Create a log source configuration

Regulate and set filters on the logs to be forwarded by creating a log source configuration.

Before you begin

Role required: admin or sn_logstoanalytics.admin

Procedure

Navigate to All > Log Export Service > Sources.

A list of source configurations shows up.
Select New to create a new source configuration.

You can also select an existing source configuration if you want to modify it.

The Source form shows up.
On the form, fill up the fields.

Fields	Description
Source Type	Types of log sources- Node Log Table See Log sources for more information.
Log Level	A set of standard logging levels that can be used to control logging output. Following convention, each level will forward logs of equal or greater severity.Note: This field is visible only when one of the following conditions is met. When you select Node Log as the Source Type When you select Table as the Source Type and the table is syslog
Table	Selection of table for exporting table type logs. For more information on supported tables, see Log sources.Note: This field is visible only when you select Table as the Source Type.
Filter Type	Conditions to forward logs selectively.Note: This field is visible only if you select syslog, sys_audit, sys_audit_delete, or sys_audit_relation as the table.
Topic	Select an existing topic, or create a topic through the lookup icon. For more information on creating a topic, refer Create source type and multi topics in the LES source table
Accepts	Specifies the format in which the logs are forwarded to Hermes. They can either be sent as JSON or as plain text.
Active	Indicates whether the Source log is active.

4. Complete the flow that matches the table you selected.

-   **Standard source**

    Select **Submit** to save the source configuration. The source details appear in the Sources list, where you can review its source type, table, topic, and active status.

    **Note:**

    -   Applies when you select Source type as Node Log and any table other than the syslog and sys\_audit tables.
    -   The configuration is complete. Skip the remaining steps.
-   **syslog table**

    When you select **Source type** as Table and syslog in the **Table** field:

    **Note:** You can create multiple source topics for this selection.

    1.  Select the **Log level**.
    2.  Select **Submit**. The **Source topics** related list appears, and the log export filters become available.
    3.  Select **New** to create a new source topic.
    4.  In the **Filter** field, select a value from the dropdown list.
        -   **All**: No additional field appears.
        -   **Application Family**, **Package**, or **Scope**: A corresponding lookup field appears. Select the lookup icon to select a value.
    5.  In the **Topic** field, select an existing topic, or create a topic through the lookup icon. For more information on creating a topic, refer [Create source type and multi topics in the LES source table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/les-multi-topics-v2.md).
    6.  Select **Submit**, and then review the source topics that you created.
-   **sys\_audit table with the Log table filter**

    When you select the **Table** as sys\_audit and **Filter type** as Log table:

    **Note:** You can create multiple source topics for this selection.

    1.  The **Source topics** related list appears, and the log export filters become available.
    2.  Select **New** to create a new source topic.
    3.  Select the required table in the **Log table** field using the lookup icon.
    4.  In the **Topic** field, select an existing topic, or create a topic through the lookup icon. For more information on creating a topic, refer [Create source type and multi topics in the LES source table](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/les-multi-topics-v2.md).
    5.  Select **Submit**, and then review the source topics that you created.

Create source type and multi topics in the LES source table
Consume logs for each source type by creating multiple topics per source type. You can now leverage the option of customized selection of specific topics for different log sources during the debugging process, without impacting the other log tables.

Parent Topic:Administering Log Export Service (LES)

title	Create a log source configuration
description	Regulate and set filters on the logs to be forwarded by creating a log source configuration.
locale	en-US
canonical_url	https://www.servicenow.com/docs/r/australia/platform-security/les-create-source-configuration.html
release	australia
topic_type	task
last_updated	2026-09-10
reading_time_minutes	4
breadcrumb	AdministerLog Export Service \(LES\)Platform Security