--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Log data auto-mapping and mapping # Log data auto-mapping and mapping in Health Log Analytics {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Log data auto-mapping and mapping in Health Log Analytics Health Log Analytics (HLA) automatically maps incoming log lines to key tags---service instance, component, and source type---to organize and analyze log data effectively. This automatic tagging is based on fields such assource,path, and others in the log entries. ServiceNow customers can customize or override this automatic mapping through JavaScript functions or leverage AI-assisted mapping via ServiceNow Otto for ITOM for enhanced accuracy and reduced manual effort. Show full answer Show less ## Key features * **Auto-mapping:** By default, HLA assigns service instances from data input setups and extracts components and source types from log fields like `source` and `path`. It also supports syslog tags when data is sent via Syslog. * **Custom JavaScript mapping:** Customers can manually define JavaScript functions to tailor mapping of logs to service instances and components, enabling refined organization aligned to their environment. * **Test mode for mapping scripts:** Test mode allows previewing mapping results without creating permanent objects or consuming storage, facilitating iterative script refinement. * **AI-assisted mapping with ServiceNow Otto for ITOM:** When activated, AI analyzes log patterns and suggests optimal mappings. This streamlines setup and enhances accuracy without needing custom scripts. * **Control over extracted data:** Users can configure HLA to extract specific desired terms or suppress extraction of redundant or non-descriptive log data to improve data relevance. * **Management of source counts:** System properties enable limits on the number of sources created per data input, preventing excessive source generation that could impact system stability. * **Binding logs to CMDB CIs:** Logs can be bound to service instances linked to Configuration Items (CIs) in the CMDB to enable correlation and support root cause analysis. * **Header properties detection:** HLA separates transport headers from inner log messages to focus analysis on actual log content rather than shipping metadata. ## Practical benefits for ServiceNow customers * Efficient log data organization by automatically or manually mapping logs to meaningful tags, improving searchability and analysis. * Flexible customization through JavaScript functions and test mode ensures mappings align precisely with customer environments and logging formats. * AI-powered mapping reduces manual configuration effort and improves accuracy of log categorization, accelerating deployment. * Control over data extraction enhances log data quality by focusing on relevant information and reducing noise. * Integration with the CMDB enables correlation of log data with IT assets, supporting faster root cause analysis and operational insights. * Proactive management of source creation limits helps maintain system performance and prevents disruptions in data input processing. By default, the HLA Engine tries to auto-map every incoming log line to the correct tags. You can change automatic mapping results manually by defining a JavaScript function. ## Auto-mapping incoming log lines {#hla-data-input-automapping__section_qqb_p4q_vmb} Health Log Analytics auto-mapping assigns log samples and metadata to three tags: service instance, component, and source type. The service instance assignment is based on the service instance specified in the data input setup. The remaining tags are assigned automatically. For example, in the following example log line, Health Log Analytics uses the "source" field to find the component and source type. {"beat":{"version":"6.8","name":"abc3.prd.acme.com","hostname":"abc3.prd.acme.com"},"@timestamp":"2020-08-27T10:12:24.792Z","prospector":{"type":"log"},"message":"**** User null is requesting the following page http://www.acme.com PROPS:{"subcategory1":"home pages","httpStatus":"200","loginLevel":"Anonymous","userAgent":"Mozilla5.0", ("pageUrl":\"http://www.acme.com","host":"abc3.prd.acme.com","@version":"1","source":"/opt/oracle/weblogic/abc/online_store3/logs/online_store3.out","offset":3951550786} In the example, Health Log Analytics extracts the string "online_store". It analyzes the following fields if they exist in the log line: source, path, channel, namespace_name, name, pod_name, source_name, and aws_lambda_name. When data is sent over Syslog, it also analyzes the syslog tag. Stop extraction of unneeded data : If an extracted string is not descriptive enough or contains redundant text or information, you can stop extracting such expendable data. For more information, see [Stop extraction of unneeded log data in Health Log Analytics](https://www.servicenow.com/docs/FMwh2zOT2ujiw88jaGI8NA "If an extracted string of data is not descriptive enough or contains redundant text or information, you can set Health Log Analytics to stop extracting such data from your logs."). Ensuring extraction of specific data : You can make sure that Health Log Analytics extracts specific desired terms. For more information, see [Extract specific log data in Health Log Analytics](https://www.servicenow.com/docs/JvU1Ij_R8IEUrbHsiFZmpg "Set Health Log Analytics to extract specified terms from logs and map them to specific components."). ## AI-assisted log mapping with ServiceNow Otto for ITOM {#hla-data-input-automapping__section_ai_assisted_mapping} AI-assisted log mapping using ServiceNow Otto for ITOM recommends optimal mapping configurations based on your log patterns. This approach reduces manual setup effort and improves accuracy without requiring custom JavaScript functions. For this capability to be enabled, the integration must be activated by selecting the Activate with AI option. This option enables AI-powered automatic parsing and mapping of log data to service instances and components for contextual alerts. When the integration is activated, ServiceNow Otto for ITOM collects and analyzes log data and suggests the best log field for mapping. You can override the suggested mapping by selecting a different log field from each list, if needed. For more information, see [Map logs to service instances, components, source types](https://www.servicenow.com/docs/4NDXkBa2GNaFuxZYNk6FqQ "Map your logs to service instances, components, and source types so that Health Log Analytics (HLA) can generate contextual alerts."). Note: AI-assisted log mapping depends on AI-assisted log parsing. When you activate an integration with AI, mapping starts only after the AI parser has