Custom Log Ingestion

The Bronto Ingestion API lets you POST log events directly to Bronto from any HTTP client or script. This is useful when you need to build a custom pipeline, integrate with an existing system, or ingest logs programmatically without an agent.

Prerequisites

You’ll need an API key with ingestion or admin permissions. See API Keys for how to create one.

Endpoints

https://ingestion.eu.bronto.io — EU region
https://ingestion.us.bronto.io — US region

OTLP logs can also be sent to https://ingestion.eu.brontobytes.io/v1/logs or https://ingestion.us.brontobytes.io/v1/logs.

Request Format

All requests must be POST with a JSON Lines (NDJSON) body — one JSON object per line.

Required headers

Header	Value
`x-bronto-api-key`	Your Bronto API key
`Content-Type`	`application/json`

Recommended headers

These headers control how your data is organized in Bronto. See Data Organization for how datasets, collections, and tags work.

Header	Description
`x-bronto-dataset`	Dataset to ingest into
`x-bronto-collection`	Collection name
`x-bronto-tags`	Comma-separated tags to attach to events

Other headers

Header	Description
`Content-Encoding`	Compression format: `gzip`, `zstd`, or `deflate`

Event schema

Each line in the request body should be a JSON object with the following fields:

Field	Required	Description
`message`	Yes	The log content string
`timestamp`	Recommended	ISO 8601 timestamp (e.g. `2024-01-15T10:30:00Z`)

Send logs

Uncompressed

Send logs

curl -X POST https://ingestion.eu.bronto.io \
  -H "x-bronto-api-key: <YOUR_API_KEY>" \
  -H "Content-Type: application/json" \
  --data-binary '{"timestamp":"2024-01-15T10:30:00Z","message":"user login successful","user":"alice"}
{"timestamp":"2024-01-15T10:30:01Z","message":"request completed","status":200}'

With gzip compression

Send logs with gzip

echo '{"timestamp":"2024-01-15T10:30:00Z","message":"user login successful"}' | \
  gzip | \
  curl -X POST https://ingestion.eu.bronto.io \
    -H "x-bronto-api-key: <YOUR_API_KEY>" \
    -H "Content-Type: application/json" \
    -H "Content-Encoding: gzip" \
    --data-binary @-

With Zstandard compression

Send logs with zstd

echo '{"timestamp":"2024-01-15T10:30:00Z","message":"user login successful"}' | \
  zstd | \
  curl -X POST https://ingestion.eu.bronto.io \
    -H "x-bronto-api-key: <YOUR_API_KEY>" \
    -H "Content-Type: application/json" \
    -H "Content-Encoding: zstd" \
    --data-binary @-

With deflate compression

Send logs with deflate

echo '{"timestamp":"2024-01-15T10:30:00Z","message":"user login successful"}' | \
  python3 -c "import sys,zlib; sys.stdout.buffer.write(zlib.compress(sys.stdin.buffer.read()))" | \
  curl -X POST https://ingestion.eu.bronto.io \
    -H "x-bronto-api-key: <YOUR_API_KEY>" \
    -H "Content-Type: application/json" \
    -H "Content-Encoding: deflate" \
    --data-binary @-

Batch processing

For large files, use a shell script to split the file into chunks and send each one:

Batch ingest from file

#!/bin/bash
FILE="logs.ndjson"
BATCH_SIZE=5000
API_KEY="<YOUR_API_KEY>"
ENDPOINT="https://ingestion.eu.bronto.io"

split -l $BATCH_SIZE "$FILE" /tmp/batch_

for batch in /tmp/batch_*; do
  gzip -c "$batch" | curl -s -X POST "$ENDPOINT" \
    -H "x-bronto-api-key: $API_KEY" \
    -H "Content-Type: application/json" \
    -H "Content-Encoding: gzip" \
    --data-binary @-
  echo "Sent $batch"
done

rm /tmp/batch_*

Compression ratios

Compressing payloads before sending reduces transfer size significantly. Typical compression ratios for CDN logs:

Algorithm	`Content-Encoding` value	Typical ratio
gzip	`gzip`	~7.8%
Zstandard	`zstd`	~6.0%
Deflate	`deflate`	~7.8%

Zstandard offers the best compression ratio and is recommended for high-volume pipelines.

Payload size limits

Payload type	Maximum size
Uncompressed	10 MB (10,485,760 bytes)
Compressed (wire size)	10 MB (10,485,760 bytes)

Exceeding these limits returns an HTTP 413 response.

Response codes

Code	Meaning
`200`	Success — events ingested
`400`	Malformed request or invalid JSON
`401`	Invalid or missing API key
`413`	Payload exceeds size limit
`429`	Rate limit or quota exhausted
`500`	Server error

Reliable delivery

A 200 response means your data has been securely stored and will be ingested — no data will be lost. If the API returns an error response, no data from that request will be ingested.

Bronto is built for reliable, end-to-end delivery. Once you receive a 200, your logs are safe.

Get started

Changelog

Tracing

Metrics

Search

Query syntax

Visualize

Monitors and alerting

Notification channels

My Data

Account and security

SSO

Reference

Prerequisites

Endpoints

Request Format

Required headers

Recommended headers

Other headers

Event schema

Send logs

Uncompressed

With gzip compression

With Zstandard compression

With deflate compression

Batch processing

Compression ratios

Payload size limits

Response codes

Reliable delivery

​Prerequisites

​Endpoints

​Request Format

​Required headers

​Recommended headers

​Other headers

​Event schema

​Send logs

​Uncompressed

​With gzip compression

​With Zstandard compression

​With deflate compression

​Batch processing

​Compression ratios

​Payload size limits

​Response codes

​Reliable delivery

Prerequisites

Endpoints

Request Format

Required headers

Recommended headers

Other headers

Event schema

Send logs

Uncompressed

With gzip compression

With Zstandard compression

With deflate compression

Batch processing

Compression ratios

Payload size limits

Response codes

Reliable delivery