Loki
Loki is a log aggregation system built around labels instead of full-text indexing. It is often paired with Grafana for querying and visualization.
What Makes Loki Different
- It indexes labels, not the entire log body.
- It is optimized for cost-efficient log storage.
- It fits naturally into the Prometheus and Grafana ecosystem.
Core Ideas
- Streams are identified by a label set.
- Log lines are stored with the stream they belong to.
- LogQL is the query language used to filter and analyze logs.
Example Queries
{app="api"} |= "error"
{namespace="prod", container="ingress"} |~ "timeout|failed"
{job="kubernetes-pods"} | json | level="warn"
Good Practices
- Keep labels low-cardinality.
- Do not put request IDs or user IDs in labels.
- Put searchable fields in the log line itself, then parse them in queries.
Common Stack
- Fluentd or Promtail for ingestion.
- Loki for storage and query.
- Grafana for dashboards and exploration.