Managing resources

The shared list, get, create, update, delete pattern for datasets, monitors, dashboards, users, API keys, and every other Bronto resource.

Every Bronto resource (datasets, monitors, API keys, and the rest) has a command, and they all take the same verbs.

Listing, inspecting, and changing resources

​

The pattern

bronto <resource> list
bronto <resource> get <id-or-name>
bronto <resource> create -f key=value -f other=value
bronto <resource> update <id-or-name> -f key=value
bronto <resource> delete <id-or-name> --yes

For example:

$ bronto datasets list
COLLECTION  DATASET           LAST_ACTIVITY  LOG_ID
prod        checkout-service  2m ago         0b7c6f2e-1d4a-4c8e-9a51-3f2d8e6b7a10
prod        payments-api      2m ago         5e2a9c41-7b3d-4f6a-8c20-9d1e4b5f6a21
prod        web-frontend      2m ago         8f1d3b7a-2c5e-4a9b-b6d4-1e7f9a3c2b32
staging     checkout-service  5h ago         c3a8e5d2-9f4b-4e1a-a7c3-6b2d8f1e4c43
$ bronto datasets get prod/checkout-service
{
  "collection": "prod",
  "dataset": "checkout-service",
  "log": "checkout-service",
  "log_id": "0b7c6f2e-1d4a-4c8e-9a51-3f2d8e6b7a10",
  "metadata": {
    "created_at": 1776762000000,
...
  }
}
$ bronto monitors get "High 5xx rate on checkout"
{
  "actions": [
...
  "comparison_operator": "ABOVE",
  "description": "More than 5 responses with status >= 500 from checkout-service in 5 minutes",
  "id": "a1f3c9d2-4b6e-4f81-9c2d-7e5b3a8f1c01",
...
  "monitor_type": "PATTERN",
  "name": "High 5xx rate on checkout",
  "status": "ALERT",
  "threshold": 5,
  "window": "Last 5 minutes"
}

At a terminal, list prints a table of the main columns and get prints the whole object as JSON.

Exceptions: no get for parsers, api-keys, forward-configs, webhooks, slack, monitors downtimes; no update for metrics, exports. collections, log-views, and permissions are list-only, and metrics is read-only (list and get, plus top-keys). The generated command reference lists the exact verbs for each resource.

Resource	Try	Platform docs	API reference
datasets, where log events are stored	bronto datasets list	Data Organization	Datasets
collections, which group datasets (list-only)	bronto collections list	Data Organization	Collections
log views (list-only)	bronto log-views list		Logs
parsers	bronto parsers list	Custom Parser
monitors, templates, downtimes (guide)	bronto monitors list	Monitors	Monitors
dashboards and widgets (guide)	bronto dashboards list	Dashboards	Dashboards
saved searches	bronto saved-searches list	Saved Searches
export jobs (guide)	bronto exports list		Exports
metrics and their attribute keys	bronto metrics list	Explore Metrics	Metrics
users, groups, roles, permissions (guide)	bronto users list	User Management	Users
API keys	bronto api-keys list	API Keys	API keys
webhook integrations	bronto webhooks list	Webhooks	Integrations
Slack integrations	bronto slack list	Slack	Integrations
log forwarding destinations	bronto forward-configs list	Log Forwarding	Forward
bring-your-own encryption keys	bronto encryption-keys list	BYOK	Encryption keys
account limits	bronto limits list		Limits

​

Names work wherever ids do

Every command that takes an id also takes a unique name:

• Datasets resolve by name, or by collection/name when the name exists in more than one collection.
• Users resolve by email.
• Roles resolve by id or display_name. System roles have readable ids such as Admin and ReadOnly.
• Monitors, dashboards, and the rest resolve by name. Quote names with spaces.

If a name matches more than one resource, the command fails with exit code 2 and lists the matching ids.

​

Creating and updating

create and update build the request body from repeated -f key=value flags. A value that parses as JSON keeps its type (number, boolean, array, or object). Anything else is sent as a string:

bronto dashboards create -f name=Overview -f description=Prod
bronto parsers update <id> -f name=nginx-combined
bronto groups create -f name=sre

For larger bodies, pass a JSON file with --input, or --input - to read stdin. -f and --input can’t be combined.

bronto monitors create --input monitor.json
./generate-monitor.sh | bronto monitors create --input -

The CLI sends the body unchanged, so use the fields the Bronto API expects for that resource. The example in each command’s help (bronto <resource> create --help) lists the fields the API requires.

Updates to monitors, monitors templates, monitors downtimes, widgets, datasets, forward-configs, webhooks, slack, and roles use HTTP PUT, which replaces the whole object. Send every field you want to keep, not only the one you change. A few other updates need more than the changed field too:

• groups update needs both name and description. The API clears whichever one you leave out, so the CLI refuses an update without both.
• datasets update needs both collection and dataset, and roles update needs both display_name and permissions. The CLI refuses an update without them.
• dashboards update needs name (or a layout). A description is ignored.
• saved-searches update needs name, log_ids, and search_details.

