--- sourceDocument: Zurich Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Explore # Exploring Log Export Service (LES) {#ariaid-title1} * Release version: Zurich * * Updated July 31, 2025 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Exploring Log Export Service (LES) The Log Export Service (LES) in ServiceNow provides a highly scalable, near real-time integration with external analytic tools, enabling advanced monitoring and analysis of your ServiceNow environment. LES helps detect security threats, analyze incidents, troubleshoot application performance, and monitor user experience by exporting log events efficiently. It leverages the Hermes Messaging Service, a multi-tenant, multi-cluster data transport and queuing service built on Apache Kafka, to stream large volumes of log events from your instance to analytic solutions. Show full answer Show less ## Key Features * **Integration with Analytic Tools:** LES supports three connectivity options for consuming logs: * Dedicated MID Server that pulls logs continuously and pushes them via REST. * Kafka connector from your log analytic tool (e.g., Splunk) to pull logs continuously. * Direct Kafka system connection using native Kafka protocols. * **Hermes Messaging Service:** Acts as the central data streaming layer built on Apache Kafka, enabling seamless log event export and consumption. * **Guided Setup and Configuration:** LES application, installed from the ServiceNow Store, provides guided setups for configuring log sources, Kafka consumers, and MID Server consumers, along with dashboards for log analysis. * **Log Source Options:** Supports exporting logs from System Log Tables, Audit Tables, and Application Node Log Files. ## Key Outcomes * **Improved Security and Incident Management:** Quickly detect and analyze security threats within your ServiceNow environment. * **Enhanced Performance Monitoring:** Troubleshoot and optimize application and user experience performance using your preferred analytic tools. * **Operational Efficiency:** Simplified setup and maintenance through guided workflows reduce administrative overhead. * **Flexible Integration:** Multiple connectivity options allow you to integrate LES with both cloud and on-premises analytic solutions according to your infrastructure needs. ## Roles and Responsibilities * **Application Admin:** Manages log source configurations and can use the LES application without full admin rights. * **System Administrator:** Responsible for installing the LES application, setting up Kafka and MID Server consumers, and overall system administration tasks. ## Next Steps To fully leverage LES, explore detailed guides on administering, configuring, and using Log Export Service. Begin by installing the application from the ServiceNow Store and follow the guided setup to configure your log sources and consumers. The LES service provides a highly scalable and near real-time integration with your analytic tools that is easy to set up and maintain. If you're new to LES, read this overview section to learn what the tool can do. Check your entitlements to determine whether you have access to Log Export Service. ## Log Export Service overview {#les-landing-page__section_lcq_ckz_mdc} The integration tool allows you to leverage your analytic solutions to perform the following: * Detect ServiceNow security threats and analyze security incidents * Troubleshoot and optimize ServiceNow app performance * Monitor and optimize ServiceNow user experience {#les-landing-page__ul_xdg_vh4_21c} LES leverages a ServiceNow AI Platform capability called the Hermes Messaging Service, which is a multi-tenant, multi-cluster, data transport, and queuing service built on Apache Kafka that enables your instance to produce and consume large volumes of Kafka events. Apache Kafka is an open-source data streaming platform that provides a single integration point for exchanging data across business systems in your organization. LES forwards a copy of the log events as they're generated to the Hermes Messaging Service. The Hermes Messaging Service is a multi-tenant, multi-cluster, data transport, and queuing service built on Apache Kafka that enables your instance to produce and consume large volumes of Kafka events. The Hermes Messaging Service is a ServiceNow AI Platform capability that is available as part of Stream Connect, Log Export Service (LES), and Instance Data Replication (IDR). The external log analytic systems, either in the cloud or on-prem, can use and consume