---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Create advanced log alert filters

# Create advanced log alert filters {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Add advanced log alert filters to scan alerts for conditions that you specify. The filters reduce noise by dropping alerts that do not indicate a significant issue. While developing a filter, you can test, update, publish, or activate the filter at any time.

## Before you begin

The Disable Alert Rule Engine feature and the Disable Detection Rule Engine feature must be in the OFF state. You set the values by navigating to Health Log AnalyticsHealth Predictive AI Ops AdministrationFeatures.

Role required: evt_mgmt_operator or evt_mgmt_admin

## Procedure

1. Navigate to Health Log AnalyticsLog Anomaly DetectionAdvanced Log Alert Filter.
2. Select New.
3. Enter a unique and descriptive name for the filter.
4. **Optional:** Enter a description of the operation of the filter.
5. In the Script template field, select the script that most closely matches your intended logic.  
   The template can act as a starting point for your custom script code.  
   After you select a template, the Custom JS function text box is populated with the appropriate JavaScript function. The JavaScript function applies the filter to the alert payload data and either allows or drops the alert. The alert payload is the text and metadata for the kind of alert that the filter will analyze.
6. Save the record by selecting Submit.  
   To continue modifying the filter, you must reopen the record from the [filters list](https://www.servicenow.com/docs/EfIvw5TWHaNaqJxf9X_ANA "Define, save, and share searches of log data to help determine the causes of Log Analytics alerts."). You can then edit, test, publish, and activate the filter.
7. Edit the default Alert payload text in preparation for testing your intended logic.  
   To remove your changes and revert to the default text for the Alert payload
   text box, click Reset.

   For your convenience, Health Log Analytics provides sample alerts with
   preconfigured payloads. Select a sample alert in the Example alert field to display its payload in the Alert payload text
   box.
8. **Optional:** Save the current values of the filter without testing by selecting Update.
9. When your content for the alert payload and your JavaScript function are complete, select Test.  
   To simulate the alert operation, the system saves the filter values, applies the filter to the Alert payload text, and then displays one of the following results:
   * Alert will be dropped.
   * Alert will be allowed.

   {#hla-op-adv-alert-filter-crud__ul_rcj_3k2_gnb} Figure 1. Testing the JavaScript to determine whether to allow or drop the alert  
   Note:  
   If your new JavaScript function is not behaving as expected, you can revert to the last published one by selecting the Revert JS Function related link.
10. Repeat the process of updating the alert payload and testing the JavaScript function as often as needed.
11. When you're satisfied with the filter, save its values and determine whether to apply it to the log stream.
    * To save the values and apply the filter to the log stream, make sure the Active check box is selected and select Publish.
    * To save the filter without applying it to the log stream, clear the Active check box and select Publish.

    {#hla-op-adv-alert-filter-crud__choices_qzy_5v3_qqb}  
    Note:  
    If you modify a published filter, you must publish the modified filter to apply it to the log stream.

## Result

The values of the active filter are saved. If you selected the Active option, the filter is applied to the log stream.

*[\>]: and then