How ContentStack's engineering team went from 30-minute query timeouts to real-time CDN log analysis

The Contentstack team runs a massive content delivery and experience platform, serving APIs behind a global CDN for third party websites, mobile apps, and e-commerce systems. Every request hits their API with a unique key, and their team needs to trace errors, group by status codes, and export logs to customers.

‍
How Bronto helped

Bronto serves as Contentstack's unified logging layer for high-volume CDN workloads, starting with Fastly logs and expanding to include Cloudflare data. Bronto enables Contentstack to store significantly more log data over extended periods – something that was previously cost-prohibitive.

Extended retention unlocks new value: With 12-month retention (compared to their previous 2-week window), ContentStack's teams can now analyze months of historical data to understand business-critical patterns. They're tracking customer API latency trends over time, identifying seasonal performance variations, and building comprehensive reports that inform both operational and strategic decisions.

From operational to analytical: This extended data access has opened up use cases beyond immediate troubleshooting. ContentStack performs business-level analysis directly from their log data, examining customer usage patterns and API performance trends that were previously slow and cumbersome to reveal.

AI-powered efficiency: As a design partner, ContentStack is helping shape Bronto's AI capabilities, including natural language query features that reduce time-to-insight and improve team efficiency during incident response.

‍

Benchmarks

Query performance at ContentStack's scale: Their typical queries span 635GB of CDN data and return results in 2.2 seconds on average. For context, their previous solution took 30+ minutes for similar queries. 

Filtering for edge cases: Large queries (1-5TB) that filter for rare events like specific HTTP error codes or API endpoint failures return in under 900ms. This makes debugging intermittent issues actually feasible during incidents.

Complex aggregations: Multi-terabyte queries with heavy aggregation work (think grouping by customer ID across months of API logs) complete in around 4 seconds. The kind of analysis that used to be "we'll run that overnight and check tomorrow."