Health Log Analytics severity mapping

reference australia Updated Sep 10, 2026 1 min read hla-severity-mapping.md
Raw file servicenow.com

Health Log Analytics (HLA) uses common severity values to identify severity labels in the Source Type Structure.

The Log severity mapping table shows how HLA identifies severity words from raw logs (left column) and maps them to its own severity values (middle column). HLA then presents them in Event Management alerts (right column).

Raw log severity HLA log severity Event Management alert severity
TRACE TRACE Keywords-based
VERBOSE TRACE Keywords-based
FINE TRACE Keywords-based
FINER TRACE Keywords-based
FINEST TRACE Keywords-based
DEBUG DEBUG Keywords-based
DBG DEBUG Keywords-based
CONFIG DEBUG Keywords-based
INFORMATIONAL INFORMATIONAL Keywords-based
INFORMATION INFORMATIONAL Keywords-based
INF INFORMATIONAL Keywords-based
INFO INFORMATIONAL Keywords-based
UNKNOWN UNKNOWN Keywords-based
NOTICE NOTICE LOW
NOTIFICATION NOTICE LOW
WARNING WARNING MEDIUM
WARN WARNING MEDIUM
ERROR ERROR HIGH
ERR ERROR HIGH
CRITICAL CRITICAL CRITICAL
CRIT CRITICAL CRITICAL
FAT CRITICAL CRITICAL
FATAL CRITICAL CRITICAL
SEVERE CRITICAL CRITICAL
ALERT ALERT CRITICAL
EMERGENCY EMERGENCY CRITICAL
EMER EMERGENCY CRITICAL

Note: If your raw log contains numerical severities or unrecognized words, map these values to the HLA Log Severity column by creating a conditional statement using the JS function in the Source Type Structure. For more information, see Source type structure adjustment in Health Log Analytics.

Parent Topic:Health Log Analytics reference

Keywords Health Log AnalyticsHLAseverity wordsseverity valueslog severity
Search documentation
Search document titles and file paths on the australia branch