Configure data inputs (Microsoft Azure Log Analytics)

Release version: Washingtondc

Updated February 1, 2024

3 minutes to read

Configure a data input for streaming log data from Microsoft Azure Log Analytics to your ServiceNow instance. The data input points the Health Log Analytics AI engine to a data source in your Microsoft Azure Log Analytics account.

Before you begin

Important:

Health Log Analytics does not support IPv6. To work with the application, configure the MID Server to IPv4.

You must have an installed and configured MID Server with the log ingestion capability enabled.
If the IP address of the MID Server is exposed by network address translation (NAT), a load balancer or a similar device, it must have a public IP address. In the MID Server properties, add a property named mid.public_ip with the public IP address as the value. For more information, see Create a MID Server property.

Role required: evt_mgmt_admin

Procedure

Navigate to All > Health Log Analytics > Data Input > Data Inputs.
On the Data Inputs page, select New.
Choose the Microsoft Azure Log Analytics data input.
On the form, fill in the fields.
For a description of the fields, see Microsoft Azure Log Analytics data input configuration fields.
Optional: Select Advanced to set additional configuration fields.
For a description of the fields, see Microsoft Azure Log Analytics data input configuration fields. For information about configuring the advanced settings later, see Configure advanced settings for Microsoft Azure Log Analytics data inputs.
On the Query settings tab, fill in the fields.
Health Log Analytics uses the values set in these fields to generate the query for receiving log data from Microsoft Azure Log Analytics.
For example:
```
{"query": "ContainerLog | where TimeGenerated > %s | take 500", "project": ["TimeGenerated", "LogEntry", "LogEntrySource"]}
```
where:
- ContainerLog: The data source name.
- TimeGenerated: The event time property name.
- 500: The maximum number of rows retrieved in each query.
- ["TimeGenerated", "LogEntry", "LogEntrySource"]: The event time and the comma-separated list of column names to return.
Alternatively, you can configure a custom query in the Log query field. The value you set in this field overrides the values in all other fields on the Query settings tab except the From field. If the Log query field is empty, Health Log Analytics generates the query using the values set in the other fields on the tab.

For a description of the Query settings fields, see Microsoft Azure Log Analytics data input configuration fields.
On the Transport tab, fill in the fields.
For a description of the fields, see Microsoft Azure Log Analytics data input configuration fields.
Select Save.
Health Log Analytics adds the data input record to the Data Inputs table.
Ensure that the data input is configured correctly by selecting Test connection.

Health Log Analytics tries to connect the MID Server to the data repository.

If the data input is configured to run on a MID Server cluster, the system tries to connect all the MID Servers contained in the cluster to the repository. The cluster passes the test if at least one of its MID Servers gets connected. This feature is supported in the Health Log Analytics application, Version 26.0.17 - February 2023 and later, available from the ServiceNow Store.
- If the connection was established, the Test connection button is turned off and the Publish button is enabled.
- If the connection failed, the reason for the failure displays in the Error message field. Resolve the issue, select Save if you modified the configuration, and then select Test connection to test the connection again.
  Note:
  You can only publish the data input configuration when the connection is created successfully.
Note:
You can revert to the last published configuration by selecting Revert Changes. This option is available only when you're modifying a configuration that has been published previously.
Select Publish to publish the data input to the MID Server.

Result

The data input starts streaming log data from Microsoft Azure Log Analytics to your instance.

Note:

If the Health Log Analytics AI engine is down and data has stopped streaming, a notification appears at the top of the data input configuration page. When this happens, contact ServiceNow support.

What to do next

Make sure that the data input is streaming data.