generated a parser for the log format. By default, the system waits up to 7 minutes for the parser before it stops waiting. ## Mapping data input sources manually by defining a JavaScript function {#hla-data-input-automapping__section_bsk_54q_vmb} You can also change automatic mapping results manually by defining a JavaScript function. [Data input mapping](https://www.servicenow.com/docs/_oQ7QYez5I1Me1o0_73i~A "Mapping raw log data that streams into your ServiceNow instance determines how Health Log Analytics processes the data. If HLA doesn't discover properties automatically, you can map data input sources manually.") enables you to organize your log data by service instance and by availability zone. A single service instance can include multiple components, and a component can receive logs from many different source types. An service instance-component pair, however, is unique. Source types are based on a specific log structure and format. Service instances and components are defined more broadly and are therefore used mainly for logical mapping. Activating Test mode avoids blowing up Elasticsearch storage with sample data that is used only for perfecting the log data mapping. When the data input is in Test mode, Health Log Analytics doesn't create the source types, sources, or any other objects it creates in the standard flow. It saves the streamed data in dedicated temporary Elasticsearch indices that appear as components in the Log viewer. When you publish the script and exit Test mode, these temporary indices are deleted to minimize storage space consumption. When you're defining a JavaScript function, select Test to view the outcome of the script as it is currently specified. This functionality enables you to preview the created source types and sources. You can then refine the script until it achieves the desired outcome. For example, it can be useful to compare the test outcome of several versions of the JavaScript function. Note: By default, the test processes 100 log data samples. You can customize this number in the system properties. For more information, see [Configure global Health Log Analytics system properties](https://www.servicenow.com/docs/NSYOUBmEHV6dnFxf5yvC8g "Configure global Health Log Analytics system properties if you need to alter the default values, which typically should not be necessary."). During the data input setup, the system might create an excessive total number of data input sources. For example, this can be due to a faulty mapping script. You can configure limits for the number of sources created per data input in the [system properties](https://www.servicenow.com/docs/NSYOUBmEHV6dnFxf5yvC8g "Configure global Health Log Analytics system properties if you need to alter the default values, which typically should not be necessary."):{#hla-data-input-automapping__table_efl_hqt_fqb__entry__3} | System property | Description | Default | |-|-|-| | log_source.sources_warning_limit | The warning limit for the number of sources created per data input. | 500 | | log_source.sources_critical_limit | The critical limit for the number of sources created per data input. | 600 | [ ] {#hla-data-input-automapping__table_efl_hqt_fqb}The number of log sources that a specific data input has created displays in the Sources count field for that data input. When the total number of sources created during the data input setup reaches the warning limit, the system sends a warning notification by email. It also displays a message on the Data Input mapping, Log sources, and Data input pages. The notification and the message include the total number of sources created so far and the three data inputs that contributed the most sources to this total. If no action is taken, the system continues to create sources until the total number reaches the critical limit. When this happens, the data input setup and streaming from all data inputs stops automatically. You can't start data inputs again manually until the issue has been resolved. You can resolve this state by following the instructions in the [How to handle too many sources in data inputs \[KB0963067\]](https://support.servicenow.com/nav_to.do?uri=/kb?id=kb_article_view&sysparm_article=KB0963067) article in the Now Support Knowledge Base. ## Binding log data {#hla-data-input-automapping__section_dtv_gvq_vmb} Binding log data to Configuration Items (CIs) in the Configuration Management Database (CMDB) enables you to search the CMDB for endpoints that match a log. When you configure a data input, you bind log entries to a service instance that is bound to a CI in the CMDB. Binding log entries, service instances, and CIs enables the HLA Engine to correlate them for use in root cause analysis (RCA). For more information, see [Configure a Rsyslog, Filebeat, or Winlogbeat data input in Health Log Analytics manually](https://www.servicenow.com/docs/egwHZ9KKS8UjHdSPC~KrOA "Set up a data input for streaming log messages to your ServiceNow instance using an Rsyslog, Filebeat, or Winlogbeat agent.") or [Configure an Elasticsearch data input in Health Log Analytics manually](https://www.servicenow.com/docs/gbT7RQ07KBVCY6jR3C1o_g "Set up a data input for streaming log data from Elasticsearch indices to your ServiceNow instance."). * **[Map raw log data manually](https://www.servicenow.com/docs/_oQ7QYez5I1Me1o0_73i~A)** Mapping raw log data that streams into your ServiceNow instance determines how Health Log Analytics processes the data. If HLA doesn't discover properties automatically, you can map data input sources manually. * **[Source type and log source relationships](https://www.servicenow.com/docs/aCqse0lNSoOW9XtkmFEnTg)** Explore the many-to-many relationships between source types and log sources to help you optimize data input mapping in Health Log Analytics. * **[Header properties detection in Health Log Analytics](https://www.servicenow.com/docs/FcsWLOQ4Fj~ZAtnS62skqw)** In Health Log Analytics, automatic header properties detection separates the transport header from the inner log message and forwards only the inner log message to the source type structure. The inner message contains the actual log data without including shipping information. * **[Extract specific log data in Health Log Analytics](https://www.servicenow.com/docs/JvU1Ij_R8IEUrbHsiFZmpg)** Set Health Log Analytics to extract specified terms from logs and map them to specific components. * **[Stop extraction of unneeded log data in Health Log Analytics](https://www.servicenow.com/docs/FMwh2zOT2ujiw88jaGI8NA)** If an extracted string of data is not descriptive enough or contains redundant text or information, you can set Health Log Analytics to stop extracting such data from your logs.