ECS Container Logs with AWS FireLens

Route Amazon ECS container logs directly to Bronto using AWS FireLens with Fluent Bit, skipping CloudWatch and reducing AWS log ingestion costs.

​

When to Use FireLens

FireLens is a good fit when you are running workloads on ECS and want to:

• Ship container stdout / stderr logs directly to Bronto without going through CloudWatch
• Keep your setup log-focused without the overhead of an OTel pipeline
• Use AWS’s native ECS log routing rather than managing a separate collector

If you also need metrics or traces from your ECS workloads, use ADOT, which handles logs, metrics, and traces through one Collector.

---

​

Supported AWS Services

FireLens routes logs from containers running in:

Service	Log type
Amazon ECS (EC2 launch type)	Container stdout / stderr
AWS Fargate	Container stdout / stderr
Amazon ECS Managed Instances	Container stdout / stderr

FireLens is ECS-specific. For EKS container logs, use Fluent Bit on EKS. For Lambda or other AWS services, see the overview.

---

​

What is FireLens?

AWS FireLens is an ECS log routing feature that uses a Fluent Bit (or Fluentd) sidecar container as a log driver. Container logs are piped from your application containers directly to the FireLens sidecar, which forwards them to Bronto using JSON Lines over HTTPS.

FireLens runs as a sidecar in the same ECS task. No separate infrastructure is required.

---

​

Bronto Ingestion Endpoint

FireLens uses Fluent Bit’s http output, which sends JSON Lines to the Bronto base endpoint (no path):

Region	Endpoint
EU	ingestion.eu.bronto.io
US	ingestion.us.bronto.io

This is different from the OTLP endpoints (/v1/logs, /v1/metrics, /v1/traces), which accept only OTLP payloads (protobuf or OTLP/JSON). Fluent Bit’s http output sends JSON Lines, not OTLP, so it must target the base endpoint.

All requests require the header:

x-bronto-api-key: <YOUR_API_KEY>

See API Keys for how to generate a key.

---

​

Setup

​

Step 1 — Add the FireLens sidecar to your task definition

Add a log_router container using the AWS-provided Fluent Bit image. This container acts as the log driver for all other containers in the task.

{
  "name": "log-router",
  "image": "public.ecr.aws/aws-observability/aws-for-fluent-bit:3.5.4",
  "essential": true,
  "firelensConfiguration": {
    "type": "fluentbit",
    "options": {
      "enable-ecs-log-metadata": "true",
      "config-file-type": "file",
      "config-file-value": "/fluent-bit/configs/bronto.conf"
    }
  }
}

Pin a specific 3.x version. The stable tag currently points to the 2.x line, which is based on Amazon Linux 2 and reached end of life on June 30, 2026.

​

Step 2 — Configure Fluent Bit to forward to Bronto

Give the sidecar a custom Fluent Bit configuration file with config-file-type and config-file-value. Use file for a config baked into a custom image or mounted into the container, or s3 with the object’s ARN on the EC2 launch type. Fargate and ECS Managed Instances support only file; to load from S3 there, use the AWS for Fluent Bit init image. SSM Parameter Store isn’t a supported source. The output section targets Bronto’s base ingestion endpoint using JSON Lines format.

For the full Fluent Bit configuration reference and output options, see the Fluent Bit setup guide.

[OUTPUT]
    Name              http
    Match             *
    Host              ingestion.<REGION>.bronto.io
    Port              443
    Format            json_lines
    Compress          gzip
    tls               On
    tls.verify        On
    Header            x-bronto-api-key <YOUR_API_KEY>
    Header            x-bronto-dataset <YOUR_DATASET_NAME>
    Header            x-bronto-collection <YOUR_COLLECTION_NAME>

Replace <REGION> with eu or us.

​

Step 3 — Point your application containers at FireLens

Update the logConfiguration of each application container to use the awsfirelens log driver:

{
  "logConfiguration": {
    "logDriver": "awsfirelens",
    "options": {
      "Name": "http",
      "Host": "ingestion.<REGION>.bronto.io",
      "Port": "443",
      "Format": "json_lines",
      "Compress": "gzip",
      "tls": "On",
      "tls.verify": "On",
      "Header": "x-bronto-api-key <YOUR_API_KEY>"
    }
  }
}

---

​

Data Organization

Set the recommended headers in your Fluent Bit [OUTPUT] block to control how data lands in Bronto — see Data Organization for how datasets, collections, and tags work.

Header	Description
x-bronto-dataset	Dataset to ingest into
x-bronto-collection	Collection name
x-bronto-tags	Comma-separated tags to attach to events

[OUTPUT]
    Name              http
    Match             *
    Host              ingestion.<REGION>.bronto.io
    Port              443
    Format            json_lines
    Compress          gzip
    tls               On
    tls.verify        On
    Header            x-bronto-api-key <YOUR_API_KEY>
    Header            x-bronto-dataset <YOUR_DATASET_NAME>
    Header            x-bronto-collection <YOUR_COLLECTION_NAME>
    Header            x-bronto-tags env=prod,team=platform

To route different containers in the same task to different datasets, define multiple [OUTPUT] blocks with different Match patterns and per-output Header directives.

---

​

Cost Notes

• No CloudWatch ingestion fees — logs go directly from FireLens to Bronto.
• You pay only for the ECS task compute running the FireLens sidecar, which is negligible.
• Compare with CloudWatch Log Forwarder if your services already write to CloudWatch.

---

For assistance, contact [e-mail].