> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Fluent Bit to Bronto

> Configure the Fluent Bit log processor to collect application and system logs, batch them, and forward to Bronto over HTTP for search and analysis.

Fluent Bit forwards logs to Bronto using its built-in HTTP output plugin. This page covers Fluent Bit configuration only.

For installation instructions, see the [Fluent Bit installation guide](https://docs.fluentbit.io/manual/installation/getting-started-with-fluent-bit). For the full Fluent Bit configuration reference, see the [Fluent Bit documentation](https://docs.fluentbit.io/manual/administration/configuring-fluent-bit).

## Endpoint and authentication

Use the ingestion endpoint for your Bronto region:

| Region | Host                     |
| ------ | ------------------------ |
| EU     | `ingestion.eu.bronto.io` |
| US     | `ingestion.us.bronto.io` |

Every request requires these headers:

| Header                | Required | Description                                                                                              |
| --------------------- | -------- | -------------------------------------------------------------------------------------------------------- |
| `x-bronto-api-key`    | Required | Your [Bronto API key](/Account-Management/API-Keys#create-a-new-api-key).                                |
| `x-bronto-dataset`    | Required | The dataset to route logs to.                                                                            |
| `x-bronto-collection` | Required | The collection to group datasets under.                                                                  |
| `x-bronto-tags`       | Optional | Key-value tag pairs (e.g. `env=prod,team=platform`). See [Partitions](/Search-and-Visualize/Partitions). |

## Minimal configuration

Tail a single log file and forward to Bronto.

```ini fluent-bit.conf theme={"dark"}
[SERVICE]
    flush        1
    daemon       off
    log_level    info

[INPUT]
    name              tail
    path              /path/to/your/logs
    tag               app.logs
    refresh_interval  5
    mem_buf_limit     5MB
    skip_long_lines   on

[OUTPUT]
    name        http
    tls         on
    match       *
    host        ingestion.<REGION>.bronto.io
    port        443
    format      json_lines
    compress    gzip
    header      x-bronto-api-key    <YOUR_API_KEY>
    header      x-bronto-dataset    <YOUR_DATASET_NAME>
    header      x-bronto-collection <YOUR_COLLECTION_NAME>
```

For the full HTTP output configuration reference, see the [Fluent Bit HTTP output documentation](https://docs.fluentbit.io/manual/pipeline/outputs/http).

## Parsing unstructured logs

Rather than building Fluent Bit parsers for unstructured text, ship raw log lines to Bronto and use the [Bronto Custom Parser](/core-features/custom-parser) to extract structured fields server-side. The Custom Parser uses LLMs to generate parsers automatically and ships with built-in support for Apache, IIS, HAProxy, Syslog, key-value, and custom formats — no regex maintenance required.

## Common patterns

The patterns below cover configuration concerns most Bronto customers run into.

### Adding metadata to every log

Use the `record_modifier` filter to inject metadata — e.g. a deployment identifier, branch name, or region — from environment variables. Export the variable from your CI/CD pipeline or container runtime, then reference it in your Fluent Bit config.

```bash theme={"dark"}
export APP_GIT_BRANCH="feature-branch-name"
```

```ini fluent-bit.conf theme={"dark"}
[FILTER]
    name    record_modifier
    match   *
    record  branch ${APP_GIT_BRANCH}
```

### Multi-line logs (stack traces)

Multi-line application output — like Java, Python, or Ruby stack traces — must be reassembled at the input stage so each stack trace ships as a single log record. Use the `multiline.parser` directive on `[INPUT]`. Fluent Bit ships with parsers for `java`, `python`, `ruby`, `go`, `dotnet`, and others.

```ini fluent-bit.conf theme={"dark"}
[INPUT]
    name              tail
    path              /var/log/app.log
    tag               app.logs
    multiline.parser  python
```

<Note>
  `multiline.parser` at the `[INPUT]` level requires Fluent Bit 1.8 or later.
</Note>

### Routing multiple log sources to separate datasets

A single Fluent Bit instance can ship logs from multiple applications to different Bronto datasets. Tag each `[INPUT]` distinctly, then use `Match` on each `[OUTPUT]`.

```ini fluent-bit.conf theme={"dark"}
[INPUT]
    name              tail
    path              /var/log/api.log
    tag               api.logs

[INPUT]
    name              tail
    path              /var/log/worker.log
    tag               worker.logs

[OUTPUT]
    name        http
    tls         on
    match       api.logs
    host        ingestion.<REGION>.bronto.io
    port        443
    format      json_lines
    compress    gzip
    header      x-bronto-api-key    <YOUR_API_KEY>
    header      x-bronto-dataset    api-service
    header      x-bronto-collection <YOUR_COLLECTION_NAME>

[OUTPUT]
    name        http
    tls         on
    match       worker.logs
    host        ingestion.<REGION>.bronto.io
    port        443
    format      json_lines
    compress    gzip
    header      x-bronto-api-key    <YOUR_API_KEY>
    header      x-bronto-dataset    worker-service
    header      x-bronto-collection <YOUR_COLLECTION_NAME>
```

The `Match` field is the routing mechanism — a filter or output with `Match api.logs` will never apply to `worker.logs`, and vice versa. A filter with `Match *` applies to every stream.

### Kubernetes

For Kubernetes deployments, install Fluent Bit as a DaemonSet via the [official Helm chart](https://github.com/fluent/helm-charts) and use the `x-bronto-collection` header to identify the cluster. Dataset names are inferred from Kubernetes metadata.

```ini fluent-bit.conf theme={"dark"}
[INPUT]
    name               tail
    path               /var/log/containers/*.log
    multiline.parser   docker, cri
    tag                kube.*
    mem_buf_limit      5MB
    skip_long_lines    on

[FILTER]
    name                kubernetes
    match               kube.*
    k8s-logging.parser  on
    k8s-logging.exclude on

[OUTPUT]
    name                http
    tls                 on
    match               kube.*
    host                ingestion.<REGION>.bronto.io
    port                443
    format              json_lines
    compress            gzip
    header              x-bronto-api-key    <YOUR_API_KEY>
    header              x-bronto-collection <CLUSTER_NAME>-<ENVIRONMENT>-<REGION>
```

## Verify log collection

Once you have applied your configuration and restarted Fluent Bit, you can expect to see your log data being ingested to Bronto and accessible via the [Search](https://app.bronto.io/search) page.

## Further reading

* [Fluent Bit installation](https://docs.fluentbit.io/manual/installation/getting-started-with-fluent-bit)
* [Fluent Bit configuration reference](https://docs.fluentbit.io/manual/administration/configuring-fluent-bit)
* [Multiline parsing](https://docs.fluentbit.io/manual/administration/configuring-fluent-bit/multiline-parsing)
* [Fluent Bit Helm chart](https://github.com/fluent/helm-charts) — for Kubernetes
* [Bronto Custom Parser](/core-features/custom-parser) — extract structured fields from unstructured logs
