> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Log Forwarding

> Forward Bronto log events to an external Amazon S3 bucket for archiving, long-term storage, compliance workflows, or downstream processing.

## Overview

Bronto supports outbound log forwarding so you can send log events outside of Bronto for archiving, long-term storage, compliance workflows, or downstream processing.

Forwarding is configured through the Bronto API. A forward config defines the destination, the logs to forward, optional filters, compression, and batching limits. The currently supported destination type is Amazon S3. If S3 does not fit your needs, contact support to request integrations with other destinations.

Common uses include:

* Archiving selected log events to your own S3 bucket
* Keeping an external copy of all current and future logs
* Sending only matching events, such as warnings and errors, to a long-term store
* Feeding downstream data processing or compliance review workflows

## How It Works

A forward config can forward either all logs or a specific list of log IDs.

When `all_logs` is set to `true`, Bronto forwards all logs in the account and automatically includes logs created in the future. When `all_logs` is set to `false`, provide the `log_ids` you want to forward.

You can also add a `filter` to forward only matching events. Filters use Bronto search syntax, so you can target specific severities, services, environments, or any indexed event fields.

Forwarded events are buffered and sent to S3 in payloads or batches. Depending on the volume of matching data and the batching configuration, it may take some time for enough events to be collected and uploaded. If data does not appear in S3 immediately after you create a forward config, wait for the next payload to be prepared and delivered.

Before creating a forward config, allow Bronto to write to the target S3 bucket. Add a bucket policy like the following, replacing `<bucket-name>` with the name of the bucket where you want to receive forwarded log data:

```json theme={"dark"}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Allow Bronto to write data to the S3 bucket",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::637423326566:role/BrontoForwarder"
        ]
      },
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::<bucket-name>",
        "arn:aws:s3:::<bucket-name>/*"
      ]
    }
  ]
}
```

After updating the bucket policy, use the test destination endpoint to confirm Bronto can write to the target S3 bucket.

## Configure Forwarding

Use the API reference to create, test, update, retrieve, or delete forwarding configurations:

* [Create a new forward config](/api-reference/forward/create-new-config)
* [Test access to the destination](/api-reference/forward/test-access-to-destination)
* [Retrieve forward configs](/api-reference/forward/retrieve-forward-configs)
* [Update an existing forward config](/api-reference/forward/update-existing-config)
* [Delete a forward config](/api-reference/forward/delete-a-config)

## Destination Options

For S3 destinations, configure:

* `bucket`: the target S3 bucket name
* `prefix`: an optional key prefix, such as `bronto/archives/`
* `storage_class`: the S3 storage class for forwarded objects

Bronto supports `ZSTD`, `GZIP`, or no compression. `ZSTD` is recommended for reducing payload size.