> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Logstash to Bronto

> Configure the Logstash data processing pipeline with an HTTP output to enrich, transform, and forward log events from your applications to Bronto.

Logstash forwards logs to Bronto using its built-in `http` output plugin. This page covers Logstash configuration only.

For installation instructions, see the [Logstash installation guide](https://www.elastic.co/guide/en/logstash/current/installing-logstash.html). For the full Logstash configuration reference, see the [Logstash documentation](https://www.elastic.co/guide/en/logstash/current/configuration.html).

## Endpoint and authentication

Use the ingestion endpoint for your Bronto region:

| Region | Endpoint                         |
| ------ | -------------------------------- |
| EU     | `https://ingestion.eu.bronto.io` |
| US     | `https://ingestion.us.bronto.io` |

Every request requires these headers:

| Header                | Required | Description                                                                                              |
| --------------------- | -------- | -------------------------------------------------------------------------------------------------------- |
| `x-bronto-api-key`    | Required | Your [Bronto API key](/Account-Management/API-Keys#create-a-new-api-key).                                |
| `x-bronto-dataset`    | Required | The dataset to route logs to.                                                                            |
| `x-bronto-collection` | Required | The collection to group datasets under.                                                                  |
| `x-bronto-tags`       | Optional | Key-value tag pairs (e.g. `env=prod,team=platform`). See [Partitions](/Search-and-Visualize/Partitions). |

## Minimal configuration

Tail a log file and forward to Bronto.

```ruby /etc/logstash/conf.d/bronto.conf theme={"dark"}
input {
  file {
    id   => "app_input"
    path => "/path/to/your/logs"
  }
}

output {
  http {
    id          => "bronto_output"
    url         => "https://ingestion.<REGION>.bronto.io"
    http_method => "post"
    format      => "json"
    headers     => {
      "x-bronto-api-key"    => "<YOUR_API_KEY>"
      "x-bronto-dataset"    => "<YOUR_DATASET_NAME>"
      "x-bronto-collection" => "<YOUR_COLLECTION_NAME>"
    }
  }
}
```

For the full HTTP output configuration reference, see the [Logstash HTTP output documentation](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-http.html).

## Parsing unstructured logs

Rather than building grok patterns inside Logstash, ship raw log lines to Bronto and use the [Bronto Custom Parser](/core-features/custom-parser) to extract structured fields server-side. The Custom Parser uses LLMs to generate parsers automatically and ships with built-in support for Apache, IIS, HAProxy, Syslog, key-value, and custom formats — no regex maintenance required.

## Common patterns

The patterns below cover configuration concerns most Bronto customers run into.

### Adding metadata to every log

Use the `mutate` filter to inject metadata — e.g. a deployment identifier, branch name, or region — into every event. Values can be referenced from environment variables via `${VAR}`.

```ruby theme={"dark"}
filter {
  mutate {
    add_field => {
      "branch"      => "${APP_GIT_BRANCH}"
      "environment" => "${APP_ENV}"
    }
  }
}
```

### Multi-line logs (stack traces)

Multi-line application output — like Java, Python, or Ruby stack traces — must be reassembled at the input stage so each stack trace ships as a single log record. Use the `multiline` codec on the input.

```ruby theme={"dark"}
input {
  file {
    id   => "app_input"
    path => "/var/log/app.log"
    codec => multiline {
      pattern => "^\s"
      what    => "previous"
    }
  }
}
```

The pattern above appends any line beginning with whitespace to the previous line — a common heuristic for stack traces. Adjust the pattern for your log format. See the [multiline codec documentation](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html) for details.

### Routing multiple log sources to separate datasets

A single Logstash instance can ship logs from multiple applications to different Bronto datasets. Tag each input distinctly, then use a conditional on each output.

```ruby /etc/logstash/conf.d/bronto.conf theme={"dark"}
input {
  file {
    id   => "api_input"
    path => "/var/log/api.log"
    tags => ["api"]
  }
  file {
    id   => "worker_input"
    path => "/var/log/worker.log"
    tags => ["worker"]
  }
}

output {
  if "api" in [tags] {
    http {
      id          => "bronto_api"
      url         => "https://ingestion.<REGION>.bronto.io"
      http_method => "post"
      format      => "json"
      headers     => {
        "x-bronto-api-key"    => "<YOUR_API_KEY>"
        "x-bronto-dataset"    => "api-service"
        "x-bronto-collection" => "<YOUR_COLLECTION_NAME>"
      }
    }
  }

  if "worker" in [tags] {
    http {
      id          => "bronto_worker"
      url         => "https://ingestion.<REGION>.bronto.io"
      http_method => "post"
      format      => "json"
      headers     => {
        "x-bronto-api-key"    => "<YOUR_API_KEY>"
        "x-bronto-dataset"    => "worker-service"
        "x-bronto-collection" => "<YOUR_COLLECTION_NAME>"
      }
    }
  }
}
```

## Verify log collection

Once you have applied your configuration and restarted Logstash, you can expect to see your log data being ingested to Bronto and accessible via the [Search](https://app.bronto.io/search) page.

## Further reading

* [Logstash installation](https://www.elastic.co/guide/en/logstash/current/installing-logstash.html)
* [Logstash configuration reference](https://www.elastic.co/guide/en/logstash/current/configuration.html)
* [`http` output plugin](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-http.html)
* [`multiline` codec](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html)
* [Bronto Custom Parser](/core-features/custom-parser) — extract structured fields from unstructured logs