Grafana Loki
2 min read
Grafana Loki is a horizontally-scalable, highly-available log aggregation system inspired by Prometheus. Unlike other logging systems, Loki is designed to be cost-effective and easy to operate, focusing on storing and querying logs with minimal indexing.
Features
• Label-based indexing (like Prometheus)
• LogQL, a powerful query language for logs
• Multi-tenancy support
• Scalability via microservice architecture
• Efficient storage (logs are compressed and stored in object stores or local filesystems)
Architecture Overview
Loki is built with a microservices design:
• Distributor: Handles ingestion and load balancing
• Ingester: Temporarily stores and processes incoming logs
• Querier: Executes LogQL queries
• Compactor: Merges log segments for better storage performance
• Index Gateway: Handles index writes and queries in scalable deployments
LogQL
LogQL is Loki’s query language, combining filtering and aggregation capabilities:
Log stream selectors
logql
{job="nginx", level="error"}
Filtering log content
logql
{job="nginx"} |= "timeout"
{job="nginx"} != "healthcheck"
Aggregation queries
logql
sum(rate({job="nginx"} |= "error" [5m])) by (instance)
Compose
yaml
version: '3'
services:
loki:
image: grafana/loki:latest
ports:
- "3100:3100"
command: -config.file=/etc/loki/local-config.yaml