​

Deleting

delete asks for confirmation at a terminal. Without a terminal it can’t ask, so it fails with usage_confirmation_required (exit code 2) unless you pass --yes:

bronto api-keys delete <id> --yes

​

Preview changes with —dry-run

--dry-run works on every command that changes something. It changes nothing, but reads still run, so names resolve and an unknown name fails the same way it would without --dry-run.

Every command that changes something prints the request it would send as a JSON plan on stdout: method, path, and body. That includes delete and action verbs such as groups add-members, monitors mute, and users deactivate. A name you pass shows up as the id it resolved to in the plan’s path. delete also skips its confirmation prompt, because nothing is deleted.

$ bronto dashboards create -f name=Overview -f description=Prod --dry-run
{
  "body": {
    "description": "Prod",
    "name": "Overview"
  },
  "dry_run": true,
  "method": "POST",
  "path": "/dashboards"
}
$ bronto monitors delete "Payments latency p95" --dry-run
{
  "dry_run": true,
  "method": "DELETE",
  "path": "/monitors/b2e4d0a3-5c7f-4092-8d3e-8f6c4b9a2d02"
}

​

Commands beyond CRUD

A few resources have extra verbs:

Command	What it does	Guide
bronto monitors events, bronto monitors notifications	recent events and sent notifications	Monitors
bronto monitors mute, bronto monitors check	mute a monitor, lint definitions in CI	Monitors
bronto dashboards attach-widgets, bronto dashboards remove-widget, bronto dashboards detach-from-template	assemble dashboards	Dashboards
bronto widgets attach-widgets, bronto widgets remove-widget	nest widgets	Dashboards
bronto groups members, bronto groups add-members, bronto groups remove-members	group membership	Access management
bronto users groups, bronto users deactivate, bronto users reactivate, bronto users resend-invite	user lifecycle	Access management
bronto datasets parser get, bronto datasets parser set, bronto datasets parser unset	assign a parser to a dataset	below
bronto metrics top-keys	attribute keys seen on a metric	below
bronto datasets monitors, bronto datasets dashboards	what uses a dataset	below
bronto forward-configs test	check that Bronto can write to a forwarding destination	below

​

Assign a parser to a dataset

bronto datasets parser shows or changes which parser a dataset uses:

$ bronto datasets parser get prod/checkout-service
{
  "parser_id": "8d0f2b4c-6e7a-4c9d-9f3b-4c6e8a0d2f16",
  "parser_name": "json"
}

bronto datasets parser set prod/checkout-service <parser>
bronto datasets parser unset prod/checkout-service

​

Metric attribute keys

bronto metrics top-keys <metric> lists the attribute keys seen on a metric, the metrics counterpart of bronto fields:

bronto metrics top-keys system.cpu.utilization --since 1h

​

What uses a dataset

bronto datasets monitors and bronto datasets dashboards list the monitors and dashboards that query a dataset. Check them before you delete or rename the dataset. They print the same columns as bronto monitors list and bronto dashboards list:

$ bronto datasets monitors prod/checkout-service
NAME                       WINDOW          THRESHOLD  CREATED     ID
High 5xx rate on checkout  Last 5 minutes  5          2026-05-04  a1f3c9d2-4b6e-4f81-9c2d-7e5b3a8f1c01
$ bronto datasets dashboards prod/checkout-service
NAME               DESCRIPTION                                                 CREATED     ID
Checkout overview  Request rate, 5xx errors and latency for the checkout flow  2026-05-04  d4c6e2b5-7e91-42b4-af50-1b8e6d3c4f04

​

Test a forwarding destination

Log forwarding copies events to an S3 bucket. bronto forward-configs test has Bronto write and delete a test object there, so you can check the bucket policy before you create a forward config, or after you change it. Name an existing forward config, or pass --bucket (with --prefix and --storage-class if needed). Flags override the saved config’s fields:

bronto forward-configs test --bucket my-archive-bucket --prefix bronto/
bronto forward-configs test <forward-config>

If Bronto can’t write to the bucket, the command exits 1 with forward_destination_failed.

​

API keys

bronto api-keys create is your one chance to copy a new key. Its output contains the full key (<id>.<secret>), including the JSON it prints when piped, and the CLI reminds you on stderr to store it. Bronto never returns the secret part again: list shows only the key’s id part.

bronto api-keys list masks that id part in every output format, JSON included, so it doesn’t leak into CI logs. Pass --reveal to see it in full.

$ bronto api-keys list
NAME     API_KEY    CREATED     ID
docs-ci  bronto_d…  2026-05-04  7c9e1a3b-5d6f-4b8c-8e2a-3b5d7f9c1e15

​

Usage

bronto usage shows your organization’s billable ingestion volume over a period (default 7d). It doesn’t cover search or export usage:

$ bronto usage --since 7d
TIME              EVENTS  VOLUME
2026-07-19 09:00  41      9.5 kB
2026-07-19 09:05  39      9.1 kB
2026-07-19 09:10  40      9.3 kB
2026-07-19 09:15  38      8.9 kB
2026-07-19 09:20  52      13.6 kB
2026-07-19 09:25  34      7.9 kB

For per-dataset numbers, call the API directly with bronto api GET /usage/organizations/logs (see the api command).