Configure an OpenTelemetry Collector or 3rd Party agent to send data to HLA - Support and Troubleshooting

Configure an OpenTelemetry Collector or 3rd Party agent to send data to HLA Background and benefits This document describes how to send logs to HLA using the OpenTelemetry (OTLP) protocol.

Logs in OTLP format means sending your application and system logs to HLA using a standardized, vendor-neutral protocol. This allows logs to be easily collected, processed, and correlated regardless of where they originate or where they're being sent.

Additional documentation on MID-less ingest with HLA is available at KB2117152.

Requirements Health Log Analytics App version 36.0.19 or later HLA scale enabled on your instance An agent (or API) that emits logs in OpenTelemetry (OTLP) format A KeyStore on your instance to generate an access token Solution Architecture External systems that can emit OTLP log data are configured to send data to a remote endpoint in a regional ServiceNow data center with a secure access token header generated in Integration Launchpad. This is typically an OpenTelemetry Collector, but any solution that can push OTLP log data (v1.6.0 or higher) can be accepted.

Supported distributions of the OpenTelemetry Collector Generally, any source system that supports emitting log data following the OTLP Specification (v1.6.0 or later) is supported. This includes a large number of agents provided by vendor:

OpenTelemetry Collector Splunk Distribution of the OpenTelemetry Collector AWS Distro for OpenTelemetry Grafana Agent Cribl Stream OpenTelemetry Destination Datadog Vector Agent Dynatrace Collector Any software that emits logs in OTLP (v1.6.0) Sending data from a collector to HLA 1. Create a new MID-less data input in Integration Launchpad and save the integration ID, endpoint, and access token after activating.

2. Find your OpenTelemetry Collector configuration. This is typically a local file or mounted as a ConfigMap object in Kubernetes deployments.

3. Add a new OTLP exporter with your configuration to the collector's logging pipeline (see example below). Use the values provided after you create a MID-less HLA data input in Integration Launchpad for the endpoint, access token, and integration ID.

4. Restart the collector, check for any connection errors or failures in the logs.

5. After several minutes, logs should appear in HLA.

Example OpenTelemetry collector configuration Every collector configuration will be slightly different.

# Basic OTLP log configuration for sending data to HLA # Exports logs to HLA (MID-less) and the console for debugging # Tested with OpenTelemetry Collector Core v0.110.0 # # Learn more about the OpenTelemetry Collector via # https://opentelemetry.io/docs/collector/ receivers: otlp: protocols: grpc: http: processors: batch: exporters: debug: otlp/servicenow: # Replace with the endpoint in your regional data center. # For gRPC exporters, do not append a path to the endpoint: # Just provide a hostname:port, e.g. endpoint: "itomgw-prod-gateway-your-region.sncapps.service-now.com:443" endpoint: "endpoint-provided-by-data-input-screen:443" headers: # Replace with the access token and integration ID provided by your data input. servicenow-access-token: "access-token-provided-by-data-input" servicenow-integration-id: "integration-id-provided-by-data-input" tls: insecure: false timeout: 10s extensions: health_check: pprof: zpages: service: extensions: [health_check, pprof, zpages] pipelines: logs: receivers: [otlp] processors: [batch] exporters: [otlp/servicenow, debug] Send a test log # # This sends a single test OTLP log # Replace INSERT_YOUR_TOKEN_HERE, INSERT_INTEGRATION_ID_HERE and INSERT_REGIONAL_GATEWAY_HERE with appropriate values provided by the data input in Integration Launchpad # curl -v -X POST -H "Content-Type: application/json" -H "servicenow-integration-id: INSERT_INTEGRATION_ID_HERE" -H "servicenow-access-token: INSERT_YOUR_TOKEN_HERE" -d '{"resourceLogs":[{"scopeLogs":[{"logRecords":[{"timeUnixNano":"1716843505000000000","body":{"stringValue":"mini log"}}]}]}]}' https://INSERT_REGIONAL_GATEWAY_HERE.sncapps.service-now.com/ingest/otlp/v1/logs # A valid response will return a 200 OK: * upload completely sent off: 124 bytes Troubleshooting If the collector does not start, verify your configuration has no syntax errors and is valid. External tools like otelbin.io or the collector itself can optionally validate configurations.

For connection errors in the collector logs, verify the data input is active and the integration ID, access token, and endpoint are correct. Also verify your cloud or corporate firewall allows outbound connections over port 443 to the ServiceNow data center.

See KB1957226 for additional recommendations.