES includes dashboards to review log sizes and allows replaying historical logs to backfill downstream systems, ensuring comprehensive log analysis and data integrity. * **Role-Based Access:** LES assigns specific roles such as Application Admin (for managing configurations) and System Administrator (for installation and setup) to streamline administration and control. ## Key Outcomes * Enable real-time detection and analysis of security threats within your ServiceNow environment by integrating with advanced analytic tools. * Optimize ServiceNow application performance and enhance user experience monitoring through continuous log streaming and analysis. * Leverage flexible connectivity methods to suit your infrastructure, ensuring seamless integration with existing analytics platforms. * Gain operational control with guided setups and comprehensive reporting to manage log exports efficiently and troubleshoot issues proactively. LES provides scalable, near real-time integration with analytic tools for security threat detection, performance optimization, and user experience monitoring. If you're new to LES, read this overview section to learn what the tool can do Verify your entitlements to confirm you have access to Log Export Service. ## Log Export Service overview {#les-landing-page__section_lcq_ckz_mdc} LES enables you to use your analytic solutions to: * Detect ServiceNowsecurity threats and analyze security incidents * Troubleshoot and optimize ServiceNow application performance * Monitor and optimize ServiceNow user experience {#les-landing-page__ul_xdg_vh4_21c} LES leverages Hermes Messaging Service, a multi-tenant, multi-cluster data transport and queuing service built on Apache Kafka. This ServiceNow AI Platform capability enables your instance to produce and consume large volumes of Kafka events. Apache Kafka is an open-source data streaming platform that provides a single integration point for exchanging data across business systems. LES forwards a copy of the log events as they are generated to Hermes Messaging Service. Hermes Messaging Service is available as part of Stream Connect, Log Export Service, and Instance Data Replication (IDR). External log analytic systems, either in the cloud or on-premises, can consume the log events from Hermes Messaging Service. LES provides three connectivity options: * Dedicated MID Server: A dedicated MID Server installed on-premises or in the cloud automatically connects to Hermes Messaging Service, pulls log events continuously, and pushes them to log analytic tools through a REST connection. * Kafka connector from your log analytic solution: A Kafka connector from your log analytics product (for example, Splunk) installed on-premises or in the cloud automatically connects to Hermes Messaging Service, pulls log events continuously, and pushes them to log analytics tools. * Direct Kafka system connection: Your Kafka system connects directly with Hermes Messaging Service and uses native Kafka protocol commands to pull log events. {#les-landing-page__ul_obt_kl4_21c} Note: If your Kafka message exceeds the configured memory buffer, Hermes returns an error indicating the message is larger than the configured total memory buffer. To configure and manage LES, install it from ServiceNow Store. The LES application provides Guided Setups to install the service, pages to configure the service (log sources, consumers, and destinations), and reports to understand log creation and consumption. Note: To create a custom source configuration, see [Create a log source configuration](https://www.servicenow.com/docs/YqltI2C6YNrcn6E5svm2Aw "Regulate and set filters on the logs to be forwarded by creating a log source configuration."). ## Log Export Service users {#les-landing-page__section_kbs_pkd_qjb} The following roles can use LES. {#les-landing-page__table_ph5_fns_xjb__entry__2} | Role | Description | |-|-| | Application admin (sn_logstoanalytics.admin) | The LES application installs this role, allowing non-admin users to configure and manage LES. | | System administrator (admin) | Required to install the LES Store application. | [Table 1. LES user roles] {#les-landing-page__table_ph5_fns_xjb} ## Log Export Service benefits {#les-landing-page__section_b3z_nm2_bbc} {#les-landing-page__table_c3z_nm2_bbc__entry__3} | Benefit | Feature | User | |-|-|-| | Create log source configuration to set filters on the logs | [Create a log source configuration](https://www.servicenow.com/docs/YqltI2C6YNrcn6E5svm2Aw "Regulate and set filters on the logs to be forwarded by creating a log source configuration.") | Application admin | | Experience guided setup for Kafka consumers | [Guided setup for Kafka consumers](https://www.servicenow.com/docs/Mba3e9Ul_CPBbPgBQgWMPw "Implement the following steps for a complete guided setup for Kafka consumers.") | System administrator | | Experience guided setup for MID server consumers | [Guided setup for MID Server consumers](https://www.servicenow.com/docs/ftuuaDK1giHhgB3fbgFktw "Implement the following steps for a complete guided setup for MID Server consumers.") | System administrator | | Examine the log report dashboard to analyze the size of each data log | [Review log report](https://www.servicenow.com/docs/8nN0Vb65zBTZhEm2HSNEPg#les-review-log-exports "Analyze the size of each data log by reviewing the log report dashboard.") | System administrator or Application admin | | Replay historical log data from a supported table to backfill downstream systems retroactively | [Export existing logs on demand](https://www.servicenow.com/docs/jHrZ9GXZqyOY6hXk_ysHjA "Replay historical log data from a supported table to a Hermes topic by creating and starting a Backfill Run. Use this process to export logs from a specific time range for analysis or archival.") | Application admin or System administrator | [Table 2. LES benefits and features] {#les-landing-page__table_c3z_nm2_bbc} ## What to explore next {#les-landing-page__cf-exploring-parent-links} To learn more about using Log Export Service, see: * [Administering Log Export Service (LES)](https://www.servicenow.com/docs/_o0wT5wznieYDCJLxdrwWg "Use LES to create log source configurations, manage multi-topics per source type, and run on-demand exports of existing logs.") * [Configuring Log Export Service (LES)](https://www.servicenow.com/docs/zYF6u_yw2y6zzYHboNYeYA "Use guided setup to step through the initial configuration of LES. Guided setup assists you with planning the roll-out of the product and performing the basic configuration to go live.") * [Using Log Export Service (LES)](https://www.servicenow.com/docs/8nN0Vb65zBTZhEm2HSNEPg#les-use "Use LES to review the log report dashboard.") * [Log Export Service (LES) references](https://www.servicenow.com/docs/Dm4ruu221yb363dnQmeE2Q "Find all the miscellaneous information about LES in the reference section.") {#les-landing-page__ul_fhy_xfw_sbc} * **[Log sources](https://www.servicenow.com/docs/jLyNdWlySNZDgPQfPaFbSg)** Log Export Service (LES) can export log sources from some System Log Tables, Audit Tables, and Application Node Log Files.