Edge Delta data input configuration fields

  • Release version: Zurich
  • Updated July 31, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Edge Delta data input configuration fields

    This guide explains the configuration fields available when setting up an Edge Delta data input in ServiceNow. It helps you properly stream log data from Edge Delta to your ServiceNow instance, ensuring correct connectivity and data correlation.

    Show full answer Show less

    Key Configuration Fields

    • Data input name: Mandatory name for the new data input.
    • Description: Optional field to describe the data input.
    • Transport: Specifies the protocol used to send log messages. Options include:
      • TCP: Ideal for large log volumes; requires specifying a MID Server and port. TLS/SSL is not supported. A TCP destination must be created in Edge Delta matching the MID Server host and port.
      • HTTP: Suitable for smaller log sets; uses RESTful APIs via HTTP or HTTPS depending on MID Web Server settings. Requires selecting a MID Web Server, which auto-populates MID Server and port fields. Supports Basic or API Key authentication configured on the MID Web Server. An HTTP destination with a specific endpoint URL and custom headers (Authorization and Content-Type) must be configured in Edge Delta.
    • MID Web Server: Required when using HTTP transport; this is the server receiving streamed logs.
    • MID Server: Required for log streaming; auto-filled if HTTP transport is selected based on the MID Web Server.
    • Port: The listening port on the MID Server. Must be within a recommended range and available. The port must be opened by your security team. Auto-filled for HTTP transport.
    • Service instance: Required to bind log data for HLA correlation with Configuration Items (CIs) in the CMDB. If no service instance exists, create one, add CIs, and set its status to Operational to enable root cause analysis.

    Practical Considerations

    • Choose TCP transport for high-volume logs and HTTP for smaller, secure transmissions.
    • Ensure the MID Server and MID Web Server are correctly configured and reachable.
    • Coordinate with your security team to open necessary ports.
    • Properly configure authentication headers for HTTP transport to enable successful log ingestion.
    • Accurately map logs to service instances in CMDB for effective root cause analysis using HLA.

    Description of the fields on the Edge Delta data input configuration form.

    Table 1. Edge Delta data input configuration form
    Field Description
    Data input name Name of the new data input. This field is required.
    Description Description of the data input.
    Transport The Edge Delta destination used for streaming log messages to the ServiceNow instance. The options are:
    • TCP - Frequently used for handling large volumes of log data.

      If you select TCP, you must provide the MID Server and port.

      When choosing the TCP transport option, create a TCP destination in Edge Delta to send log data to the instance from any source, using the same MID Server host and port you have configured for the Edge Delta data input.

      Note:
      For TCP, TLS/SSL is not supported.
    • HTTP: Frequently used for sending smaller logs via RESTful APIs, HTTP, or HTTPS for secure transmission.
      Note:
      For the HTTP protocol, authentication is used.

      If you select HTTP, you must provide the MID Web Server that is running on the MID Server. The system then populates the MID Server and port fields automatically, based on the provided MID Web Server.

      Depending on the MID Web Server configuration, you can send logs using either HTTP or HTTPS. If the Secure Connection check box on the MID Web Server extension form is clear, use HTTP. If it is selected, use HTTPS. For more information, see Event Management MID Web Server extension form. In addition, if the Authentication Type on the MID Web Server extension form is Basic, provide Basic authentication details in the Authorization header. If the Authentication Type is API Key, provide the key as “Key Api_Key".

      When choosing the HTTP transport option, create an HTTP destination in Edge Delta and enter the Endpoint URL in the following format: http://{MID_SERVER_IP}:{MID_WEB_SERVER_PORT}/api/mid/hla/raw. In Advanced Settings, create two headers to be attached to the HTTP request:
      • An Authorization header with the MID Web Server API key value or basic credentials as MID Web Server configured.
      • A Content-Type header named with the application/json value.
    MID web server The MID Web Server to which the log data is streamed.
    MID server The MID Server to which the Edge Delta logs are streamed.

    This field is required. If you selected HTTP in the Transport field, this field is populated automatically based on the selected MID Web Server.
    Port The port on the MID Server used for listening to logs.

    Choose a port within the suggested range from the array. In the case of TCP transport, the port must not be occupied by another process. Make sure that your organization’s security team opens the selected port.

    This field is required. If you selected HTTP in the Transport field, this field is populated automatically based on the selected MID Web Server.
    Service instance The service instance to which to bind the log data. This field is required.
    Choosing the service instance enables HLA to correlate CIs and service instances in the CMDB for root cause analysis.
    Note:
    If no relevant service instance exists, Create an service instance and add CIs to it. Set the status of the new service instance to Operational.