---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Identify and resolve a log streaming issue

# Identify and resolve a log streaming issue in Health Log Analytics {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Find and address log streaming issues to verify that your data inputs are streaming log data to your instance properly.

## Before you begin

Role required: evt_mgmt_admin

## Procedure

1. Navigate to AllHealth Log AnalyticsStreaming Sources.  
   The Streaming Sources page shows all data inputs and the MID Servers that are receiving logs from them.  
   Note:  
   * When Look up hostnames is selected in the [advanced data input configuration](https://www.servicenow.com/docs/zXTS6wzmJf~VKEp2IfLs1w "When you have configured a data input successfully, Health Log Analytics adds a record to the Data Inputs table and attaches the configuration file to it. You can configure advanced settings for your data input. Configuring advanced settings is optional."), the Streaming Sources page shows the hostname of devices that use an Rsyslog or a Filebeat shipper. For Elasticsearch indices, it displays the index name.
   * Streaming Sources is also available as a related list on the data input form. The related list displays only the endpoint devices that are relevant to that data input.
   * If the HLA engine is down and data has stopped streaming, a notification appears at the top of the Streaming Sources page. When this happens, contact ServiceNow support.
   {#hla-data-input-streaming__ul_cdw_hlj_nsb}
2. Select a data input record to view the streaming data of its sources and identify streaming issues and their possible cause.  
   For example, if the last recorded event time for a data input's endpoint server is yesterday, that server might be down or configured incorrectly. A streaming issue might also be caused by the data input configuration file not being installed on the endpoint.  
   {#hla-data-input-streaming__table_k2m_wq3_qmb__entry__2}

   | Filter | Description |
   |-|-|
   | Status | The status of the source. A red bullet indicates that this source has not streamed data in the last hour. |
   | Last event time | The last recorded time an event arrived at the MID Server in the last one-minute interval. Health Log Analytics continuously updates the last event time. If the last event time is not up to date, data is not streaming. |
   | Raw log lines/sec | The average number of raw log lines that streamed to the MID Server per second in the last one-minute interval. Note: This value represents the number of raw log lines before preprocessing. |
   | Preprocessed log lines/sec | The average number of preprocessed log lines that streamed to the MID Server per second in the last one-minute interval. Note: This value can differ from the number of raw log lines per second. For example, the difference can be a result of logs having been dropped during preprocessing. |
   [ ]

   {#hla-data-input-streaming__table_k2m_wq3_qmb}
3. Investigate and resolve any data streaming issues.  
   Note:  
   If you experience permissions-related issues with streaming log data from Elasticsearch, refer to the [Granting privileges for data streams from Elasticsearch \[KB0967366\]](https://support.servicenow.com/kb?id=kb_article_view&sys_kb_id=9648a9281b61b4100b8a9979b04bcb04) article in the Now Support Knowledge Base.

## What to do next

When the logs are streaming properly, proceed to [map your raw log data](https://www.servicenow.com/docs/RTFq766xdWMGqMdEUABgcA "Mapping raw log data that streams into your ServiceNow instance determines how Health Log Analytics processes the data. If HLA doesn't discover properties automatically, you can map data input sources manually.").  
Note:  
You can choose to [edit incoming raw log data](https://www.servicenow.com/docs/hcAtCuoakt5t5rZx7DpyJA "Use the Data Input Preprocessor to filter, split, or sanitize raw log data before it is treated in the MID Server and mapped and structured by Health Log Analytics.") before Health Log Analytics processes it. For example, preprocessing enables you to discard log portions or remove sensitive data from your logs. This task is optional.

*[\>]: and then