---
title: Rsyslog, Filebeat, or Winlogbeat data input configuration fields
description: Description of the fields on the Rsyslog, Filebeat, and Winlogbeat data input configuration forms.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/it-operations-management/health-log-analytics/hla-data-input-syslog-beats-ref.html
release: brazil
product: Health Log Analytics
classification: health-log-analytics
topic_type: reference
last_updated: "2026-09-10"
reading_time_minutes: 4
breadcrumb: [Data input configuration fields, Health Log Analytics reference, Health Log Analytics, ITOM AIOps, IT Operations Management]
---

# Rsyslog, Filebeat, or Winlogbeat data input configuration fields

Description of the fields on the Rsyslog, Filebeat, and Winlogbeat data input configuration forms.

## Basic configuration

<table id="table_iky_4jq_j4b"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Data input name

</td><td>

Name of the new data input. This field is required.

</td></tr><tr><td>

Description

</td><td>

Optional description of the data input.

</td></tr><tr><td>

MID server

</td><td>

The MID Server to which the logs stream. This field is required.**Note:** The default maximum number of data inputs streaming logs to a single MID Server is 10. You can modify this number in the MID Server properties.

</td></tr><tr><td>

Port

</td><td>

The port on the MID Server. This field is required.

**Note:** Choose a port within the suggested range from the array. The port must not be occupied by another process. Verify that your organization’s security team opens the selected port.

</td></tr><tr><td>

Content pack

</td><td>

\(Linux using Filebeat only\) The content pack to use.Content packs contain default source types and mapping script templates. Health Log Analytics activates the selected pack automatically and uses its mapping script for mapping the data input sources. For more information, see [Health Log Analytics content packs for quicker time to value](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/health-log-analytics/hla-content-packs.md).

</td></tr></tbody>
</table><table id="table_eqc_zjq_j4b"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Path

</td><td>

The full path from which to stream logs. You can use a wildcard. This field is required.

</td></tr><tr><td>

Service instance

</td><td>

The service instance to which to bind the log data. This field is required.Selecting the service instance enables HLA to correlate CIs and service instances in the CMDB for root cause analysis.

**Note:** If no appropriate service instance exists, create one, add CIs to it, and set its status to Operational. For more information, see [Create a Service instance \(application service\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/servicenow-platform/create-it-services.md).

</td></tr><tr><td>

Component

</td><td>

The device type or stack layer as context for the logs that is used for anomaly detection and correlation. For example: Tomcat.Components typically represent CIs in the CMDB. Several components are often clustered together in a single service instance.

</td></tr><tr><td>

Source Type

</td><td>

The source type, which defines how Health Log Analytics handles a specific application and parses the log data. For example: Tomcat Catalina.Each data input can have multiple source types, based on the diversity of its log formats. Service instances and components can have any number of source types.

</td></tr></tbody>
</table>## Advanced configuration

For Rsyslog data inputs:

|Field|Description|Default values|
|-----|-----------|--------------|
|Use SSL/TLS|Option to use SSL/TLS.| |
|Look up hostnames|Option to perform DNS lookup to resolve IPs to hostnames.|false|
|Boss thread count|The number of threads that manage connections.|1|
|Worker thread count|The number of threads that handle incoming data.|4|
|Read timeout seconds|The timeout, in seconds, since the last read. When the timeout expires, the system closes the channel.|30|
|Default timezone|The default time zone used when a log doesn't include time zone information.|GMT|
|Sub sample drop ratio|The number of events to batch together, out of which one will be discarded. This setting is used to reduce the number of fetched events.|-1|
|Sub sample receive ratio|The number of events to batch together, out of which all but one will be discarded. This setting is used to decrease the number of received events.|-1|
|Max length in bytes|The maximum length of log messages, in bytes.|32766|
|Character encoding|The character encoding for this data input. This field is read-only.|UTF-8|
|Drop if queue is full|Option to discard logs if many processes are waiting in the queue to access the MID Server.|Clear|

For data inputs that use Beats agents:

|Field|Description|Default value|
|-----|-----------|-------------|
|Client inactivity timeout \(sec\)|The timeout, in seconds, to close an inactive channel.|15|
|Worker thread count|The number of threads that handle incoming data.|4|
|Default time zone|The default time zone used when a log doesn't include time zone information.|GMT|
|Sub sample drop ratio|The number of events to batch together, out of which one will be discarded. This setting is used to reduce the number of fetched events.|-1|
|Sub sample receive ratio|The number of events to batch together, out of which all but one will be discarded. This setting is used to decrease the number of received events.|-1|
|Max length in bytes|The maximum length of log messages, in bytes.|32766|
|Character encoding|The character encoding for this data input. This field is read-only.|UTF-8|
|Drop if queue is full|Option to discard logs if many processes are waiting in the queue to access the MID Server.|false|

**Parent Topic:**[Data input configuration fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/health-log-analytics/hla-data-input-config-fields.md)