---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/it-operations-management

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Edit raw log data before processing

# Edit raw log data before processing in Health Log Analytics {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 Minuten Lesedauer

You can modify raw log data and drop or break up log messages before they are treated in the MID Server, and therefore before Health Log Analytics maps and structures
them.

## Vorbereitungen

Role required: evt_mgmt_admin

## Warum und wann dieser Vorgang ausgeführt wird

If your application logs contain sensitive information, such as user identifiers or email addresses, you may want to sanitize or modify the raw data before it reaches Health Log Analytics. Using the Data Input Preprocessor, you can define a JavaScript function that automatically replaces sensitive data with asterisks (\*), removes unwanted log lines, or breaks up multiline
messages. The JavaScript function processes the data before the logs are streamed through the MID Server. This ensures your sensitive content never enters the ServiceNow instance while still enabling Health Log Analytics to map, structure, and analyze the data. This capability is particularly useful for organizations with strict data-privacy or data-sensitivity requirements.

## Prozedur

1. Navigate to AllHealth Log AnalyticsData Input Preprocessor.
2. Open a record.  
   Hinweis:  
   The first time the preprocessing form is displayed, Health Log Analytics fetches log samples automatically. In subsequent sessions, fetch fresh samples manually by selecting Refresh Samples.
3. **Wahlweise:** Prevent showing log samples that are taken from your organization's raw logs by selecting Disable raw log samples.  
   Select this option if you don't want to expose your logs to Health Log Analytics.
4. **Wahlweise:** View how the current JavaScript function affects the log lines.
   1. Add a sample message in the Test manual sample field.
   2. Select Go.
   3. Note how the JavaScript function affects the log lines.
   {#hla-data-input-preprocess__substeps_mxw_ptm_f4b}
5. In the Raw input samples field, choose a log sample that will show the effect of your new JavaScript function on log lines when you test it.
6. Define a JavaScript function that modifies your raw log data before Health Log Analytics maps and structures it.  
   Hinweis:  
   (ACC data inputs only) When the Agent Client Collector switches to a different MID Server to provide failover protection, it must switch to a different ACC data input. Therefore, all ACC data inputs must have the same JavaScript function. Health Log Analytics provides the latest published JavaScript function to all existing and future ACC data inputs, replacing the previous script. This feature is supported in the Health Log Analytics application, Version 22.0.12 - December 2021 and later, available from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home). For information about failover protection in Agent Client Collector Log Analytics (ACC-L), see [Agent Client Collector Log Analytics](https://servicenow-prod.fluidtopics.net/~YCIZgNv3aQGzaz98AjFxQ "Agent Client Collector Log Analytics (ACC-L) enables you to stream log data from Linux and Windows hosts to a ServiceNow instance, using the Agent Client Collector.").
   1. In the JavaScript console, either change the provided default JavaScript function, modify an existing custom JavaScript function, or define a new one.  
      Hinweis:  
      In addition to the default JavaScript function for data preprocessing, Health Log Analytics provides a JavaScript function template named Scrubbing. This JavaScript function removes personally identifiable information such as email addresses, social security numbers, and passwords, from the raw log data. The template can act as a starting point for your custom script code. This feature is supported in the Health Log Analytics application, Version 20.0.11 - July 2021, available from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home).  
      Hinweis:  
      (ACC data inputs only) Make sure that your JavaScript function can be used to handle data streamed by all ACC data inputs.  
      JavaScript functions for preprocessing raw log data use the following objects:
      * Signature: function process(sample, metadata)  
        {#hla-data-input-preprocess__table_krp_n31_24b__entry__2}

        | Object | Description |
        |-|-|
        | sample | The current log sample. |
        | metadata | Object that contains the event stream. To access the event stream, call the metadata.eventStream function. Because event stream is an object, you can access each of its properties by calling the metadata.eventStream.origin or metadata.eventStream.LocalPort functions. The list of available event stream properties is available in the Event Stream: access via metadata tab. |
        [ ]

        {#hla-data-input-preprocess__table_krp_n31_24b}
      * Return type and structure  
        Hinweis:  
        The JavaScript function returns a map of two entries. Do not change this return structure.  
        {#hla-data-input-preprocess__table_vtl_t31_24b__entry__2}

        | Object | Description |
        |-|-|
        | modifiedInput | The current log message after the JavaScript function has modified the original message. If null, the original log message is used. |
        | splitEvents | Array of log messages after the JavaScript function has divided the original message. |
        [ ]

        {#hla-data-input-preprocess__table_vtl_t31_24b}
      * To discard a log message, call `return drop()`.
      {#hla-data-input-preprocess__ul_c4p_1fl_vnb}
   2. Test the JavaScript function by selecting Test and viewing the outcome on your log sample in related lists.  
      {#hla-data-input-preprocess__table_ojy_xht_f4b__entry__2}

      | Tab | Description |
      |-|-|
      | Outcome | The result of running the JavaScript function on your log sample. |
      | Event Stream: access via metadata | The key-value pairs that present the event stream metadata. |
      | Failures | The log samples on which the JavaScript function failed to run successfully. |
      [ ]

      {#hla-data-input-preprocess__table_ojy_xht_f4b}  
      Hinweis:  
      If your new JavaScript function is not behaving as expected, you can revert to the last published one by selecting the Revert JS Function related link.
   3. **Wahlweise:** Make any necessary adjustments and then test the JavaScript function again.
   {#hla-data-input-preprocess__substeps_h3k_vnc_4mb}
7. Select the Save template option to save the JavaScript function.  
   You can either save the JavaScript function as a new template or overwrite the currently selected template.
   * To save the JavaScript function as a new template, enter a new name in the Template name field.
   * To overwrite the template currently selected in the JS function templates field, leave the Template name field empty.
   {#hla-data-input-preprocess__ul_lbs_f3n_f4b}
8. Select Publish to save the JavaScript function to the database.

## Ergebnisse

When the JavaScript function is published, Health Log Analytics uses it to preprocess your raw log data before mapping and structuring it.

The new script is automatically added to the list of JS function templates from which you can choose. This feature is supported in the Health Log Analytics application, Version 20.0.11 - July 2021, available from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home).

(ACC data inputs only) Health Log Analytics provides the published JavaScript function to all existing and future ACC data inputs. The new JavaScript function replaces the previous script.

## Nächste Maßnahme

Proceed to the Data Input Mapping page by selecting the Go to Mapping related link. [Map raw data](https://servicenow-prod.fluidtopics.net/VIT8IvZONTcCl735A~MEMw "Mapping raw log data that streams into your instance determines how the data is handled. Health Log Analytics automatically structures logs, creates metrics for anomaly detection, and presents alerts based on how your data is tagged.") that streams into your instance to determine how Health Log Analytics processes it.