Observe · Log aggregation
Loki
Grafana Loki stores logs as compressed chunks in object storage and indexes only metadata labels. Queries use LogQL, which mirrors PromQL, and integrate directly with Grafana dashboards and alerts.
On this page
What it does
Receives logs from agents (Alloy, Promtail, Fluent Bit), stores them cheaply and makes them searchable by label and content.
Where it fits
Observe stage, alongside Prometheus for metrics and Tempo for traces.
Quick start
helm install loki grafana/loki -n logging --create-namespace -f values.yaml
# LogQL examples
# {namespace="payments"} |= "error" | json | status >= 500
# sum by (pod) (rate({namespace="payments"} |= "timeout" [5m]))Common pitfalls
- Using high-cardinality labels (request IDs) as stream labels defeats the design; keep them in log content.
- Retention and compaction must be configured explicitly for object storage.
On this site
- Kubernetes Observability with Prometheus, Grafana and Loki: Loki in single-binary mode with Alloy as the collector, the
filenamelabel that multiplied streams on every restart, and LogQL for the questions logs answer.
Articles about Loki
Observability intermediate
Kubernetes Observability with Prometheus, Grafana and Loki
kube-prometheus-stack, Loki in single-binary mode and Alloy on a kind cluster; the PromQL and LogQL that answer operational questions; low-cardinality log labels; a real OOM restart loop diagnosed end to end.