Skip to main content
Stream Activity events from Aptible to any Logstash-supported destination using Aptible’s activity-forwarder container. The forwarder uses Filebeat (HTTPJSON input) and Logstash to poll the Activity API and forward events to a configurable output.

​
Prerequisites

​
Supported Destinations

This guide includes configuration for Sumo Logic. For other providers, contact Aptible Support for guidance.

​
Setup

​
Step 1: Create an App

Create a new Account and App on Aptible to host the forwarder. This App will have access to a long-term token with full visibility into your organization’s Activity, so only grant access to its Environment to roles and users for whom that level of access is appropriate.
Do not add a Log Drain to this Account yet. The forwarder starts in a preview mode that prints the initial backfill window (the last 30 days of activity by default) to stdout, which could be tens or hundreds of thousands of lines.

​
Step 2: Deploy the Forwarder

Deploy the forwarder image with your activity token: 
aptible deploy --app ${HANDLE} --docker-image aptible/activity-forwarder \
  "APTIBLE_ACTIVITY_ACCESS_TOKEN=long_term_token_placeholder"

​
Step 3: Configure Service Settings

Set the service to use a simple health check and a longer stop timeout to handle releases and restarts gracefully: 
aptible services:settings --app ${HANDLE} cmd --simple-health-check --stop-timeout 60

​
Step 4: Verify the Connection

Stream the app’s logs and confirm that recent activities appear. Events should show up within about two minutes: 
aptible logs --app ${HANDLE}

Connected to logs from log-tail-zyvwad
User Login by Alex Kubacki at 2026-03-18T20:20:26.312Z
App Configure by Alex Kubacki at 2026-03-18T20:20:32.823Z

​
Step 5: Request Persistent Storage

Contact Aptible Support to attach a persistent volume to this container before proceeding. Without persistent storage, the forwarder’s cursor resets on every restart, causing it to re-send the last 30 days of activity to your destination.

​
Step 6: Configure Your Destination

Set OUTPUT_CONFIG to forward events to your provider. The value should be a complete Logstash output { ... } block.

​
Sumo Logic

Set up a new HTTP source in Sumo Logic and copy the pre-signed URL. The default settings will work. Then configure the output: 
aptible config:set --app ${HANDLE} OUTPUT_CONFIG='output {
    http {
      url => "https://endpoint4.collection.sumologic.com/receiver/v1/http/YOUR_TOKEN"
      http_method => "post"
      format => "json"
      content_type => "application/json"
    }
  }'

​
Step 7: Confirm Events Are Arriving

Verify that activity events are appearing in your destination. The initial backfill covers 30 days by default, and new completed activity typically appears within about two minutes.

​
Step 8: Enable Cursor Persistence

After persistent storage is attached (Step 5), disable cursor cleanup so the forwarder resumes from its saved position after restarts instead of re-importing the backfill window: 
aptible config:set --app ${HANDLE} CLEAN_CURSOR=false