Log Export Service (LES) Payloads
Reference for LES JSON payload formatting
Content
I don’t expect the format to change, but the following was exported from Log Export Service 3.3.0 on Yokohama.
The following details are all based on LES Source configurations with the ‘Accepts’ field set to the default value of ‘JSON’. The ‘text’ option will be covered in a future post, but I’m not sure when since I’ve never seen this used in a real-world deployment of LES.
Payload
Common Attributes
The following nine attributes are present in every LES payload regardless of source type:
| Attribute | Description |
|---|---|
_timestamp |
Event timestamp |
_source_type |
Source type (syslog, table, localhost_log) |
_system_id |
System/instance identifier |
_logged_in_user |
Logged-in user at time of event |
_logger_name |
Logger class or script path |
_user |
Acting user |
_is_impersonating |
Whether user is impersonating |
_txid |
Transaction ID |
_session_id |
Session identifier |
The three table source type payloads (Transaction, Audit, Outbound HTTP) share four additional attributes not found in Syslog or Node Log:
| Attribute | Description |
|---|---|
_page_name |
Page generating the log entry |
_log_table_table_name |
Source table name for the log |
_log_table |
Log table (e.g., sys_audit, syslog_transaction) |
sys_id |
Record sys_id |
Syslog and Node Log share _message and _level, which the table-type payloads do not have.
Table
Here is a sample payload for each of the OOB LES Source options. Notice that inside the payload there is no mention of the Hermes/Kafka bootstrap or topic configuration. This is only used for transport layer configuration.
Syslog
Config:
Payload:
{
"_timestamp" : "2026-03-27T14:02:34.219642141",
"_source_type" : "syslog",
"_system_id" : "app135049.ord101.service-now.com:psxlogexportstage003",
"_logged_in_user" : "system",
"_logger_name" : "sn_data_discovery.sys_script_include.c18595b3437102105a2ad069a7b8f297",
"_user" : "system",
"_is_impersonating" : "false",
"_txid" : "cfbea883333b",
"_session_id" : "glide.scheduler.worker.7",
"_message" : "Unable to run Accidental PII Discovery Job: No license for Data Privacy and/or Data Discovery.",
"_level" : "ERROR",
"_script_record" : "c18595b3437102105a2ad069a7b8f297",
"_scope" : "sn_data_discovery",
"_package" : "1ce87daf2059d110f877dbb56179e0a1",
"_script_table" : "sys_script_include",
"_syslog_source" : "sn_data_discovery",
"record_sys_id" : "c80f4a56332d32509a5cb6919e5c7b79",
"table_name" : "sys_trigger",
"caller" : "com.glide.schedule_v2.SchedulerWorkerThread",
"job_name" : "Accidental PII Discovery"
}
Transaction
{
"_timestamp" : "2026-03-26T21:12:16",
"_source_type" : "table",
"_system_id" : "app135049.ord101.service-now.com:psxlogexportstage003",
"_logged_in_user" : "admin",
"_logger_name" : "com.glide.script.GlideRecordLogger",
"_user" : "admin",
"_is_impersonating" : "false",
"_txid" : "fb77c1363373",
"_session_id" : "AC9AD832337F72909A5CB6919E5C7B73",
"_page_name" : "sys_kafka_topic_list.do",
"_log_table_table_name" : "",
"_log_table" : "syslog_transaction",
"_tx_pattern_hash" : "-494480968",
"sys_id" : "fb77c1363373b2909a5cb6919e5c7be9",
"business_rule_count" : "1",
"transaction_pattern" : "-494480968",
"referer" : "/sys_kafka_topic_list.do",