the log events from the Hermes Messaging Service. LES provides three connectivity options to consume the logs: * Dedicated MID Server: A dedicated MID Server is installed on-prem or in the cloud that automatically connects to Hermes Messaging Service, pulls log events from it continuously and then pushes them to log analytic tools via a REST connection. * Leverage Kafka connector from your log analytic solution (for example, Splunk): A Kafka connector from your log analytics product of choice is installed on-prem or in the cloud that automatically connects to Hermes Messaging Service, pulls log events from it continuously and then pushes them to log analytics tools. * Directly from your Kafka system: Your Kafka system connect directly with the Hermes Messaging Service and use its native Kafka protocol commands and connectivity to pull logs events from it. {#les-landing-page__ul_obt_kl4_21c} Note: If your Kafka message exceeds the configured memory buffer, Hermes may return an error indicating that it's larger than the total memory buffer you've configured. To configure and manage LES you need to install it from ServiceNow Store. The LES application provides Guided Setups to help you install the service, pages to configure the service (log sources, consumers and destinations) and reports to understand log creation and consumption. Note: You can also create a new source configuration. See [Create a log source configuration](https://www.servicenow.com/docs/4yj1NjflqnhFlC~0VTKX4g "Regulate and set filters on the logs to be forwarded by creating a log source configuration.") for more information. ## Log Export Service users {#les-landing-page__section_kbs_pkd_qjb} Log Export Service has the following users.{#les-landing-page__table_ph5_fns_xjb__entry__2} | Users | Description | |-|-| | Application admin \[sn_logstoanalytics.admin\] | This role is installed along with the LES application and allows a non-admin to use the application. | | System administrator \[admin\] | Admin role is required for the setup of the LES store application. | [ ] {#les-landing-page__table_ph5_fns_xjb} ## Log Export Service benefits {#les-landing-page__section_b3z_nm2_bbc} {#les-landing-page__table_c3z_nm2_bbc__entry__3} | Benefit | Feature | Users | |-|-|-| | Create log source configuration to set filters on the logs | [Create a log source configuration](https://www.servicenow.com/docs/4yj1NjflqnhFlC~0VTKX4g "Regulate and set filters on the logs to be forwarded by creating a log source configuration.") | Application admin | | Experience guided setup for Kafka consumers | [Guided setup for Kafka consumers](https://www.servicenow.com/docs/49qP5D4dqMRZMmMYMw51Rw "Implement the following steps for a complete guided setup for Kafka consumers.") | System administrator | | Experience guided setup for MID server consumers | [Guided setup for MID Server consumers](https://www.servicenow.com/docs/pKaiijbHq~rSMQ9jpI02MQ "Implement the following steps for a complete guided setup for MID Server consumers.") | System administrator | | Examine the log report dashboard to analyze the size of each data log | [Review log report](https://www.servicenow.com/docs/QnY_BBAKur7xZwkAoGx1fA#les-review-log-exports "Analyze the size of each data log by reviewing the log report dashboard.") | System administrator or Application admin | [ ] {#les-landing-page__table_c3z_nm2_bbc} ## What to explore next {#les-landing-page__cf-exploring-parent-links} To learn more about using Log Export Service, see: * [Administering Log Export Service (LES)](https://www.servicenow.com/docs/6meie69TRaUd5M4pbLpI~g "Use LES to create log source configuration and multi-topics for each source type.") * [Configuring Log Export Service (LES)](https://www.servicenow.com/docs/9Xkvuou6WL44DK0h24XTXA "Use guided setup to step through the initial configuration of LES. Guided setup assists you with planning the roll-out of the product and performing the basic configuration to go live.") * [Using Log Export Service (LES)](https://www.servicenow.com/docs/QnY_BBAKur7xZwkAoGx1fA#les-use "Use LES to review the log report dashboard.") * [Log Export Service (LES) references](https://www.servicenow.com/docs/IYPmDtVbSjCewnnAHsHqdQ "Find all the miscellaneous information about LES in the reference section.") {#les-landing-page__ul_fhy_xfw_sbc} * **[Log sources](https://www.servicenow.com/docs/_bdVMkIis5OU9Un8vKDaag)** Log Export Service (LES) can export log sources from some System Log Tables, the Audit Table, and Application Node Log Files.