Textbook of Linux

← Software

Grafana Loki

A horizontally scalable log aggregation system.

Loki indexes only the metadata labels (job, namespace, container, hostname, severity, etc.) attached to each log line, not the full log content itself. This makes it dramatically cheaper to operate at scale than Elasticsearch for many log workloads: storage and indexing costs scale with label cardinality, not log volume.

Loki was started at Grafana Labs in 2018 as the "logs" pillar of their observability stack alongside Prometheus (metrics) and Tempo (traces). The architectural pitch is "Prometheus, but for logs" — the same label-based selector model, the same federation story, and the same Grafana integration. LogQL, Loki's query language, deliberately mirrors PromQL.

Loki is widely deployed in Kubernetes-heavy environments where it pairs with Prometheus and Grafana to form a coherent observability stack. Compared to the ELK stack it trades full- text-on-everything for much lower cost, which is the right trade for most "I just need to find recent errors and group by service" workloads.

Download from https://grafana.com/oss/loki/
Or via Docker:
  docker run -p 3100:3100 grafana/loki:latest