--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # MID-less log streaming via ITOM Gateway # MID-less log streaming via ITOM Gateway in Health Log Analytics {#ariaid-title1} Release version: Australia Updated May 4, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of MID-less log streaming via ITOM Gateway in Health Log Analytics Health Log Analytics (HLA) now supports receiving log data directly from external cloud-native sources via the ITOM Gateway, eliminating the need for a MID Server. This enhancement is designed to handle high-volume log streaming efficiently, improving throughput and scalability for ServiceNow customers managing large log datasets. Show full answer Show less ## How Log Streaming via ITOM Gateway Works External log sources send data to the ITOM Gateway using gRPC. The ITOM Gateway then forwards this data to the Hermes Messaging Service, which delivers it to the AI Engine---the processing back-end of HLA. This architecture separates streaming from ingestion, allowing better performance compared to direct MID Server streaming. ## Deployment Scenarios * **Standard Deployment:** Suitable for typical log volumes. Customers enable ITOM Gateway and Hermes Messaging Service on their instance, configure a JSON Web Token (JWT) provider and token for authentication, and set up their log sources via the Integrations Launchpad. * **High-Volume Deployment:** For handling 30,000+ log events per second, infrastructure scaling is required. This includes resizing AI Engine and Elasticsearch nodes and coordinating a migration. Customers must contact ServiceNow Support to arrange scaling, which involves a 6-hour change window and 2--6 hours of downtime limited to HLA functions. ## Supported Log Sources Currently supported log sources for ITOM Gateway streaming include: * AWS Firehose * Cribl Stream * OpenTelemetry Collector Each source has a dedicated configuration tile within the ServiceNow Integrations Launchpad. ## Authentication Log sources authenticate using JWT tokens. Customers must configure a JWT provider and generate tokens on their ServiceNow instance before activating ITOM Gateway integrations. ## Key Components * **ITOM Gateway:** Receives log data over gRPC and forwards it to Hermes Messaging Service. * **Hermes Messaging Service:** Routes data to the HLA back-end. * **AI Engine:** Processes and analyzes ingested log data. * **Integrations Launchpad:** User interface for configuring log source integrations. ## Next Steps for ServiceNow Customers * Configure a JWT provider and token on your instance for secure authentication. * Set up log streaming via ITOM Gateway using the Integrations Launchpad for your chosen log sources. * For high-volume deployments, contact ServiceNow Support to plan infrastructure scaling and migration. Health Log Analytics (HLA) can receive log data from external sources directly through the ITOM Gateway, without routing data through a MID Server. This architecture supports cloud-native log sources such as Amazon Data Firehose, Cribl, and OpenTelemetry, and is required for high-volume HLA deployments. ## How log streaming via ITOM Gateway works {#hla-midless-streaming__section_esh_zvk_djc} External log sources send data to the ITOM Gateway over gRPC. The ITOM Gateway forwards the data to the  Hermes  Messaging Service, which delivers it to the AI Engine, the HLA processing back-end. This design separates log streaming from ingestion, enabling higher throughput than direct MID Server streaming. ## Deployment scenarios {#hla-midless-streaming__section_qvs_dwk_djc} The setup path depends on your expected log volume.{#hla-midless-streaming__table_vsg_4xy_djc__entry__2} | Deployment type | Setup | |-|-| | Standard | For typical log volumes, enable ITOM Gateway and the  Hermes  Messaging Service on your instance, configure a JSON Web Token (JWT) provider and token, and set up your log source from Integrations Launchpad. For more information, see [Configure a JWT provider and token](https://www.servicenow.com/docs/8ggBPj9hGXTx7a9H2mYJug "Configure a JSON Web Token (JWT) provider and token to authenticate log streaming integrations sending data to Health Log Analytics (HLA) via ITOM Gateway. This configuration is required before you can activate any ITOM Gateway integration in Integrations Launchpad.") and [Set up log streaming via ITOM Gateway for Health Log Analytics](https://www.servicenow.com/docs/iFLmDN7o8f30BFgkTJlS8g "Set up log streaming via ITOM Gateway to enable Health Log Analytics (HLA) to receive log data directly from external sources without a MID Server."). | | High-volume | For deployments requiring 30,000 or more log events per second, you must scale the HLA infrastructure before enabling ITOM Gateway. This process involves resizing the AI Engine and Elasticsearch nodes and coordinating a cross-team migration. Contact ServiceNow Support to request infrastructure scaling. For details and the required information to provide, see [Set up log streaming via ITOM Gateway for Health Log Analytics](https://www.servicenow.com/docs/iFLmDN7o8f30BFgkTJlS8g "Set up log streaming via ITOM Gateway to enable Health Log Analytics (HLA) to receive log data directly from external sources without a MID Server.") Note: Infrastructure scaling requires a 6-hour change window and involves expected downtime of 2--6 hours for HLA functions only. | [Table 1. Log streaming via ITOM Gateway deployment scenarios] {#hla-midless-streaming__table_vsg_4xy_djc} ## Supported log sources {#hla-midless-streaming__section_jbh_nwk_djc} Currently, the following log sources can stream data to HLA via ITOM Gateway: * [AWS Firehose](https://www.servicenow.com/docs/HDeVwU9NgyiGAHHFl76QXw "Set up an integration to stream log data from Amazon Data Firehose directly to the ServiceNow datacenter, where it’s queued for Health Log Analytics processing. There’s no need to store AWS keys on your ServiceNow instance.") * Cribl Stream * OpenTelemetry Collector {#hla-midless-streaming__ul_sxy_4wk_djc}Each source has a dedicated tile in Integrations Launchpad for configuration. ## Authentication {#hla-midless-streaming__section_u2x_swk_djc} Log sources authenticate to HLA using a JWT token. You must configure a JWT provider and generate a token on the ServiceNow instance before activating an ITOM Gateway integration. ## Key components {#hla-midless-streaming__section_hkb_vwk_djc} {#hla-midless-streaming__table_u5r_xwk_djc__entry__2} | Component | Description | |-|-| | ITOM Gateway | Receives incoming log data from external sources over gRPC and forwards it to the  Hermes  Messaging Service. | | Hermes  Messaging Service | Message broker that routes data from ITOM Gateway to the HLA back-end. | | AI Engine | HLA back-end component that processes and analyzes ingested log data. | | Integrations Launchpad | ServiceNow interface for configuring log source integrations. Each supported log source has a dedicated tile. | [Table 2. Key components] {#hla-midless-streaming__table_u5r_xwk_djc} **Related tasks** * [Configure a JWT provider and token](https://www.servicenow.com/docs/8ggBPj9hGXTx7a9H2mYJug "Configure a JSON Web Token (JWT) provider and token to authenticate log streaming integrations sending data to Health Log Analytics (HLA) via ITOM Gateway. This configuration is required before you can activate any ITOM Gateway integration in Integrations Launchpad.") * [Set up log streaming via ITOM Gateway for Health Log Analytics](https://www.servicenow.com/docs/iFLmDN7o8f30BFgkTJlS8g "Set up log streaming via ITOM Gateway to enable Health Log Analytics (HLA) to receive log data directly from external sources without a MID Server.")