Configure a Rsyslog, Filebeat, or Winlogbeat data input in Health Log Analytics manually

---
title: Configure a Rsyslog, Filebeat, or Winlogbeat data input in Health Log Analytics manually
description: Set up a data input for streaming log messages to your ServiceNow instance using an Rsyslog, Filebeat, or Winlogbeat agent.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/health-log-analytics/hla-data-input-rsyslog-beats.html
release: australia
product: Health Log Analytics
classification: health-log-analytics
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 7
keywords: [ServiceNow, Health Log Analytics, HLA, manual, data input, configuration]
breadcrumb: [Manual data input configuration, Set up data inputs manually, Set up HLA on your instance, Configuring, Health Log Analytics, ITOM AIOps, IT Operations Management]
---

# Configure a Rsyslog, Filebeat, or Winlogbeat data input in Health Log Analytics manually

Set up a data input for streaming log messages to your ServiceNow instance using an Rsyslog, Filebeat, or Winlogbeat agent.

## Before you begin

-   Verify that a MID Server is installed and configured with the Log Ingestion capability enabled. For more information, see [MID Server system requirements](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/servicenow-platform/r_MIDServerSystemRequirements.md).

    \[Omitted image "hla-mid-log-ingestion.png"\] Alt text: MID Server configuration with Log Ingestion capability enabled.

    **Important:** Health Log Analytics does not support IPv6. To work with the application, configure the MID Server to IPv4.

-   Unless the MID Server and external clients are on the same network, verify that the MID Server has a public IP address. This is required when its IP is exposed through network address translation \(NAT\), a load balancer, or a similar device. The public IP address enables external clients, such as Filebeat agents located outside its network, to reach the MID Server. Private IP addresses aren't routable over the internet. Without a public IP, external clients can't connect to the MID Server even if they are configured with its address. In the MID Server properties, add a property named **mid.public\_ip** with the public IP address as the value. For more information, see [Create a MID Server property](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/servicenow-platform/r_MIDServerProperties.md). If the MID Server and external clients are on the same network, connections can be made using the private IP address.
-   For shipping your logs encrypted using SSL TLS, see the [Streaming Data With Rsyslog & Filebeat Using SSL \[KB0866319\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0866319) article in the Now Support Knowledge Base.

Role required: evt\_mgmt\_admin

## Procedure

1.  Navigate to **All** > **Health Log Analytics** > **Data Input** > **Data Inputs**.

2.  On the Data Inputs page, select **New**.

3.  Choose the data input type to create from the available data input types described in the table.

    **Note:** The selected data input type complements the passive data input \(listener\). For more information, see [Supported data inputs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-data-input-supported.md).

    |Type|Description|
    |----|-----------|
    |Rsyslog|Streams log messages from UNIX-based servers to the ServiceNow AI engine using the Rsyslog agent.|
    |Linux using Filebeat|Streams system log messages and local files from Linux servers to the instance using the Filebeat agent.|
    |Windows Application Logs using Filebeat|Streams local files from Microsoft Windows devices to the ServiceNow instance using the Filebeat agent.|
    |Windows OS using Winlogbeat|Streams Windows event logs to the ServiceNow instance using the Winlogbeat agent.|

4.  On the **Getting Started** tab, fill in the form.

    For a description of the fields, see [Rsyslog, Filebeat, or Winlogbeat data input configuration fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-data-input-syslog-beats-ref.md).

    **Note:** When creating a data input for Linux using Filebeat, you can select a content pack from the **Content pack** drop-down. The content pack contains default source types and mapping script templates that save you the time it takes to create them from scratch. For more information, see [Health Log Analytics content packs for quicker time to value](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-content-packs.md).

5.  If the Rsyslog, Filebeat, or Winlogbeat agent has not already been installed, download and install it from the **Installation** tab.

    For installation instructions, refer to the product documentation of the respective agent.

    **Important:** Verify that you’re running the latest version of the agent. Earlier versions will work, but with limited functionality.

6.  On the **Tagging and Binding** tab, assign logs to a service instance in the Configuration Management Database \(CMDB\)

    Associating logs with a service instance in the CMDB is a prerequisite for log data correlation and root cause analysis.

    1.  For each source, configure the path and service instance for the logs to be streamed.

        **Note:** By default, only the required fields **Path** and **Service instance** appear.

        For a description of the fields, see [Rsyslog, Filebeat, or Winlogbeat data input configuration fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-data-input-syslog-beats-ref.md).

