--- sourceDocument: Yokohama IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/it-operations-management Release : - yokohama ft:locale : - en-US ft:publication_title : - Yokohama IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Get started with ServiceNow Health Log Analytics (HLA) # Get started with ServiceNow Health Log Analytics (HLA) {#ariaid-title1} * Release version: Yokohama * * Updated January 30, 2025 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Get started with ServiceNow Health Log Analytics (HLA) ServiceNow Health Log Analytics (HLA) enables IT teams to proactively identify and resolve IT issues by collecting, analyzing, and correlating machine-generated log data in real time. It detects anomalies---deviations from normal behavior---as they occur and generates alerts to notify operators of potential problems before they impact users. HLA processes various textual logs, including application, infrastructure, and network logs, using UTF-8 encoding. It integrates with ServiceNow Event Management to centralize alert handling and supports both direct log streaming and log repository ingestion via MID Server and other connectors. Show full answer Show less ## Key Features * **Log Ingestion:** Supports multiple data input connectors such as Rsyslog, Beats, Splunk, Elasticsearch, MID Server, and TCP streams; guided setup simplifies connector configuration. * **Data Structuring and Auto-Mapping:** Automatically extracts key properties from logs (message, timestamp, host, severity, external IDs) and maps logs to logical components for organized analysis. * **Enrichment:** Identifies variable message parts, keywords (e.g., WARN, Failed), and contextual properties (e.g., user, source IP, port) to enhance analysis. * **Analysis with Machine Learning and AI:** Uses unsupervised algorithms to learn normal log behavior and dynamically detect anomalies by setting real-time thresholds. * **Alerting:** Sends detected anomalies as events to ServiceNow Event Management where alerts are consolidated and visible for operators to act upon. * **User Roles:** Administrators configure and maintain HLA; Operators analyze alerts and perform issue resolution. * **Additional Capabilities for Operators:** Log viewer visualization, log correlators for relationship detection, alert muting, log filters, lexical keyword management, and custom alert rule creation. * **Administration Efficiency:** Content packs accelerate onboarding; data input migration reduces errors when moving configurations between instances. ## Key Outcomes * Faster IT issue identification and resolution through real-time log anomaly detection and alerting. * Improved root cause analysis by enabling triage of surrounding log data linked to anomalies. * Centralized alert management by integrating with ServiceNow Event Management, allowing operators to view and respond to all alerts in one place. * Reduced noise and false positives through customizable filters, alert rules, and keyword management. * Streamlined setup and administration for quicker deployment and ongoing maintenance of log data ingestion and analysis. ServiceNow Health Log Analytics predicts IT issues before they affect your users. The application helps you solve problems faster by collecting, analyzing, and correlating machine-generated log data in real time. It discovers any anomaly, or deviation from normal behavior, as it happens and alerts you of possible issues. ## Health Log Analytics overview {#hla-understanding__section_nqx_vvd_d2c} Health Log Analytics helps you solve IT issues faster by collecting, analyzing, and correlating machine-generated log data in real time. The application receives and processes logs via the MID Server and sends events to ServiceNow Event Management. Health Log Analytics discovers any anomaly---deviation from normal behavior---as it happens, and alerts you of possible issues. The application helps you identify the root cause of an issue by enabling you to triage related logs and analyze the raw data. Health Log Analytics can handle any kind of machine-generated textual log data. It can process application, infrastructure, and network logs, as well as other types of textual log data. Although a configuration management database (CMDB) can be helpful to generate high-quality events and alerts, it is not necessary. Note: * Health Log Analytics supports only UTF-8 logs. It does not support binary logs. * If you are sending logs in