---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Cribl Stream

# Set up a Cribl Stream (MID-less) integration for Health Log Analytics {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read  
Set up a Cribl Stream integration to stream Cribl log data directly to your ServiceNow instance, without a MID Server.

## Before you begin

Set up MID-less log streaming via ITOM Gateway. Choose the deployment method based on your expected log volume. For more information, see [MID-less log streaming via ITOM Gateway in Health Log Analytics](https://www.servicenow.com/docs/J7jjYG2Bko88VdNZdNHtbg "Health Log Analytics (HLA) can receive log data from external sources directly through the ITOM Gateway, without routing data through a MID Server. This architecture supports cloud-native log sources such as Amazon Data Firehose, Cribl, and OpenTelemetry, and is required for high-volume HLA deployments.").

As an alternative to the provided procedure, set up a MID-less integration for HLA from an AI-enabled MCP Client. For more information, see [MID-less log ingestion for HLA from an MCP Client](https://www.servicenow.com/docs/kLxwAEXjOy_F9jkGkVb4WQ "Set up MID-less log ingestion integrations for Health Log Analytics (HLA) directly from an AI-enabled MCP Client, without opening the ServiceNow UI.").

Role required: evt_mgmt_admin

## Procedure

1. Navigate to WorkspacesService Operations Workspace.
2. From the navigation pane, select the AIOps configuration center icon ![ITOM AIOps configuration center icon]().  
   The ITOM AIOps configuration center page appears. The configuration center is a centralized workspace. Use it to configure and manage AIOps features from a single place.
3. From the Integrate section, under Integrations, select Add integration.  
   The Integrations Launchpad appears.
4. In the Browse integrations tab, search for the Cribl Stream integration and select its tile.  
   Note:  
   If you start an integration setup before meeting all prerequisites, a message appears. You can cancel the setup and complete the prior requirements first. Alternatively, you can continue in draft mode and complete the requirements later. Note that you can't activate the integration until you have completed all the prerequisites. {#il-connector-hla-cribl-stream__step-search}
{#il-connector-hla-cribl-stream__step-search}
5. On the Provide details form, fill in the fields and then select Next. {#il-connector-hla-cribl-stream__step-provide-details}
{#il-connector-hla-cribl-stream__step-provide-details}
6. On the Set-up instruction screen, follow the instructions to enable sending Cribl log data to ServiceNow using OpenTelemetry.
   1. Copy the provided access token, endpoint, and integration ID to the clipboard.  
      These credentials enable Cribl to securely send logs to the ServiceNow ITOM Gateway. {#il-connector-hla-cribl-stream__table_rpn_tdc_hjc__entry__2}

      | Credential | Description |
      |-|-|
      | Access Token | The JWT credential passed with every request (servicenow-access-token). |
      | Endpoint | The Gateway gRPC endpoint, the address to which Cribl Stream will send the log data. |
      | Integration ID | The ID by which the integration identifies to ServiceNow (servicenow-integration-id). |
      [Table 1. Credentials]

      {#il-connector-hla-cribl-stream__table_rpn_tdc_hjc}
   2. In the Cribl UI or configuration files, depending on your deployment, set up a Cribl destination that uses the OpenTelemetry Protocol (OTLP) to forward data to ServiceNow.  
      Note:  
      Cribl integrates directly with ServiceNow via API. No collector or agent is needed.
   3. In Cribl, paste the copied credentials into the destination configuration.

   {#il-connector-hla-cribl-stream__substeps_ot4_hdc_hjc}  
   For more detailed instructions, see the [Set up Cribl to send data to HLA without a MID Server \[KB2271238\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2271238) article in the Now Support knowledge base. {#il-connector-hla-cribl-stream__step-third-party-install}
{#il-connector-hla-cribl-stream__step-third-party-install}
7. Do one of the following.
   * If you completed all the prerequisites before starting the configuration, activate the integration either with or without AI-powered capabilities. Select the appropriate option.
     * Activate with AI enables AI-powered automatic parsing and mapping of log data to service instances and components for contextual alerts.

       When the integration is activated successfully, the
       Overview tab is displayed. ServiceNow Otto for ITOM collects and analyzes log data. An AI icon indicates that AI is active.
     * Activate activates the integration without AI-powered mapping. The integration is activated and the Overview tab is displayed.

     {#il-connector-hla-cribl-stream__ul_py4_nwq_1kc}

     On the Integrations Launchpad, the integration tile is available in the Installed integrations tab.
   * If you didn't complete all the prior requirements, select Save draft.

     The system saves the integration as a draft in the Integrations Launchpad
     Installed integrations tab, under Waiting for your action. At a later time, complete the prerequisites and activate the installation. For more information, see [Activate a draft integration in Health Log Analytics](https://www.servicenow.com/docs/DAmYfLPD0NEITGyZW4NdLA "Activate an integration that was configured and saved as a draft in Health Log Analytics (HLA).").
   {#il-connector-hla-cribl-stream__choices_nyl_mwq_1kc}

## What to do next

On the Overview tab, do the following:

* Use the displayed information to refine how Health Log Analytics reads the log data. For more information, see [Review log streaming data and adjust integration settings in Health Log Analytics](https://www.servicenow.com/docs/xhKQCc4NqohZEveb0YGBuQ "Review the log data streaming status and streaming sources of an active integration for Health Log Analytics on the integration's Overview screen. From this tab, you can investigate streaming issues and refine the integration settings. Leverage the displayed data to refine how HLA reads the log data by adjusting the integration's configuration.").
* Use the More options menu (![More options menu icon.]()) to open the Data Input Mapping, Source Type Structures, or Log Sources pages with context from the integration. If your log data is not properly mapped, structured, or sourced, go back and adjust the configuration. If the Service Operations Workspace Log Analytics application is installed, the More options menu also provides direct access to the Log Viewer. Use the Log Viewer to review raw log messages ingested by the integration. For more information, see:
  * [Log data auto-mapping and mapping](https://www.servicenow.com/docs/_qOYyxhT10AxB3Vk8TBS3Q "By default, the HLA Engine tries to auto-map every incoming log line to the correct tags. You can change automatic mapping results manually by defining a JavaScript function.")
  * [Source type structure adjustment](https://www.servicenow.com/docs/FT~QnhGR~cbIugpIM2RDgw "Health Log Analytics (HLA) enables you to reclassify auto-classified log properties and change auto-mapped labels. These adjustments help HLA machine learning analyze your data accurately.")
  * [Review alert-related logs on the Log Viewer](https://www.servicenow.com/docs/VSxmRMC7yhr1sTwLkZrmeA "The Log Viewer tab in Health Log Analytics lets you browse the logs for an alert by timestamp or time range, and visualize anomaly frequency within a specific time period. Customizing the displayed data and adjusting time filters enables you to better understand the framework in which the anomaly occurred, helping you find the root cause faster.")
  {#il-connector-hla-cribl-stream__ul_lxn_qr5_l3c}
{#il-connector-hla-cribl-stream__ul_ggk_nr5_l3c}

If you activated the integration with AI, verify that AI correctly auto-mapped log data to service instances and components. To do this, select View mapping under
Log context mapping. You can override the AI mapping by selecting a different log field from each list. For more information, see [Map logs to service instances, components, source types](https://www.servicenow.com/docs/PnEYhxi6g4LdpVamfj4V3Q "Map your logs to service instances, components, and source types so that Health Log Analytics (HLA) can generate contextual alerts.").

*[\>]: and then