Skip to main content

​
Overview

Bronto supports outbound log forwarding so you can send log events outside of Bronto for archiving, long-term storage, compliance workflows, or downstream processing. Forwarding is configured through the Bronto API. A forward config defines the destination, the logs to forward, optional filters, compression, and batching limits. The currently supported destination type is Amazon S3. If S3 does not fit your needs, contact support to request integrations with other destinations. Common uses include:
  • Archiving selected log events to your own S3 bucket
  • Keeping an external copy of all current and future logs
  • Sending only matching events, such as warnings and errors, to a long-term store
  • Feeding downstream data processing or compliance review workflows

​
How It Works

A forward config can forward either all logs or a specific list of log IDs. When all_logs is set to true, Bronto forwards all logs in the account and automatically includes logs created in the future. When all_logs is set to false, provide the log_ids you want to forward. You can also add a filter to forward only matching events. Filters use Bronto search syntax, so you can target specific severities, services, environments, or any indexed event fields. Forwarded events are buffered and sent to S3 in payloads or batches. Depending on the volume of matching data and the batching configuration, it may take some time for enough events to be collected and uploaded. If data does not appear in S3 immediately after you create a forward config, wait for the next payload to be prepared and delivered. Before creating a forward config, allow Bronto to write to the target S3 bucket. Add a bucket policy like the following, replacing <bucket-name> with the name of the bucket where you want to receive forwarded log data: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Allow Bronto to write data to the S3 bucket",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::637423326566:role/BrontoForwarder"
        ]
      },
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::<bucket-name>",
        "arn:aws:s3:::<bucket-name>/*"
      ]
    }
  ]
}
After updating the bucket policy, use the test destination endpoint to confirm Bronto can write to the target S3 bucket.

​
Configure Forwarding

Use the API reference to create, test, update, retrieve, or delete forwarding configurations:

​
Destination Options

For S3 destinations, configure:
  • bucket: the target S3 bucket name
  • prefix: an optional key prefix, such as bronto/archives/
  • storage_class: the S3 storage class for forwarded objects
Bronto supports ZSTD, GZIP, or no compression. ZSTD is recommended for reducing payload size.