Connect Fluent Bit to Bronto

Configure the Fluent Bit log processor to collect application and system logs, batch them, and forward to Bronto over HTTP for search and analysis.

Fluent Bit forwards logs to Bronto using its built-in HTTP output plugin. This page covers Fluent Bit configuration only.

For installation instructions, see the Fluent Bit installation guide. For the full Fluent Bit configuration reference, see the Fluent Bit documentation.

Endpoint and authentication

Use the ingestion endpoint for your Bronto region:

Region	Host
EU	ingestion.eu.bronto.io
US	ingestion.us.bronto.io

Every request requires these headers:

Header	Required	Description
x-bronto-api-key	Required	Your Bronto API key.
x-bronto-dataset	Required	The dataset to route logs to.
x-bronto-collection	Required	The collection to group datasets under.
x-bronto-tags	Optional	Key-value tag pairs (e.g. env=prod,team=platform). See Partitions.

Minimal configuration

Tail a single log file and forward to Bronto.

fluent-bit.conf

[SERVICE]
    flush        1
    daemon       off
    log_level    info

[INPUT]
    name              tail
    path              /path/to/your/logs
    tag               app.logs
    refresh_interval  5
    mem_buf_limit     5MB
    skip_long_lines   on

[OUTPUT]
    name        http
    tls         on
    match       *
    host        ingestion.<REGION>.bronto.io
    port        443
    format      json_lines
    compress    gzip
    header      x-bronto-api-key    <YOUR_API_KEY>
    header      x-bronto-dataset    <YOUR_DATASET_NAME>
    header      x-bronto-collection <YOUR_COLLECTION_NAME>

For the full HTTP output configuration reference, see the Fluent Bit HTTP output documentation.

Parsing unstructured logs

Rather than building Fluent Bit parsers for unstructured text, ship raw log lines to Bronto and use the Bronto Custom Parser to extract structured fields server-side. The Custom Parser uses LLMs to generate parsers automatically and ships with built-in support for Apache, IIS, HAProxy, Syslog, key-value, and custom formats — no regex maintenance required.

Common patterns

The patterns below cover configuration concerns most Bronto customers run into.

Adding metadata to every log

Use the record_modifier filter to inject metadata — e.g. a deployment identifier, branch name, or region — from environment variables. Export the variable from your CI/CD pipeline or container runtime, then reference it in your Fluent Bit config.

export APP_GIT_BRANCH="feature-branch-name"

fluent-bit.conf

[FILTER]
    name    record_modifier
    match   *
    record  branch ${APP_GIT_BRANCH}

Multi-line logs (stack traces)

Multi-line application output — like Java, Python, or Ruby stack traces — must be reassembled at the input stage so each stack trace ships as a single log record. Use the multiline.parser directive on [INPUT]. Fluent Bit ships with parsers for java, python, ruby, go, dotnet, and others.

fluent-bit.conf

[INPUT]
    name              tail
    path              /var/log/app.log
    tag               app.logs
    multiline.parser  python

multiline.parser at the [INPUT] level requires Fluent Bit 1.8 or later.

Routing multiple log sources to separate datasets

A single Fluent Bit instance can ship logs from multiple applications to different Bronto datasets. Tag each [INPUT] distinctly, then use Match on each [OUTPUT].

fluent-bit.conf

[INPUT]
    name              tail
    path              /var/log/api.log
    tag               api.logs

[INPUT]
    name              tail
    path              /var/log/worker.log
    tag               worker.logs

[OUTPUT]
    name        http
    tls         on
    match       api.logs
    host        ingestion.<REGION>.bronto.io
    port        443
    format      json_lines
    compress    gzip
    header      x-bronto-api-key    <YOUR_API_KEY>
    header      x-bronto-dataset    api-service
    header      x-bronto-collection <YOUR_COLLECTION_NAME>

[OUTPUT]
    name        http
    tls         on
    match       worker.logs
    host        ingestion.<REGION>.bronto.io
    port        443
    format      json_lines
    compress    gzip
    header      x-bronto-api-key    <YOUR_API_KEY>
    header      x-bronto-dataset    worker-service
    header      x-bronto-collection <YOUR_COLLECTION_NAME>

The Match field is the routing mechanism — a filter or output with Match api.logs will never apply to worker.logs, and vice versa. A filter with Match * applies to every stream.

Kubernetes

For Kubernetes deployments, install Fluent Bit as a DaemonSet via the official Helm chart and use the x-bronto-collection header to identify the cluster. Dataset names are inferred from Kubernetes metadata.

fluent-bit.conf

[INPUT]
    name               tail
    path               /var/log/containers/*.log
    multiline.parser   docker, cri
    tag                kube.*
    mem_buf_limit      5MB
    skip_long_lines    on

[FILTER]
    name                kubernetes
    match               kube.*
    k8s-logging.parser  on
    k8s-logging.exclude on

[OUTPUT]
    name                http
    tls                 on
    match               kube.*
    host                ingestion.<REGION>.bronto.io
    port                443
    format              json_lines
    compress            gzip
    header              x-bronto-api-key    <YOUR_API_KEY>
    header              x-bronto-collection <CLUSTER_NAME>-<ENVIRONMENT>-<REGION>

Verify log collection

Once you have applied your configuration and restarted Fluent Bit, you can expect to see your log data being ingested to Bronto and accessible via the Search page.

Further reading

• Fluent Bit installation
• Fluent Bit configuration reference
• Multiline parsing
• Fluent Bit Helm chart — for Kubernetes
• Bronto Custom Parser — extract structured fields from unstructured logs