"request_param_size" : "208",
"session" : "AC9AD832337F72909A5CB6919E5C7B73",
"type" : "list",
"protocol" : "HTTP/1.1",
"remote_ip" : "165.225.11.1",
"origin_scope" : "global",
"sql_count" : "30",
"client_transaction" : "0",
"start_process_at" : "2026-03-26 21:12:16",
"sql_time" : "14",
"potential_cpu_time" : "14832",
"user_agent" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.",
"cpu_time" : "187",
"phase1_form_length" : "221973",
"session_wait_time" : "0",
"business_rule_time" : "5",
"system_id" : "app135049.ord101.service-now.com:psxlogexportstage003",
"network_time" : "0",
"total_wait_time" : "0",
"largest_input_read" : "0",
"gzip" : "1",
"url" : "/sys_kafka_topic_list.do?sysparm_userpref_module=6a8ed1d65b09111025319a011581c743&sysparm_nostack=true",
"largest_chunk_written" : "66028",
"output_length" : "32034",
"acl_time" : "9",
"render_size" : "150083",
"transaction_number" : "11129",
"response_time" : "213",
"has_call_chain" : "0",
"cpu_usage" : "0.01",
"transaction_processing_time" : "213",
"semaphore_wait_time" : "0"
}
Audit
{
"_timestamp" : "2026-03-27T14:50:33",
"_source_type" : "table",
"_system_id" : "app135049.ord101.service-now.com:psxlogexportstage003",
"_logged_in_user" : "admin",
"_logger_name" : "com.glide.script.GlideRecordLogger",
"_user" : "admin",
"_is_impersonating" : "false",
"_txid" : "0eb9384f333b",
"_session_id" : "AC9AD832337F72909A5CB6919E5C7B73",
"_page_name" : "incident.do",
"_log_table_table_name" : "incident",
"_log_table" : "sys_audit",
"_log_table_field_name" : "description",
"sys_id" : "ceb93883337bf2909a5cb6919e5c7b21",
"fieldname" : "description",
"newvalue" : "Unable to access the shared folder. Please provide access. Customer's manager has escalated.",
"documentkey" : "57af7aec73d423002728660c4cf6a71c",
"record_checkpoint" : "7",
"tablename" : "incident",
"internal_checkpoint" : "19d2fc688d90000001",
"user" : "admin",
"oldvalue" : "Unable to access the shared folder. Please provide access."
}
Outbound HTTP
Basic
{
"_timestamp" : "2026-03-27T15:17:37",
"_source_type" : "table",
"_system_id" : "app135049.ord101.service-now.com:psxlogexportstage003",
"_logged_in_user" : "admin",
"_logger_name" : "com.glide.script.GlideRecordLogger",
"_user" : "admin",
"_is_impersonating" : "false",
"_txid" : "deef38cb337b",
"_session_id" : "AC9AD832337F72909A5CB6919E5C7B73",
"_page_name" : "sys_rest_message_fn.do",
"_log_table_table_name" : "sys_ui_action",
"_log_table" : "sys_outbound_http_log",
"sys_id" : "a6ef7c0f337bf2909a5cb6919e5c7b1b",
"scheme" : "https",
"user_name" : "admin",
"response_body" : "Hey ya! Great to see you here. Btw, nothing is configured for this request path. Create a rule and s**body truncated**",
"path" : "/api/v1/scim-identity",
"protocol" : "HTTP/1.1",
"hostname" : "apitest1111991.free.beeceptor.com",
"source_record" : "48c17ed207131000dada43c0d1021e83",
"transaction_name" : "#15625 /sys_rest_message_fn.do",
"request_query" : "f=l1&s=",
"transaction_id" : "deef38cb337bf2909a5cb6919e5c7b93",
"method" : "GET",
"response_status" : "200",
"system_id" : "app135049.ord101.service-now.com:psxlogexportstage003",
"log_level" : "All",
"session_id" : "AC9AD832337F72909A5CB6919E5C7B73",
"url" : "https://apitest1111991.free.beeceptor.com/api/v1/scim-identity?f=l1&s=",
"response_length" : "125",
