---
title: 'Log streaming: Bronto'
summary: null
url: >-
  https://www.fastly.com/documentation/guides/integrations/logging-endpoints/log-management-and-observability/log-streaming-bronto
---

Fastly's [Real-Time Log Streaming](https://www.fastly.com/documentation/guides/integrations/streaming-logs/about-fastlys-realtime-log-streaming-features) feature can be configured to send logs in a format readable by [Bronto](https://www.bronto.io). Bronto is a SaaS-based log management and log analytics solution designed for scalability, cost-efficiency, and advanced search capabilities.

> **NOTE:** 
>
> Fastly does not provide direct support for third-party services. Read [Fastly's Terms of Service](https://www.fastly.com/terms) for more information.
>
>

## Prerequisites

Before adding Bronto as a logging endpoint for Fastly services, you will need to:

- **Create a Bronto account.** [Book a demo](https://www.bronto.io/book-a-demo/) with Bronto to create an account with them.
- **Generate an API key in Bronto.** To generate a Bronto API key, refer to their [API Keys documentation](https://docs.bronto.io/Account-Management/API-Keys).

For additional details on how Bronto works with Fastly, check out [their documentation](https://docs.bronto.io/integrations/fastly).

## Adding Bronto as a logging endpoint

Follow these instructions to add Bronto as a logging endpoint:

### Deliver

1.   Review the information in our guide to [setting up remote log streaming](/guides/integrations/streaming-logs/setting-up-remote-log-streaming).

2. In the HTTPS area, click **Create endpoint** button.
3. Fill out the **Create an HTTPS endpoint** fields as follows:
   -   In the **Name** field, enter a human-readable name for the endpoint.

   -   In the **Placement** area, select where the logging call should be placed in the generated VCL. Valid values are **Format Version Default** and **None**. Read our guide on [changing log placement](/guides/integrations/streaming-logs/changing-log-placement) for more information.

   - In the **Log format** field, replace the placeholder log format and make the appropriate changes as shown in our [log format recommendations](https://www.fastly.com/documentation/guides/integrations/logging-endpoints/log-management-and-observability/log-streaming-bronto#log-format-recommendations) section below.
   - In the **URL** field, enter `https://ingestion.eu.bronto.io/?service_name=@field.host&service_namespace=fastly_cdn_service` to define the location of the log data in Bronto. We've described the use of [specific parameters](https://www.fastly.com/documentation/guides/integrations/logging-endpoints/log-management-and-observability/log-streaming-bronto#using-event-fields-for-service-name-and-namespace) below.
   - In the **Maximum logs** field, leave as `0` (the default).
   - In the **Maximum bytes** field, enter `10485760`, as Bronto accepts payload up to 10MiB.
   -   *(Optional)* From the **Processing region** menu, select a geographic region where logs are processed before being sent to the logging endpoint. Our guide on [regional log aggregation](/guides/integrations/streaming-logs/setting-up-regional-log-aggregation) provides more information.

4. Click **Advanced options** and fill out the fields as follows::
   - In the **Content type** field, enter `application/json`.
   - In the **Custom header name** field, enter `x-bronto-api-key`.
   - In the **Custom header value** field, enter ``, substituting the values for your Bronto API Key.
   - From the **Method** controls, select **POST**.
   - From the **JSON log entry format** controls, select **Newline Delimited** as the appropriate log entry format to use.
   - In the **Select a log line format** area, select **Blank** as the log line format for your log messages. Our guide on [changing log line formats](https://www.fastly.com/documentation/guides/integrations/streaming-logs/changing-log-line-formats) provides more information.
   -   In the **TLS hostname** field, optionally enter a hostname to verify the logging destination server's certificate. This should be one of the Subject Alternative Name (SAN) fields for the certificate. Common Names (CN) are not supported.

   - Leave **TLS CA certificate**, **TLS client certificate**, and **TLS client key** fields empty.
5.   Click **Create** to create the new logging endpoint.

6.   From the **Activate** menu, select **Activate on Production** to deploy your configuration changes.

> **NOTE:** It can take some time for the Service and Service Namespace to be created and for logs to flow  after you've created the endpoint and deployed your service changes.

### Log format recommendations

Here's an example format string for sending data to Bronto:

```json
{
    "timestamp": "%{strftime({"%Y-%m-%dT%H:%M:%S.%f%z"}, time.start)}V",
    "client_ip": "%{req.http.Fastly-Client-IP}V",
    "geo_country": "%{client.geo.country_name}V",
    "geo_city": "%{client.geo.city}V",
    "host": "%{if(req.http.Fastly-Orig-Host, req.http.Fastly-Orig-Host, req.http.Host)}V",
    "url": "%{json.escape(req.url)}V",
    "request_method": "%{json.escape(req.method)}V",
    "request_protocol": "%{json.escape(req.proto)}V",
    "request_referrer": "%{json.escape(req.http.referer)}V",
    "request_user_agent": "%{json.escape(req.http.User-Agent)}V",
    "response_state": "%{json.escape(fastly_info.state)}V",
    "response_status": %{resp.status}V,
    "response_reason": %{if(resp.response, "%22"+json.escape(resp.response)+"%22", "null")}V,
    "response_body_size": %{resp.body_bytes_written}V,
    "fastly_server": "%{json.escape(server.identity)}V",
    "fastly_is_edge": %{if(fastly.ff.visits_this_service == 0, "true", "false")}V
}
```

## Using Event Fields for Service Name and Namespace

You can configure service name and namespace parameters within the URL to dynamically fetch values from log event content using the format `@field.key`. For example:

```url
https://ingestion.eu.bronto.io/?service_name=@field.geo_country&service_namespace=fastly
```

In this example, the `geo_country` value from the event content will be used as the service name.

Once set up, logs for each field will be directed to the relevant service in Bronto, which allows you to send the log events per service using multiple HTTPS logging endpoints with Fastly.