--- sourceDocument: zurich Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/delta-yokohama-zurich Release : - zurich ft:locale : - en-US ft:publication_title : - zurich Combined Product Files ft:clusterId : - delta3zy bundleId : - delta3zy --- # Combined Health Log Analytics release notes for upgrades from Yokohama to Zurich # Combined Health Log Analytics release notes for upgrades from Yokohama to Zurich {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 8 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Health Log Analytics release notes for upgrades from Yokohama to Zurich This consolidated release note summary covers Health Log Analytics (HLA) updates from the Yokohama to Zurich releases, helping ServiceNow customers understand new features, changes, and upgrade considerations. It highlights improvements in log data integrations, alert management, and user experience enhancements, ensuring that customers can effectively prepare for and implement upgrades. Show full answer Show less ## Key Features * **Integrations Launchpad Enhancements:** Starting in Yokohama (v36.0.19), customers can configure multiple log data integrations---such as Splunk TCP/UDP, Splunk Poller, MID Server, Apache Kafka, Microsoft Azure Log Analytics, REST API, and Amazon Data Firehose---through a unified interface, simplifying setup and management. * **Advanced Data Inputs:** Support for Cribl and Edge Delta data inputs enables streamlined ingestion of large log volumes, improving processing efficiency. The Splunk Polling data input allows regular, automated data pulls, reducing stakeholder involvement and accelerating proofs of concept. * **Export and Contextual Alerting (Zurich v38.0.16):** Export source types by log source to update sets for easier migration. Map log data to specific service instances and components, enabling alert generation with precise contextual awareness, vital when handling multiple services. * **New Integrations (Zurich v38.0.16):** Added support for Google Cloud Platform Pub/Sub, Microsoft Azure Event Hubs, and Edge Delta TCP/REST integrations via the Integrations Launchpad, expanding connectivity options. * **ServiceNow Instance Log Monitoring:** Introduced the ServiceNow Log Export data input to monitor instance node logs from Java and JavaScript, enhancing internal log visibility. * **User Experience Improvements:** The Zurich release introduces the Coral theme as the default for new portals and applications, including a dark mode option for web and mobile, improving usability and accessibility. * **Enhanced Overview Screen:** Displays ITOM Gateway in the processing pipeline and log streaming rates per minute, providing better operational insights into log ingestion and processing status. ## Key Changes * **Alert Model Update:** Component-based alert grouping was deprecated in favor of a simplified two-tier model (Log Analytics Group to Single Alert), improving alert clarity by aligning alerts with service-level anomalies rather than individual host configuration items. * **Renaming:** The Glide Syslog data input was renamed to ServiceNow System Logs data input for clarity. ## Activation and Upgrade Guidance Health Log Analytics must be installed by requesting it from the ServiceNow Store. Customers should review pre- and post-upgrade tasks before moving to Zurich to ensure a smooth transition. This page consolidates release notes for easier preparation. ## Localization and Accessibility * **Supported Languages:** US English, UK English, French, German, Italian, Japanese, and Spanish, with US English as the default. * **Accessibility:** The new Coral theme supports a dark mode option to reduce eye strain and enhance readability for users. ## Practical Benefits for ServiceNow Customers * Streamlined integration setup via the Integrations Launchpad reduces complexity and speeds deployment. * Improved alert context mapping enhances incident detection and resolution efficiency. * Expanded log source support broadens the scope of log data ingested and analyzed. * User interface enhancements promote better usability and accessibility. * Consistent update mechanisms like update set export/import facilitate environment synchronization. Consolidated page of all release notes for Health Log Analytics from Yokohama to Zurich. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Health Log Analytics release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Health Log Analytics to Zurich Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-healthloganalytics-summary__entry__2} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## New features Between your current release family and Zurich, new features were introduced for Health Log Analytics. {#dfrn3-healthloganalytics-summary__entry__8} | Release | Release notes | |-|-| | Yokohama | [Configure log data integrations from the Integrations Launchpad](https://www.servicenow.com/docs/access?context=hla-data-input-setup-integrations&family=yokohama&ft:locale=en-US) : Starting in version 36.0.19, benefit from additional log data integrations for Splunk TCP/UDP, Splunk Poller, MID Server, Apache Kafka, Microsoft Azure Log Analytics, and REST API that can be easily set up through the Integrations Launchpad. [Set up an Amazon Data Firehose integration for real-time log data streaming from multiple sources](https://www.servicenow.com/docs/access?context=il-connector-hla-firehose&family=yokohama&ft:locale=en-US) : Starting in version 36.0.19, leverage an integration for streaming log data from Amazon Data Firehose directly to the collector service in ITOM Gateway, where it is queued and then processed by Health Log Analytics. This integration doesn't run on a MID