---
sourceDocument: Zurich IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/it-operations-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Event collection from Google Cloud Platform (GCP)

# Event collection from Google Cloud Platform (GCP) {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

The MID WebService Event Collector enables you to collect JSON formatted event
messages sent from Google Cloud Platform (GCP).

## Before you begin

Ensure that the Event Management Connectors (sn_em_connector) plugin is
installed on the ServiceNow AI Platform instance.  
Ensure that you:

* Deploy and start the MID Server. See [MID Server
  configuration](https://www.servicenow.com/docs/access?context=c_MIDServerConfiguration&version=zurich&pubname=zurich-servicenow-platform&ft:locale=en-US) .
* Configure and start the MID Web Server. See [Configure the MID Web Server extension](https://www.servicenow.com/docs/RPQvfJbpCp6qgI_dATuFRg "The MID Web Server is a MID Server extension that enables developing REST APIs to send events and metrics to the MID Server. The extension is leveraged by other MID Server extensions, such as Metric Intelligence, MID WebService Event Listener, and the Agent Client Collector websocket endpoint extension.").
* Configure and start the MID WebService Event Collector. See [Configure the MID WebService Event Collector Context](https://www.servicenow.com/docs/xz_3EnP5twMrVy9mNuOSIQ "Configure the MID WebService Event Collector Context to provide a URL method to push event messages from an external source to the MID Server.").
{#event-collection-GCP__ul_d21_gkf_cy}

Role required: evt_mgmt_admin

## About this task

JSON formatted event messages are sent from Google Cloud Platform.
The MID Server transforms the collected event messages by parsing
them using the TransformEvents_MidGoogleMonitor script include, located here: Event ManagementIntegrationsPushConnectors. In the Push Connectors page, click Google Monitor Mid Push Connector.

The default format of the URL to push event messages from the GCP to the MID Server is
<kbd class="ph userinput">http://&lt;MID_Server_IP&gt;:&lt;MID_Web_Server_Port&gt;/api/mid/em/inbound_event?Transform=TransformEvents_MidGoogleMonitor</kbd>.  
{#event-collection-GCP__table_bbq_cmk_k2b__entry__2}

| Variable | Description |
|-|-|
| MID_Server_IP | IP address of the MID Web Server Extension. |
| MID_Web_Server_Port | Listening port of the MID Web Server Extension. |
| MID_Web_Server_User | Username for the MID Web Server Extension. |
| MID_Web_Server_Password | Password of the user of the MID Web Server. |
[Table 1. Variables in the default URL]

{#event-collection-GCP__table_bbq_cmk_k2b}

The following procedure describes the collection of JSON formatted event messages
using basic authentication.

## Procedure

1. In the Google Cloud Platform (GCP) console, make sure the MID Server IP is accessible from the GCP console and MID rest point is accessible from GCP or install the MID Server on a GCP VM and provide the GCP VM external IP address in the URL.  
   In the GCP console, create a firewall rule.
   1. Navigate to VPC NetworkFirewallCreate Firewall.
   2. Set the direction to ingress to allow the mid_web_server_port to connect.
   3. Add the GCP VM that the MID Server is installed on to the Applicable to instances list.
   {#event-collection-GCP__substeps_sbd_25c_xpb}
2. In the GCP console, add a webhook.
   1. Navigate to MonitoringAlerting and click Edit Notification Channels.
   2. In the Webhooks section, click Add New.
   3. Select the Use HTTP Basic Auth check box, and enter the username and password of the MID Webserver User.  
      Note:  
      Ensure that the selected user is assigned the evt_mgmt_integration role. To ensure proper authentication, use the least privileged user with the evt_mgmt_integration role, rather than a high privileged user.
   4. Enter the endpoint URL.  
      For example, use <kbd class="ph userinput">http://&lt;MID_Server_IP&gt;:&lt;MID_Web_Server_Port&gt;/api/mid/em/inbound_event?Transform=TransformEvents_MidGoogleMonitor</kbd>
3. In the GCP console, create an alerting policy.
   1. Navigate to MonitoringAlerting and click Create Policy.
   2. Configure the policy conditions that initiate alerts when the conditions are violated.
   3. Select the webhook notification channel on which the problem should be notified.
   4. Select the Notify on incident closure check box to send the closure events to the MID Server and save the alert policy.  
      Note:  
      If you need to directly open an incident in the GCP Console from the alert, navigate to Quick Response (in Alert)Show Incident in GCP Console. For more information about creating an alert policy, see [Managing alerting policies](https://cloud.google.com/monitoring/alerts/using-alerting-ui) on the Google Cloud documentation site.
   {#event-collection-GCP__substeps_ul1_sgj_ppb}

## Result

GCP does not send values such as the severity
level into the payload. The default severity is Minor, which can be changed in the
Push Connector Configuration section of Push ConnectorsGoogle Monitor MID Push Connector. The valid values of severity are 1- Critical,
2- Major, 3- Minor, 4- Warning, and 5- Info.

*[\>]: and then