    2.  If you want to ship multiline logs using Filebeat, configure the properties that control how Filebeat handles messages that span multiple lines of text.

        **Note:** Health Log Analytics currently doesn't support multiline properties for Rsyslog.

        |Field|Description|
        |-----|-----------|
        |Match|Setting that specifies how Filebeat combines matching lines into an event.|
        |Negate|Setting that specifies whether the pattern identified in the log lines is negated.|
        |Regex|Setting that specifies the regular expression to match.|

    3.  Define additional log paths to enable the data input to stream log types from multiple paths.

        Do the following for each additional log path:

        1.  Insert a new row.
        2.  Configure the log path.
        3.  Choose a service instance.
        4.  \(Optional\) Choose a component and a source type.
        **Note:** This option is not available or necessary when using Winlogbeat, because Health Log Analytics streams the Windows event logs.

7.  On the **Finish** tab, complete the configuration for your data input type.

    -   Rsyslog:
        1.  Download the configuration file and install it on the endpoint device, in the `/etc/rsyslog.d/rsyslog.conf` directory.

            **Note:** If you're using the Health Log Analytics application, Version 20.0.11 - July 2021, available from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home), do the following instead:

            1.  On the endpoint device, install the configuration file in the `/etc/rsyslog.d/` directory.
            2.  Create a spool directory by running the `sudo mkdir -p/var/spool/rsyslog` command.
        2.  Validate the configuration by running the `rsyslogd -N1` command and verify the output.
        3.  Restart Rsyslog by running the `sudo systemctl restart rsyslog` command.
        4.  Verify the output. If it contains errors, check the `/var/log/messages` system log file for error messages and fix the errors.
    -   Linux using Filebeat:
        1.  Download the configuration file and install it on the endpoint device, in the `/etc/filebeat/` directory.
        2.  Start the agent service by running the `sudo service filebeat start` command.

            **Note:** The generated configuration ignores files that were last changed more than six hours ago. If needed, you can change this setting in the configuration.

        3.  Restart the agent service by running the appropriate command.
    -   Windows using Beats \(Filebeat or Winlogbeat\):
        1.  Download the configuration file and install it on the endpoint device, in the `C:\Program Files\` directory.
        2.  Start the agent service by running the appropriate command in PowerShell.

            -   Filebeat: `PS > Start-Service filebeat`
            -   Winlogbeat: `PS > Start-Service winlogbeat`
            **Note:** The generated configuration ignores files that were last changed more than six hours ago. If needed, you can change this setting in the configuration.

        3.  Restart the agent service by running the appropriate command.
8.  Select **Save**.

    Health Log Analytics adds the data input record to the Data Inputs table.

9.  Verify that the data input is configured correctly by selecting **Test connection**.

    Health Log Analytics tries to connect the MID Server to the data repository.

    -   If the connection was established, the **Test connection** button is turned off and the **Publish** button is enabled.
    -   If the connection failed, the reason for the failure displays in the **Error message** field. This field displays only when a streaming error has occurred.

        Resolve the issue, select **Save** if you modified the configuration, and then select **Test connection** to test the connection again.

        **Note:** You can only publish the data input configuration when the connection is created successfully.

10. Revert to the last published configuration by selecting **Revert Changes**.

    **Note:** This option is available only when you're modifying a previously published configuration.

11. Select **Publish** to publish the data input to the MID Server.


## Result

The data input configuration process is complete. Health Log Analytics adds the data input record to the **Data Inputs** table. The data input starts streaming log data to your ServiceNow instance.

**Note:** The configuration file Health Log Analytics generates for new Filebeat data inputs is compatible with Filebeat version 7.14 and later. Elastic no longer supports Filebeat version 7.17 or earlier.

Existing Filebeat data input configuration files in HLA are compatible with Filebeat versions up to 8.x. If you use Filebeat version 9.0 or later, either migrate from log input to filestream input or generate a new configuration file. For more information on the migration process, refer to the [Filebeat documentation](https://www.elastic.co/docs/reference/beats/filebeat/migrate-to-filestream).

**Note:** If the HLA engine is down and data has stopped streaming, a notification appears at the top of the data input configuration page. When this happens, contact ServiceNow support.

## What to do next

[Verify that the data input is streaming data.](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-data-input-streaming.md)

**Parent Topic:**[Configuring data inputs for Health Log Analytics manually](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-data-inputs-configuring.md)