Configure a REST API data input for streaming log data to your ServiceNow instance in JSON format.

Before you begin

Important: Health Log Analytics does not support IPv6. To work with the application, configure the MID Server to IPv4.
  • You must have a configured MID Web Server with the log ingestion capability enabled.

    On the MID Web Server Context form, in the Execute on field, select Specific MID Server and not the cluster option. In the MID Server field, select the specific MID Server to which the log data is pulled.

  • If the IP address of the MID Server is exposed by network address translation (NAT), a load balancer or a similar device, it must have a public IP address. In the MID Server properties, add a property named mid.public_ip with the public IP address as the value. For more information, see Create a MID Server property.

Role required: evt_mgmt_admin

About this task

The extension handles log messages that are sent to the MID Server by an external log source. The MID Server processes the messages and then passes them to your instance.

To stream log messages to the MID Server, the URL must have the format http://{MID_SERVER_IP}:{MID_WEB_SERVER_PORT}/api/mid/hla/raw, where /api/mid/hla/raw is the endpoint.

Procedure

  1. Navigate to All > Health Log Analytics > Data Input > Data Inputs.
  2. On the Data Inputs page, select New.
  3. Choose the REST API data input.
  4. On the form, fill in the fields.
    For a description of the fields, see REST API data input configuration fields.
  5. Select Submit.

Result

Health Log Analytics adds the data input record to the Data Inputs table. The data input starts streaming log data in JSON format to your instance.
Note: If the Health Log Analytics AI engine is down and data has stopped streaming, a notification appears at the top of the data input configuration page. When this happens, contact ServiceNow support.

What to do next

Make sure that the data input is streaming data.