Header properties detection in Health Log Analytics

concept australia Updated Sep 10, 2026 1 min read hla-header-detection.md

Automatic header properties detection in Health Log Analytics separates the transport header from the inner log message and forwards only the inner log message to the source type structure. The inner message contains the actual log data, not the shipping information.

The Health Log Analytics application supports header properties detection for Fluentd, Beats, and Syslog (RFC 3164, RFC 5424).

Starting with Version 33.0.27 - August 2024, the system also supports header properties detection for logs that follow the OpenTelemetry logs data model and semantic conventions. For more information, see the OpenTelemetry Logs Data Model documentation.

You can disable header properties detection for a data input. In this case, the Health Log Analytics AI Engine stops extracting properties from the header. Forwarding the complete raw message to the source type structure can be useful in the following situations:

The inner log message lacks information for parsing, such as timestamp and severity.
The header contains information needed for structuring the log data.
The data input forwards the logs fully parsed.

For the procedure to disable header properties detection, see Map raw log data manually.

Parent Topic:Log data auto-mapping and mapping in Health Log Analytics

Keywords ServiceNowHealth Log AnalyticsHLAtransport headerinner log messagedisable header properties detectionautomatic header detectionsource type structureshipping informationraw message

34 lines · 2.7 KB Wrap lines

---
title: Header properties detection in Health Log Analytics
description: Automatic header properties detection in Health Log Analytics separates the transport header from the inner log message and forwards only the inner log message to the source type structure. The inner message contains the actual log data, not the shipping information.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/health-log-analytics/hla-header-detection.html
release: australia
product: Health Log Analytics
classification: health-log-analytics
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [ServiceNow, Health Log Analytics, HLA, transport header, inner log message, disable header properties detection, automatic header detection, source type structure, shipping information, raw message]
breadcrumb: [Log data auto-mapping and mapping, Set up HLA on your instance, Configuring, Health Log Analytics, ITOM AIOps, IT Operations Management]
---

# Header properties detection in Health Log Analytics

Automatic header properties detection in Health Log Analytics separates the transport header from the inner log message and forwards only the inner log message to the source type structure. The inner message contains the actual log data, not the shipping information.

The Health Log Analytics application supports header properties detection for Fluentd, Beats, and Syslog \(RFC 3164, RFC 5424\).

Starting with Version 33.0.27 - August 2024, the system also supports header properties detection for logs that follow the OpenTelemetry logs data model and semantic conventions. For more information, see the [OpenTelemetry Logs Data Model documentation](https://opentelemetry.io/docs/specs/otel/logs/data-model/).

You can disable header properties detection for a data input. In this case, the Health Log Analytics AI Engine stops extracting properties from the header. Forwarding the complete raw message to the source type structure can be useful in the following situations:

-   The inner log message lacks information for parsing, such as timestamp and severity.
-   The header contains information needed for structuring the log data.
-   The data input forwards the logs fully parsed.

For the procedure to disable header properties detection, see [Map raw log data manually](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-data-input-mapping.md).

**Parent Topic:**[Log data auto-mapping and mapping in Health Log Analytics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-data-input-automapping.md)