---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Export existing logs on demand

# Export existing logs on demand {#ariaid-title1}

Release version: Brazil  
Updated November 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read  
Replay historical log data from a supported table to a Hermes topic by creating and starting a Backfill Run. Use this process to export logs from a specific time range for analysis or archival.

## Before you begin

Role required: admin or sn_logstoanalytics.admin

Before you begin:

* Verify that the source table is present in the LES Sources allow-list.
* Verify that the target topic belongs to the LES application scope.
{#les-export-existing-logs-on-demand__ul_amq_33b_2kc}

## About this task

By default, Log Export Service forwards a copy of log events to Hermes Messaging Service as those events are generated. Use a backfill run to replay historical rows from a supported log table for a bounded time range.

Each Backfill Run replays rows from one source table into one Hermes Messaging Service topic, in ordered batches. Only one active run per table is allowed at a time. After you start a run, its configuration is locked to prevent accidental edits.

## Procedure

1. Navigate to AllLog Export Service (LES)Export Historical Data.
2. Select New.
3. On the form, fill in the fields.  

   |-|-|
   | **Field** | **Description** |
   | Name | Name of the Backfill Run. |
   | Table | Log source table whose historical rows you want to replay. For more information on supported tables, see [Log Sources.](https://www.servicenow.com/docs/jLyNdWlySNZDgPQfPaFbSg "Log Export Service (LES) can export log sources from some System Log Tables, Audit Tables, and Application Node Log Files.") |
   | Log level | A set of standard logging levels that can be used to control logging output. Each level forwards logs of equal or greater severity. Log level options: * INFO - Forwards all logs * WARN - Forwards warnings and errors * ERROR - Forwards errors only Note: This field appears only when you select Table as the Source Type and the table is syslog. |
   | Topic | Reference to the Hermes Messaging Service topic that the run publishes to. Select an existing topic, or create a topic through the lookup icon. For more information on creating a topic, see [Create source type and multi topics in the LES source table](https://www.servicenow.com/docs/cyEVO5gbGsEf0q0sJ~zClA "Consume logs for each source type by creating multiple topics per source type. You can now leverage the option of customized selection of specific topics for different log sources during the debugging process, without impacting the other log tables."). |
   | Range Start | Earliest timestamp of the historical window to replay. Rows with a timestamp on or after Range Start are included. |
   | Range End | Latest timestamp of the historical window to replay. Range End can be any time up to now and must be equal to or later than Range Start. |
   | Max Rows | Optional cap on the total number of rows the run publishes. Leave blank to publish all rows in the range. |
   | Batch Size | Number of rows the worker publishes per batch. The default is 1000. |
   | Throttle Ms | Optional wait time, in milliseconds, between batches. The default is 0. Increase this value only when the source instance is under heavy load. Typical non-zero values range from 10 to 100 milliseconds. |
   | Active | Indicates whether the Backfill Run is active. |
   | Status | Current state of the run: New, Queued, Running, Completed, Error, or Cancelled. A background scheduler picks up queued runs approximately once every minute. |
   | Status Detail | Plain-language summary of the current state. |
   | Rows Published | Number of rows successfully published to the topic since the run started. |
   | Rows Failed | Number of rows that failed to publish. |
   | First Timestamp Sent | Timestamp of the first row published in this run. Set once when the run starts and does not change. |
   | Last Timestamp Sent | Timestamp of the most recent row published. Updates as the run progresses. |
   | First Sys Id Sent | Sys ID of the first row published in this run. |
   | Last Sys Id Sent | Sys ID of the most recent row published. |
   | Resolved Topic | Reference to the topic record that the Topic field resolved to. |
   [Table 1. Backfill Run form]

4. Select Submit.  
   The Status field is set to New.
5. Open the record and select Start.  
   The Status field changes to Queued and then to Running when the scheduled worker picks it up. All input fields become read-only.
6. **Optional:** To stop a run that has not finished, select Cancel while the Status is Queued or Running.

## Result

When the run finishes, the Status field is set to Completed and the Status Detail field displays a summary such as "Backfill completed: forwarded 12,345
rows from syslog." If the run stops because of an error, the Status field is set to Error and the Status Detail field describes the cause.

You can also verify that logs are published to the topic using the Hermes topic inspector. For more information, see [View a message in a Hermes topic](https://www.servicenow.com/docs/access?context=view-messages-hermes-topic&version=brazil&pubname=brazil-servicenow-platform&ft:locale=en-US).

*[\>]: and then