# Ticket SNOW form Kibana

**URL:** <https://discuss.elastic.co/t/ticket-snow-form-kibana/379166>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring, elastic-stack-alerting\
**Created:** [June 13, 2025, 12:24pm UTC](https://discuss.elastic.co/t/ticket-snow-form-kibana/379166 "2025-06-13T12:24:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dariia\_Hrebenichenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dariia_hrebenichenko/32/139651_2.png) [@Dariia\_Hrebenichenko](https://discuss.elastic.co/u/Dariia_Hrebenichenko)\
**Post date:** [June 13, 2025, 12:24pm UTC](https://discuss.elastic.co/t/ticket-snow-form-kibana/379166/1 "2025-06-13T12:24:27Z")

</div>

Hello everybody!

I need to create tickets in ServiceNow what based on information in Kibana.

I already have alerting system what takes information from kibana.log and uses logstash to send different emails.

Now I need to make tickets in SNOW using pretty much the same information.  
I saw something about HTTP plugins, but I'm totally lost in amount of information.

Thank you for answers!

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [June 13, 2025, 3:57pm UTC](https://discuss.elastic.co/t/ticket-snow-form-kibana/379166/2 "2025-06-13T15:57:11Z")

</div>

Hey @Dariia_Hrebenichenko  
There is a Kibana Alert Connectors for ServiceNow:

[ServiceNow ITSM connector and action | Kibana](https://www.elastic.co/docs/reference/kibana/connectors-kibana/servicenow-action-type)  
[ServiceNow ITOM connector and action | Kibana](https://www.elastic.co/docs/reference/kibana/connectors-kibana/servicenow-itom-action-type)  
[ServiceNow SecOps connector and action | Kibana](https://www.elastic.co/docs/reference/kibana/connectors-kibana/servicenow-sir-action-type)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 13, 2025, 4:03pm UTC](https://discuss.elastic.co/t/ticket-snow-form-kibana/379166/3 "2025-06-13T16:03:03Z")

</div>

The connector requires a license, I think that the OP does not have a license as logstash is being used to send e-mails based on alerts, which also has a connector that requires a license.

> [@Dariia\_Hrebenichenko](#):
>
> Now I need to make tickets in SNOW using pretty much the same information.  
> I saw something about HTTP plugins, but I'm totally lost in amount of information.

You can use the [`http output plugin`](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-http.html), but you need to test it to see the exactly payload that ServiceNow expects and how to build it in Logstash.