"response_headers" : "{Access-Control-Allow-Origin=*, Alt-Svc=h3=\":443\"; ma=2592000, Content-Length=125, Content-Type=text/plain, Date=Fri, 27 Mar 2026 15:17:36 GMT, Vary=Accept-Encoding}",
"request_body" : "**Request body logging only supported for POST/PUT/PATCH methods**",
"request_length" : "0",
"request_headers" : "{X-SNC-INTEGRATION-SOURCE=96c3c062eb364654cbdefceacad0cdbd, User-Agent=ServiceNow/1.0, Host=apitest1111991.free.beeceptor.com}",
"response_time" : "306",
"source_table" : "sys_ui_action",
"app_scope" : "global"
}
All
{
"_timestamp" : "2026-03-27T15:17:37",
"_source_type" : "table",
"_system_id" : "app135049.ord101.service-now.com:psxlogexportstage003",
"_logged_in_user" : "admin",
"_logger_name" : "com.glide.script.GlideRecordLogger",
"_user" : "admin",
"_is_impersonating" : "false",
"_txid" : "deef38cb337b",
"_session_id" : "AC9AD832337F72909A5CB6919E5C7B73",
"_page_name" : "sys_rest_message_fn.do",
"_log_table_table_name" : "sys_ui_action",
"_log_table" : "sys_outbound_http_log",
"sys_id" : "a6ef7c0f337bf2909a5cb6919e5c7b1b",
"scheme" : "https",
"user_name" : "admin",
"response_body" : "Hey ya! Great to see you here. Btw, nothing is configured for this request path. Create a rule and s**body truncated**",
"path" : "/api/v1/scim-identity",
"protocol" : "HTTP/1.1",
"hostname" : "apitest1111991.free.beeceptor.com",
"source_record" : "48c17ed207131000dada43c0d1021e83",
"transaction_name" : "#15625 /sys_rest_message_fn.do",
"request_query" : "f=l1&s=",
"transaction_id" : "deef38cb337bf2909a5cb6919e5c7b93",
"method" : "GET",
"response_status" : "200",
"system_id" : "app135049.ord101.service-now.com:psxlogexportstage003",
"log_level" : "All",
"session_id" : "AC9AD832337F72909A5CB6919E5C7B73",
"url" : "https://apitest1111991.free.beeceptor.com/api/v1/scim-identity?f=l1&s=",
"response_length" : "125",
"response_headers" : "{Access-Control-Allow-Origin=*, Alt-Svc=h3=\":443\"; ma=2592000, Content-Length=125, Content-Type=text/plain, Date=Fri, 27 Mar 2026 15:17:36 GMT, Vary=Accept-Encoding}",
"request_body" : "**Request body logging only supported for POST/PUT/PATCH methods**",
"request_length" : "0",
"request_headers" : "{X-SNC-INTEGRATION-SOURCE=96c3c062eb364654cbdefceacad0cdbd, User-Agent=ServiceNow/1.0, Host=apitest1111991.free.beeceptor.com}",
"response_time" : "306",
"source_table" : "sys_ui_action",
"app_scope" : "global"
}
Node Log
{
"_timestamp" : "2026-03-26T21:14:11.935951806",
"_source_type" : "localhost_log",
"_system_id" : "app135049.ord101.service-now.com:psxlogexportstage003",
"_logged_in_user" : "guest",
"_logger_name" : "com.glide.velocious.jrobin.partition.JRobinShards",
"_user" : "guest",
"_is_impersonating" : "false",
"_txid" : "80f74db63373",
"_session_id" : "SYSTEM",
"_message" : "*** WARNING *** Unable to open JRobin database: sys_query_pattern_execution_time_0: Invalid file header. File [sys_query_pattern_execution_time_0.bc559920330322109a5cb6919e5c7b04] is not a JRobin RRD file",
"_level" : "WARN"
}
I hope this turns out to be a useful reference document for you. I have been curious for a while to see how the different payloads compared to each other.
Reach out on LinkedIn or SNDevs if you have comments or want to see additional posts like this in other ServiceNow security areas.