---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Set up log streaming via ITOM Gateway

# Set up log streaming via ITOM Gateway for Health Log Analytics {#ariaid-title1}

Release version: Australia  
Updated May 4, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Set up log streaming via ITOM Gateway to enable Health Log Analytics (HLA) to receive log data directly from external sources without a MID Server.

## Before you begin

* Review the [MID-less log streaming via ITOM Gateway in Health Log Analytics](https://www.servicenow.com/docs/Dy3xpF7022XHtmW7IiCVIg "Health Log Analytics (HLA) can receive log data from external sources directly through the ITOM Gateway, without routing data through a MID Server. This architecture supports cloud-native log sources such as Amazon Data Firehose, Cribl, and OpenTelemetry, and is required for high-volume HLA deployments.") documentation.
* Verify that Health Log Analytics version 36.0.19 or higher is installed on your instance.
* Verify that HLA provisioning is complete. Confirm that the AI Engine and Elasticsearch show green status at: `https://<instance>.service-now.com/xmlstats.do?include=services_status`.
* Verify that ITOM Cloud Services Core is installed on your instance.
* Verify that a JWT provider and token are configured on your instance. For more information, see [Configure a JWT provider and token](https://www.servicenow.com/docs/8ggBPj9hGXTx7a9H2mYJug "Configure a JSON Web Token (JWT) provider and token to authenticate log streaming integrations sending data to Health Log Analytics (HLA) via ITOM Gateway. This configuration is required before you can activate any ITOM Gateway integration in Integrations Launchpad.").
* (High-volume deployments only) If you expect 30,000 or more log events per second, contact ServiceNow Support to request infrastructure scaling. Proceed to the log streaming via ITOM Gateway setup procedure only after ServiceNow confirms that scaling is complete.  
  Provide the following information:{#hla-midless-streaming-setup__table_x2w_2vl_djc__entry__2}

  | Information | Example |
  |-|-|
  | Expected maximum log events per second | 100,000 log events per second from all sources |
  | Environment URL or URLs | \<customer\>prod.service-now.com |
  | Preferred migration date and time | Sundays, overnight US time preferred |
  [Table 1. Required information for infrastructure scaling]

  {#hla-midless-streaming-setup__table_x2w_2vl_djc}  
  Note:  
  Scaling requires a 6-hour change window and expected HLA downtime of 2--6 hours.
{#hla-midless-streaming-setup__ul_tm3_htl_djc}

Role required: evt_mgmt_admin

## About this task

Log streaming via ITOM Gateway removes the MID Server from the log ingestion path. External log sources send data directly to the ITOM Gateway, which routes it through the  Hermes  Messaging Service to the HLA AI Engine. For more information, see [MID-less log streaming via ITOM Gateway in Health Log Analytics](https://www.servicenow.com/docs/Dy3xpF7022XHtmW7IiCVIg "Health Log Analytics (HLA) can receive log data from external sources directly through the ITOM Gateway, without routing data through a MID Server. This architecture supports cloud-native log sources such as Amazon Data Firehose, Cribl, and OpenTelemetry, and is required for high-volume HLA deployments.").

Setup involves two stages: enabling ITOM Gateway and Hermes on your instance, and creating an integration from Integrations Launchpad.

Supported log sources include [AWS Firehose](https://www.servicenow.com/docs/HDeVwU9NgyiGAHHFl76QXw "Set up an integration to stream log data from Amazon Data Firehose directly to the ServiceNow datacenter, where it’s queued for Health Log Analytics processing. There’s no need to store AWS keys on your ServiceNow instance."), Cribl Stream, and OpenTelemetry Collector.

For more information about connecting a Cribl Stream instance to the ServiceNow
ITOM Gateway, see the [Set up Cribl to send data to HLA without a MID server](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2271238) \[KB2271238\] article in the Now Support knowledge base.

## Procedure

1. Enable ITOM Gateway and the  Hermes  Messaging Service.
   1. Navigate to All.
   2. In the navigation filter, enter sys_service.list and press Enter.
   3. In the Services table, verify that an entry for `itom-hla-gw` exists with a corresponding `sys_service_endpoint` entry.
   4. Navigate to AllMID ServerProperties.
   5. Search for the property `mid.hla.itom_gateway_streaming.enabled` and set it to true.  
      All MID Servers automatically switch to ITOM Gateway streaming mode.

   {#hla-midless-streaming-setup__substeps_btr_vvl_djc}  
   Note:  
   MID Servers re-establish gRPC connections. Data inputs are not restarted.
2. Set up the integration from Integrations Launchpad.  
   For more information, see [Set up integrations for Health Log Analytics from the Integrations Launchpad](https://www.servicenow.com/docs/NEe1QyWtmaSye1zXdr5Btw "Set up integrations from the Event Management Integrations Launchpad in Service Operations Workspace for ITOM.").
3. On the Overview tab of the integration, confirm that the ITOM Gateway URL, Integration ID, and Token values are populated.  
   If these values appear, log streaming via ITOM Gateway setup is complete.

*[\>]: and then