Webhook LogSource Configuration

Last updated – 19 August, 2026

In LogicMonitor, Webhook LogSources enable external platforms to push event-based data directly into LogicMonitor for log ingestion.

For more information on how LogSources work, see LogSource Configuration Guide.

Webhook messages are formatted in JSON. The LogSource configuration enables you to do the following:

Define key-value mappings from JSON payloads
Use regular expressions (regex) to capture dynamic values from log messages
Apply regex groups to extract multiple values for log fields or resource mappings

Include Filters for Webhook LogSource Configuration

You can add filters to include resources of certain types, such as an application. The output matching the filter criteria will be forwarded to the log ingestion process.

The following table details the available parameters:

Attribute	Comparison Operator	Value Example	Description
SourceName	Equal, NotEqual, Contain, NotContain, RegexMatch, RegexNotMatch	Meraki+CustomerA	Filters logs based on the `sourceName` value included in the webhook message. Useful for distinguishing logs from multiple sources.
OrganizationName	Equal, NotEqual, Contain, NotContain, RegexMatch, RegexNotMatch, Exist, NotExist	Customer_XYZ_Org	Filters logs by the organization name attribute in the webhook payload. This helps isolate logs from specific business units.
Message	Equal, NotEqual, Contain, NotContain, RegexMatch, RegexNotMatch	“Authentication failed”	Filters logs based on the content of the message field, enabling inclusion or exclusion of specific event types.

Log Fields for Webhook LogSource Configuration

You can configure Log Fields (tags) to send additional metadata with the logs. The following table details the available parameters:

Method	Key example	Value example	Description
Static	Customer	Customer_XYZ	Attaches a fixed key-value pair to every log processed by the LogSource, ensuring consistent metadata tagging.
Dynamic(Regex)	Host	host=*	Extracts metadata by running a regex query on the message field. Useful for pulling values like hostnames or service names.
Dynamic Group Regex	Scheme, Login	(https*):\/\/([a-z]+)	Extracts multiple values from a single regex expression using groups, with each captured group mapped to a separate key.This method is particularly useful for capturing log fields from nested JSON. While standard Webhook Attributes can capture fields directly by their JSON field name, if the required data is nested inside a JSON array, you must use Dynamic Group Regex to extract it.
Webhook Attribute	SourceName	Meraki+CustomerName	Directly maps a JSON field included in the webhook payload (for example, `sourceName`) to a log field. Useful for differentiating webhook sources.

Resource Mappings for Webhook LogSource Configuration

Configure the log property to match a monitored resource. The following table details the available mappings:

Method	Key example	Value example	Description
Static	Customer_Id	1921	Maps all webhook events from this LogSource to a specific monitored resource by applying a fixed key-value pair. Useful for tagging logs from a known source.
Dynamic(Regex)	system.ServiceName	service=*	Extracts resource identifiers (for example, service name) from the webhook payload using a regex applied to the message field.
Dynamic Group Regex	Scheme, Login	(https*):\/\/([a-z]+)	Captures multiple values from a webhook payload using regex groups. Each group is mapped to a separate resource property.
Webhook Attribute	auto.endpoint.serial_number	deviceSerial (where deviceSerial is a Webhook Attribute for Cisco Meraki)	Directly maps a property from the webhook payload (for example, device serial number) to a monitored resource in LogicMonitor.

Requirements for Configuring a Webhook LogSource

To configure a Webhook LogSource, you must have a single Bearer Token or API Token included in the HTTP header of the webhook.
For more information on the requirements, see Webhook Events as Logs.

Configuring a Webhook LogSource

In LogicMonitor, navigate to More > Modules.
Select Add.
In the Add window, select LogSource. The Add New LogSource window displays.
In the Basic Information for Info section, configure the required settings.
For more information, see Configuring Basic Information for LogSource.
In the Summary for Info section, select “LM Logs: Webhook” from the Type dropdown menu.
Add Access Groups to specify who can view, manage, and interact with the logs.
For more information, see Access Groups.
Configure the fields in the Filters section.
For more information, see Configuring Filters for LogSource.
Define Log Fields to attach metadata.
To add a log field, do the following:
1. Select Add Field. it opens a new log field row for configuration.
2. From the Method dropdown, choose how the log field should be defined:
  - Static – Attaches a fixed key-value pair to every log.
  - Dynamic (Regex) – Uses a regex query on the message field to extract a single dynamic value.
  - Dynamic Group Regex – Captures multiple values from a regex expression using groups, with each group mapped to a separate key.
  - Webhook Attribute – Maps a value directly from the webhook payload.
    For example, consider the following webhook payload:
```
{
  "eventId": "evt-12345",
  "severity": "critical",
  "timestamp": 1708179200,
  "device": {
    "name": "router-01",
    "ip": "10.0.0.15"
  },
  "tags": ["network", "core", "production"],
  "acknowledged": false
}
```
    From this payload, you can attach the following fields as metadata:
    - severity
    - eventId
    - device (object)
    - tags (array)
    - acknowledged (boolean)
3. Enter a name in the Key field. The key is the name of the metadata field you want to create. For example, ClientIP
4. Provide the corresponding value in the Value field, based on the method you selected.
5. Add details in the Comment field if additional context is required.
6. Select Save .

Set up Resource Mappings to associate logs with monitored devices.
For more information, see Configuring Resource Mapping for LogSource.
Select Save.

The Webhook LogSource is created and becomes available for processing incoming webhook events. LogicMonitor applies the configured filters, log fields, and resource mappings to matching webhook payloads as logs are ingested.

14-day access to the full LogicMonitor platform

Culture