Server and can be configured from the Integrations Launchpad. [Integrate with log data connectors from the Integrations Launchpad](https://www.servicenow.com/docs/access?context=hla-data-input-setup-integrations&family=yokohama&ft:locale=en-US) : Take advantage of the Integrations Launchpad's unified interface for convenient integration with log data connectors that feed raw log data from external sources into your instance. You set up log data connectors for HLA from the Event Management Integrations Launchpad in Service Operations Workspace for ITOM. In this release, the Integrations Launchpad enables integration with the following connectors: Elasticsearch, ServiceNow System Logs, UDP, and TCP. [Use Cribl and Edge Delta data inputs to streamline HLA data ingestion with tools handling large log volumes](https://www.servicenow.com/docs/access?context=hla-data-input-setup-manual&family=yokohama&ft:locale=en-US) : Use dedicated data inputs to facilitate data ingestion from Cribl or Edge Delta when using these tools to handle large volumes of log data from multiple sources before sending it to HLA. [Pull data from Splunk regularly using the Splunk Polling data input](https://www.servicenow.com/docs/access?context=hla-data-input-splunk-polling&family=yokohama&ft:locale=en-US) : Make your data workflows more consistent and productive by fetching data consistently over time using the Splunk Polling data input, which sends recurring queries (polls) to Splunk. Handling most configurations on the HLA side means you need minimal additional stakeholder involvement, which enables swift integration with your existing Splunk setup. This enhancement accelerates proofs of concept (POCs) and enables faster iterations using real data. [Use your Splunk data input to ingest preprocessed data from Splunk](https://www.servicenow.com/docs/access?context=hla-data-input-splunk&family=yokohama&ft:locale=en-US) : Ingest data from Splunk in a preprocessed, structured format using your existing Splunk data input. | | Zurich | [Export source types to an update set by log source](https://www.servicenow.com/docs/access?context=hla-export-sourcetypes-by-source&family=zurich&ft:locale=en-US) : Starting in version 38.0.16, export all source types related to one or more selected log sources to an update set together. You can then import the update set to the target environment. [Map log data to service instances and components for alerts in context](https://www.servicenow.com/docs/access?context=il-connector-hla-map-business-context&family=zurich&ft:locale=en-US) : Starting in version 38.0.16, map your logs to service instances and components so that Health Log Analytics can generate alerts in the correct context. Contextualizing your log data is especially important when the integration processes logs from multiple service instances and components. [Display Integrations Launchpad from the ITOM AIOps configuration center](https://www.servicenow.com/docs/access?context=itom-aiops-conf-center&family=zurich&ft:locale=en-US) : Starting in version 38.0.16, open the Integrations Launchpad from ITOM AIOps configuration center. The ITOM AIOps configuration center is a centralized workspace that enables you to configure and manage AIOps features from a single place. [Set up a GCP PubSub integration from the Integrations Launchpad](https://www.servicenow.com/docs/access?context=il-connector-hla-gcp-pubsub&family=zurich&ft:locale=en-US) : Starting in version 38.0.16, set up an integration from the Integrations Launchpad for receiving log messages that were published to a Google Cloud Platform (GCP) Pub/Sub topic and streaming them to your ServiceNow instance. [Set up a Microsoft Azure Event Hubs integration from the Integrations Launchpad](https://www.servicenow.com/docs/access?context=il-connector-hla-event-hubs&family=zurich&ft:locale=en-US) : Starting in version 38.0.16, set up an integration from the Integrations Launchpad for streaming events from Microsoft Azure Event Hubs to your ServiceNow instance. [Set up an Edge Delta TCP or REST integration from the Integrations Launchpad](https://www.servicenow.com/docs/access?context=il-connector-hla-edgedelta-tcp&family=zurich&ft:locale=en-US) : Starting in version 38.0.16, set up an integration from the Integrations Launchpad to enable Health Log Analytics to process Edge Delta log messages streaming into your ServiceNow instance over the TCP transport protocol or via REST. [Monitor ServiceNow instance logs with the ServiceNow Log Export data input](https://www.servicenow.com/docs/access?context=hla-data-input-log-export&family=zurich&ft:locale=en-US) : Starting in version 38.0.16, set up a data input for monitoring ServiceNow instance node logs from both Java code and JavaScript in Health Log Analytics. [Facilitate Cribl log data ingestion by Health Log Analytics using the Cribl integration](https://www.servicenow.com/docs/access?context=il-connector-hla-cribl&family=zurich&ft:locale=en-US) : Starting in version 37.0.15, use the Cribl log data integration to streamline Health Log Analytics data ingestion with Cribl. If your organization uses Cribl for filtering and routing large volumes of log data from various sources, the log format received by HLA is distinct from other types. The Cribl integration enables HLA to detect and separate transport headers from inner log messages in this format, forwarding only the inner message to the source type structure for processing. You can configure the Cribl integration conveniently through the Integrations Launchpad. [Leverage additional information available on the integration's Overview screen](https://www.servicenow.com/docs/access?context=il-connector-overview-tab&family=zurich&ft:locale=en-US) : Starting