Map logs to service instances, components, and source types for contextual alerts in Health Log Analytics

Map your logs to service instances, components, and source types so that Health Log Analytics (HLA) can generate contextual alerts.

Avant de commencer

Configure and activate an integration before you perform this procedure. For more information, see Set up integrations for Health Log Analytics from the Integrations Launchpad.

Role required: evt_mgmt_admin

Pourquoi et quand exécuter cette tâche

HLA uses the settings that you define in this procedure to identify service instances, components, and source types in log examples and map log data to them automatically. HLA links logs to the corresponding service instances, components, and source types for contextualized analysis. By default, automatic log context mapping is enabled.

AI suggests the optimal log field for mapping to service instances and components. When you use the AI-suggested field or if it’s the default field, an AI sparkle icon () appears. You can select a different field if needed. If AI can't find an optimal match or if your selected field is missing from the sample log, HLA uses the system default.

Important :

If a manually defined mapping script exists in the Data Input Mapping page, automatic mapping overwrites it.

Procédure

1. Navigate to Workspaces > Service Operations Workspace.
2. From the bottom of the navigation pane, select the AIOps configuration center icon .
   The ITOM AIOps configuration center page appears. The configuration center is a centralized workspace. Use it to configure and manage AIOps features from a single place.
3. Under Integrations, select Manage installed integrations.
   The Integrations Launchpad appears.
4. On the Installed integrations tab, search for an integration and open it.
   The Overview screen displays.
5. Under Next steps, on the Log context mapping card, select View mapping.
   The Log context mapping table displays.
6. Select the relevant integration.
   The integration's Log context mapping page displays.

   Remarque :

   If the selected integration has features that are unsupported in Service Operations Workspace, you’re referred to the Data Input Mapping page. For more information, see Map raw log data in Health Log Analytics.
7. Facultatif : Turn off automatic service instance and component mapping by using the toggle.
   If you turn off automatic mapping, you must define a mapping script manually in the Data Input Mapping page. For more information, see Map raw log data in Health Log Analytics.

   The remaining steps in this procedure are only relevant when automatic mapping is enabled.

   Remarque :

   When you open the Log context mapping form for the first time, the system default values display in all fields.
8. Configure the log field by which HLA identifies a service instance from the Raw log field drop-down list.
   A service instance represents a complete business process.
9. Configure the log field by which HLA identifies a component from the Raw log field drop-down list.
   A component represents the smallest part of a service instance. A single service instance typically comprises multiple components.
10. Facultatif : Select Preview to view the service instances and components the system has identified based on your settings in the previous steps.
    The service instances and components are grouped by service.
11. In Advanced settings, review the fallback service and set the log field by which the system identifies a source type.
    1. In the Selected fallback service field, review the fallback service the system uses if it can't identify the service instance in the log data.
       The displayed fallback service is the default service instance that you selected when you configured the integration.

       Remarque :

       For some integrations, such as Filebeat, this field shows N/A instead of a value. In these integrations, if HLA can't identify the service instance, it uses the system default value rather than the fallback service.
    2. Configure the log field by which HLA identifies a source type from the Raw log field drop-down list.
    3. Facultatif : Select Preview to view the log sources the system has identified based on your source type settings.
12. Facultatif : In the Simulator, review a log processing simulation based on your current mapping.
    The provided simulation helps you understand how the current mapping impacts HLA log processing. Use this information to fine-tune your settings:

    • The Log fields tab shows the default service, component, and source type and the raw log.
    • The Extracted values tab shows the service instance, component, and source type that the system has extracted from the raw log based on your current settings.
13. Select Save mapping to save your settings.