Configure a Cribl data input in Health Log Analytics

---
title: Configure a Cribl data input in Health Log Analytics
description: Configure a dedicated Cribl data input to enable Health Log Analytics to process Cribl log messages streaming into your ServiceNow instance.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/it-operations-management/health-log-analytics/hla-data-input-cribl.html
release: brazil
product: Health Log Analytics
classification: health-log-analytics
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 3
keywords: [Cribl, data input, manual, configuration, ServiceNow, Health Log Analytics, HLA]
breadcrumb: [Manual data input configuration, Set up data inputs manually, Set up HLA on your instance, Configuring, Health Log Analytics, ITOM AIOps, IT Operations Management]
---

# Configure a Cribl data input in Health Log Analytics

Configure a dedicated Cribl data input to enable Health Log Analytics to process Cribl log messages streaming into your ServiceNow instance.

## Before you begin

-   Verify that a MID Server is installed and configured with the Log Ingestion capability enabled. For more information, see [MID Server system requirements](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/servicenow-platform/r_MIDServerSystemRequirements.md).

    \[Omitted image "hla-mid-log-ingestion.png"\] Alt text: MID Server configuration with Log Ingestion capability enabled.

    **Important:** Health Log Analytics does not support IPv6. To work with the application, configure the MID Server to IPv4.

-   Unless the MID Server and external clients are on the same network, verify that the MID Server has a public IP address. This is required when its IP is exposed through network address translation \(NAT\), a load balancer, or a similar device. The public IP address enables external clients, such as Filebeat agents located outside its network, to reach the MID Server. Private IP addresses aren't routable over the internet. Without a public IP, external clients can't connect to the MID Server even if they are configured with its address. In the MID Server properties, add a property named **mid.public\_ip** with the public IP address as the value. For more information, see [Create a MID Server property](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/servicenow-platform/r_MIDServerProperties.md). If the MID Server and external clients are on the same network, connections can be made using the private IP address.

Role required: evt\_mgmt\_admin

## About this task

If your organization uses Cribl for filtering and routing large volumes of log data from various sources, the log format Health Log Analytics receives is distinct from other types. The Cribl data input enables HLA to detect and separate transport headers from inner log messages in this format. It forwards only the inner message to the source type structure for processing.

## Procedure

1.  Navigate to **All** > **Health Log Analytics** > **Data Input** > **Data Inputs**.

2.  On the Data Inputs page, select **New**.

3.  Choose the Cribl data input.

4.  On the **Getting Started** tab, fill in the form fields and then select **Next**.

    For a description of the fields, see [Cribl data input configuration fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/health-log-analytics/hla-data-input-cribl-ref.md).

5.  On the **Config** tab, fill in the form fields and then select **Next**.

6.  On the **Process** tab, select the required route and then select **Next**.

    **Note:** For troubleshooting issues related to this step, see the [Cribl - Setting up Cribl data input \| Troubleshooting setup & data ingestion issues \[KB0558611\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1787528) article in the Now Support Knowledge Base.

    The **Finish** tab opens.

7.  On the Cribl instance, verify that the configuration of the data input is correct.

    You can use the Cribl commands displayed on the **Finish** tab as needed.

8.  If the configuration is correct, return to the data input configuration **Finish** tab and select **Publish** to publish the data input.


## Result

The data input configuration process is complete. The data input starts streaming log data to your ServiceNow instance.

For resolving issues related to the ingestion of log data from Cribl, see the [Cribl - Setting up Cribl data input \| Troubleshooting setup & data ingestion issues \[KB0558611\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1787528) article in the Now Support Knowledge Base.

**Note:** If the HLA engine is down and data has stopped streaming, a notification appears at the top of the data input configuration page. When this happens, contact ServiceNow support.

## What to do next

[Verify that the data input is streaming data.](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/health-log-analytics/hla-data-input-streaming.md)

**Parent Topic:**[Configuring data inputs for Health Log Analytics manually](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/health-log-analytics/hla-data-inputs-configuring.md)