a language other than English, additional configuration may be required. {#hla-understanding__ul_urs_bk4_4bc} ## Users {#hla-understanding__section_lxb_zcw_c2c} {#hla-understanding__table_km4_gdw_c2c__entry__3} | User | Description | Role | |-|-|-| | Administrator | Configures the Health Log Analytics application to make it ready for use by Operators. Performs administration tasks to keep the system running efficiently. | evt_mgmt_admin, admin | | Operator | Analyzes Log Analytics alerts and takes action to help resolve the underlying issue. | evt_mgmt_operator | [Table 1. Health Log Analytics Users] {#hla-understanding__table_km4_gdw_c2c} ## Health Log Analytics workflow {#hla-understanding__section_p3w_j54_xmb} Health Log Analytics collects and processes log data automatically. It structures the data logically for operators to analyze, and generates meaningful alerts and suggestions that display in Event Management. The diagram shows the Health Log Analytics workflow from collecting the data through sending an event or alert to Event Management. Figure 1. Health Log Analytics workflow Ingestion : This layer connects your environment to Health Log Analytics. You can stream your logs directly from servers and endpoints or from log repositories. The optional guided setup helps you create data input connectors for the following common data sources: : * Rsyslog * Beats * Splunk * Elasticsearch * MID Server * TCP {#hla-understanding__ul_wqh_m54_xmb} Structuring : This layer deals with structuring log data and auto-mapping it to logical silos, called Components. Data structuring can be done automatically or manually. : The system auto-structures log data by extracting the following properties from incoming log messages: Message, Timestamp, Host, Severity, and External-IDs. It extracts explicit values, like "property-name" and "value is IP." and semantic ones such as length, number of English words, and variance. : Auto-mapping assigns log samples and metadata to the appropriate tags automatically. The system tries to map log lines by analyzing the source that streams the data. The mapping is based on agent hints and common transport header fields. Enrichment : This layer handles identifying the variable parts of a log message. : Figure 2. Health Log Analytics workflow - Enrichment : It also identifies keywords and contextual properties. In the image, "WARN" and "Failed" are the keywords to track. "User," "source IP," and "port" are the contextual properties. Analysis : In this layer, each log line is indexed. Health Log Analytics extracts properties from the inner log message that contribute to models of behavior that the system learns to expect. Anomalous behavior departs from this expected behavior. You can search for an event and its most significant properties for manual triaging. Machine Learning (ML) and Artificial Intelligence (AI) : Health Log Analytics uses advanced unsupervised machine-learning algorithms to discover patterns within logs and learn their unique data behavior. It then sets dynamic thresholds based on the data signature in real time to detect issues when they first occur. When the system detects a deviation from the typical pattern, it sends an event to Event Management. Alert in Event Management : Health Log Analytics sends events to Event Management. In Event Management, Health Log Analytics alerts appear in the All alerts list. This list enables operators to see alerts from the event and the Health Log Analytics alert type in a single location. ## Benefits {#hla-understanding__section_wyw_kwv_c2c} {#hla-understanding__table_s14_mdw_c2c__entry__3} | Benefit | Feature | User | |-|-|-| | Simplify data input setup using the guided setup. | [Guided setup](https://www.servicenow.com/docs/ByowkUIFyf7Z13xHLUFrAQ "The Health Log Analytics guided setup provides a sequence of tasks to help you create data inputs on your ServiceNow instance. Data input configuration is an essential step in setting up the Health Log Analytics application. Using guided setup ensures that you have the minimum required setup for the data input process.") | Administrator | | Set up log data connector integrations quickly and conveniently from the Integrations Launchpad. | [Log data connector integrations](https://www.servicenow.com/docs/2hnWmSl1ix9h3FFG_7KA5g "Set up integrations for Health Log Analytics from the Event Management Integrations Launchpad in Service Operations Workspace for ITOM.") | Administrator | | Shorten onboarding time by installing content packs. | [Content packs](https://www.servicenow.com/docs/2dxXb9TV51xRgSuGGbBTEA "Shorten onboarding time for the Health Log Analytics application by installing content packs. The packs contain default source types and mapping script templates that save you the time it takes to create them from scratch.") | Administrator | | Save time and reduce errors by migrating data input configurations between instances. | [Data input migration](https://www.servicenow.com/docs/h8zgh5ncl977JqJF4yCXKQ "Export a Health Log Analytics data input and source types configuration as an update set and import it to a different ServiceNow instance. In the target environment, you can use the migrated data input for streaming and processing log data. This functionality saves time and reduces possible errors by avoiding the need to configure the settings again on the target instance.") | Administrator | | Identify the root cause of an alert by analyzing the logs that surround the anomaly. | [Surrounding logs](https://www.servicenow.com/docs/Jq9JQ6DGaBT4doa04HaQjg "When Health Log Analytics identifies an anomaly, viewing the logs that surround the anomaly provides clues about the state of faulting systems. This information can help you narrow down the root cause of an alert.") | Operator | | Visualize anomalous log data on the Log viewer. | [Log viewer](https://www.servicenow.com/docs/xFTujkgfaGkZ_U_8Hazb~A "The Log viewer tab lets you browse the logs for an alert by timestamp or time range, and visualize anomaly frequency within a specific time period. Customizing the displayed data and adjusting time filters enables you to better understand the framework in which the anomaly occurred, helping you find the root cause faster.") | Operator | | Detect relationships in log data. | [Log correlators](https://www.servicenow.com/docs/Zgp6T7g6fBWpxgZrqK4A1g "In Health Log Analytics, log correlators are keys or values in log data that detect correlations between alerts. These correlations help you determine whether an alert is part of a larger issue.") | Operator | | Assign higher or lower significance to alerts. | [Mute alert metrics](https://www.servicenow.com/docs/VUJEn17vjdVTGizBKk2zVA "Label an alert in Health Log Analytics as meaningful or insignificant, or restore normal importance to the metric involved in generating it.") | Operator | | Reduce noise by creating log filters. | [Log alert filters](https://www.servicenow.com/docs/UtGVnXEPr6gk40kj~p4Y8g "Use advanced log alert filters to determine whether to allow an alert or drop it. These filters reduce noise by dropping alerts that do not indicate a significant issue.") | Operator | | Influence how Health Log Analytics finds anomalies by managing keywords it looks for in the log data. | [Lexical keywords](https://www.servicenow.com/docs/CgexzXGqMQ9UlrqfQJ9_gg "Influence how Health Log Analytics finds anomalies by managing keywords it looks for in your log data. When text in log data for a source matches a lexical keyword that exceeds a specified count threshold, the system identifies an anomaly and generates an alert.") | Operator | | Create alerts for specified metrics by adding, changing, or deleting rules. | [Custom alert rules](https://www.servicenow.com/docs/ohzeZcpnjaBNYhTr1alVsw "Alert rules enable you to set thresholds and conditions that determine when Health Log Analytics triggers an alert. When the conditions of an alert rule are met, the system generates a Log Analytics alert. You can add, change, or delete alert rules to create Log Analytics alerts for a specified metric.") | Operator | [Table 2. Health Log Analytics benefits] {#hla-understanding__table_s14_mdw_c2c} ## What to explore next {#hla-understanding__section_ynm_4nv_c2c} * [Health Log Analytics architecture](https://www.servicenow.com/docs/O0LZWURONoBPklYw565cWA "Health Log Analytics collects logs streaming into your ServiceNow instance from endpoints or data lakes, such as Splunk and Elasticsearch.") * [How Health Log Analytics generates alerts](https://www.servicenow.com/docs/zaqeZmmJdcaBNEqfu4~1Ww "Health Log Analytics identifies patterns in your log data and learns pattern behavior. When HLA's AI engine detects anomalous behavior, it sends an event to the ServiceNow Event Management application. As an operator, you can use these predictive alerts to handle emerging IT issues before they impact users.") {#hla-understanding__ul_n1q_pnv_c2c}