in version 37.0.15, take advantage of extra information presented on the Overview screen. The screen now displays the ITOM Gateway in the log processing pipeline and the log streaming rate per minute, aligning it with the metrics for the MID Server and the HLA Engine. The Overview screen also shows the source time of the last processed log. | [ ] ## Changes Between your current release family and Zurich, some changes were made to existing Health Log Analytics features. {#dfrn3-healthloganalytics-summary__entry__14} | Release | Release notes | |-|-| | Yokohama | [Component-based alert grouping is deprecated](https://www.servicenow.com/docs/access?context=hla-op-log-analytics-alert-types&family=yokohama&ft:locale=en-US) : Starting in version 36.0.19, the adoption of a streamlined two-tier alert model, Log Analytics Group to Single Alert, has replaced component-based alert groups, which have been removed. This model aligns alert representation with the service-level anomalies identified by Health Log Analytics, rather than individual host CIs. The update improves alert visibility, simplifies correlation, and enhances overall alert management efficiency. [ServiceNow System Logs data input](https://www.servicenow.com/docs/access?context=hla-data-input-glide-syslog&family=yokohama&ft:locale=en-US) : The Glide Syslog data input has been renamed ServiceNow System Logs data input. | | Zurich | Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. | [ ] ## Removed Between your current release family and Zurich, some Health Log Analytics features or functionality were removed. {#dfrn3-healthloganalytics-summary__entry__20} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Deprecations Between your current release family and Zurich, some Health Log Analytics features or functionality were deprecated. {#dfrn3-healthloganalytics-summary__entry__26} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Activation information Review information on how to activate Health Log Analytics. {#dfrn3-healthloganalytics-summary__entry__32} | Release | Release notes | |-|-| | Yokohama | Activation information : Install Health Log Analytics by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). Important: [Health Log Analytics](https://www.servicenow.com/docs/access?context=health-log-analytics-rn&family=yokohama&ft:locale=en-US) is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Zurich | Activation information : Install Health Log Analytics by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: [Health Log Analytics](https://www.servicenow.com/docs/access?context=health-log-analytics-rn&family=zurich&ft:locale=en-US) is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Health Log Analytics we have noted them here. {#dfrn3-healthloganalytics-summary__entry__38} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Health Log Analytics we have noted them here. {#dfrn3-healthloganalytics-summary__entry__44} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Health Log Analytics, such as specific requirements or compliance levels. {#dfrn3-healthloganalytics-summary__entry__50} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | Accessibility information : Dark theme : The new Coral theme includes a dark theme option for web and mobile experiences. This option is commonly used to alleviate eye strain and improve readability. | [ ] ## Localization information If there are specific localization considerations for Health Log Analytics we have noted them here. {#dfrn3-healthloganalytics-summary__entry__56} | Release | Release notes | |-|-| | Yokohama | Localization information : The current available languages for Health Log Analytics are US English, UK English, French, German, Italian, Japanese, and Spanish. The default language is US English. | | Zurich | Localization information : The current available languages for Health Log Analytics are US English, UK English, French, German, Italian, Japanese, and Spanish. The default language is US English. | [ ] ## Highlight information If there are specific highlight considerations for Health Log Analytics we have noted them here. {#dfrn3-healthloganalytics-summary__entry__62} | Release | Release notes | |-|-| | Yokohama | * Use the enhanced Splunk data input to ingest data from Splunk in a preprocessed structured format. You can also pull data from Splunk regularly using the new Splunk Polling data input. * Take advantage of a unified interface for convenient data input integration by setting up integrations from the Integrations Launchpad. * Streamline HLA data ingestion with tools for handling large log volumes by using dedicated Cribl and Edge Delta data inputs. * Configure log data integrations for Splunk TCP/UDP, Splunk Poller, MID Server, Apache Kafka, Microsoft Azure Log Analytics, REST API, and Amazon Data Firehose conveniently from the Integrations Launchpad. * Generate a description of Health Log Analytics alerts using Now Assist. See [Health Log Analytics](https://www.servicenow.com/docs/access?context=hla-landing-page&family=yokohama&ft:locale=en-US) for more information. | | Zurich | * Use the Cribl integration to streamline Health Log Analytics data ingestion with Cribl. * Leverage additional information presented on the integration's Overview screen, such as the ITOM Gateway in the processing pipeline and the log streaming rate per minute. * Map log data to service instances and components for alerts in context. * Monitor ServiceNow instance logs with the ServiceNow Log Export data input. See [Health Log Analytics](https://www.servicenow.com/docs/access?context=hla-landing-page&family=zurich&ft:locale=en-US) for more information. | [ ]