Grafana Loki

Overview

Grafana Loki is an open-source log aggregation system developed by Grafana Labs, introduced in 2018. It is designed for collecting, storing, and querying logs from various sources, particularly excelling in cloud-native and Kubernetes environments. Unlike traditional log management systems that index the entire log content, Loki focuses on indexing only a minimal set of metadata, referred to as labels. This architectural choice significantly reduces storage requirements and operational overhead, making it a cost-effective solution for high-volume log data.

The system is built to be horizontally scalable and multi-tenant, allowing it to handle large-scale deployments and diverse logging needs. Loki's query language, LogQL, is inspired by Prometheus's PromQL, enabling users to perform complex queries on log streams based on labels and full-text search within indexed log lines. This design philosophy positions Loki as a component of the Grafana observability stack, integrating seamlessly with Grafana dashboards for visualization and Promtail for agent-based log collection from targets like Kubernetes pods or systemd journals.

Loki is particularly suited for organizations seeking a streamlined, budget-conscious approach to log management that prioritizes operational simplicity and integration with existing Grafana monitoring setups. Its label-based indexing is beneficial for scenarios where logs are primarily used for debugging, troubleshooting, and operational insights, rather than deep analytical processing of every log field. Developers and operations teams can leverage Loki to quickly identify issues, monitor application behavior, and ensure system health without incurring the high costs associated with full-text indexing solutions.

The core products associated with this offering include the open-source Loki project itself and Grafana Cloud Logs, a managed service offering for Loki. Grafana Labs provides extensive documentation for deploying and managing Loki, including its API reference and guides for various log sources. The developer experience is characterized by its tight integration with Grafana, allowing for unified dashboards that combine metrics, logs, and traces. The system's architecture, written primarily in Go, emphasizes efficiency and scalability, making it a suitable choice for modern microservices architectures and dynamic infrastructure.

Key features

• Label-based indexing: Indexes only metadata (labels) for log streams, reducing storage costs and improving query performance for specific log sets (Grafana Loki Introduction).
• LogQL query language: A powerful query language inspired by PromQL, enabling filtering, aggregation, and transformation of log data based on labels and content (Grafana Loki Query Language).
• Horizontal scalability: Designed to scale out horizontally across multiple instances to handle increasing log volumes and query loads.
• Multi-tenancy: Supports isolating log data and access for different teams or customers within a single Loki deployment.
• Grafana integration: Seamlessly integrates with Grafana dashboards for visualizing log data alongside metrics and traces.
• Promtail log collection: Utilizes Promtail, an agent designed to collect logs from various sources (e.g., Kubernetes pods, systemd journals) and ship them to Loki (Promtail documentation).
• Cost-effective storage: Low storage footprint due to minimal indexing, making it an economical choice for long-term log retention.
• Cloud-native architecture: Built with cloud-native principles, suitable for deployment in Kubernetes and other containerized environments.

Pricing

Grafana Loki is available as an open-source project for self-hosting, and as a managed service through Grafana Cloud. The Grafana Cloud Free tier provides a generous allowance for logs, metrics, and traces. Paid tiers for Grafana Cloud Logs offer increased capacity and additional features.

Tier	Log Ingestion Limit	Key Features	Starting Price (as of 2026-05-28)
Grafana Cloud Free	10GB/month	Unified observability (logs, metrics, traces), 10k series metrics, 50GB traces	Free
Grafana Cloud Pro	Starts at 100GB/month	Increased limits, longer retention, advanced alerting, enterprise-grade support	$29/month
Grafana Cloud Enterprise	Custom	Dedicated support, custom integrations, advanced security, volume discounts	Custom pricing

For detailed and up-to-date pricing information, refer to the Grafana Cloud pricing page.

Common integrations

• Grafana: Core integration for visualizing and querying logs, metrics, and traces in unified dashboards (Grafana Loki Data Source).
• Promtail: The official agent for collecting logs from various sources and sending them to Loki (Promtail documentation).
• Kubernetes: Widely used for collecting logs from Kubernetes pods and nodes, often deployed as a DaemonSet (Loki on Kubernetes).
• Docker: Can collect logs from Docker containers using Promtail or other log drivers.
• Prometheus: Complements Prometheus for a complete observability stack, with similar query language concepts (Prometheus Overview).
• Alertmanager: Integrates with Alertmanager for sending notifications based on LogQL alerts.

Alternatives

• Datadog Logs: A comprehensive SaaS observability platform offering full-text log indexing, analysis, and visualization, alongside metrics and tracing.
• Splunk Cloud Platform: An enterprise-grade platform for collecting, indexing, and analyzing machine-generated data, including logs, with advanced search and reporting capabilities.
• Elastic Observability (Logs): Part of the Elastic Stack (ELK), offering robust log collection, storage, and analysis with Elasticsearch, Kibana, and Beats, providing full-text indexing.

Getting started

To get started with Grafana Loki, you can set up a local instance using Docker Compose. This example demonstrates a basic setup with Loki, Promtail, and Grafana.

First, create a docker-compose.yaml file:

version: "3.8"

networks:
  loki:

services:
  loki:
    image: grafana/loki:latest
    ports:
      - "3100:3100"
    command: -config.file=/etc/loki/local-config.yaml
    volumes:
      - ./loki-config.yaml:/etc/loki/local-config.yaml
    networks:
      - loki

  promtail:
    image: grafana/promtail:latest
    command: -config.file=/etc/promtail/config.yaml
    volumes:
      - ./promtail-config.yaml:/etc/promtail/config.yaml
      - /var/log:/var/log # Mount host logs
    networks:
      - loki

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    volumes:
      - ./grafana-datasources.yaml:/etc/grafana/provisioning/datasources/datasources.yaml
    environment:
      - GF_AUTH_ANONYMOUS_ENABLED=true
      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
      - GF_USERS_ALLOW_SIGN_UP=false
    networks:
      - loki

Next, create loki-config.yaml for Loki's configuration:

auth_enabled: false

server:
  http_listen_port: 3100

common:
  path_prefix: /tmp/loki
  storage_config:
    boltdb_shipper:
      active_index_directory: /tmp/loki/boltdb-shipper-active
      cache_location: /tmp/loki/boltdb-shipper-cache
    filesystem:
      directory: /tmp/loki/chunks
  replication_factor: 1
  ring:
    kvstore:
      store: inmemory

query_range:
  results_cache:
    cache_enabled: true
    cache_type: inmemory

analytics:
  reporting_enabled: false

schema_config:
  configs:
    - from: 2020-10-24
      store: boltdb-shipper
      object_store: filesystem
      schema: v11
      period: 24h

compactor:
  working_directory: /tmp/loki/boltdb-shipper-compactor
  shared_store: filesystem

Create promtail-config.yaml for Promtail:

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
  - job_name: system
    static_configs:
      - targets:
          - localhost
        labels:
          job: varlogs
          __path__: /var/log/*log
  - job_name: docker
    static_configs:
      - targets:
          - localhost
        labels:
          job: dockerlogs
          __path__: /var/lib/docker/containers/*/*log

Finally, create grafana-datasources.yaml to configure Loki as a datasource in Grafana:

apiVersion: 1

datasources:
  - name: Loki
    type: loki
    access: proxy
    orgId: 1
    url: http://loki:3100
    basicAuth: false
    isDefault: true
    version: 1
    editable: true

Run docker compose up -d in the directory containing these files. Grafana will be accessible at http://localhost:3000. You can then navigate to the Explore section in Grafana, select the Loki datasource, and query your logs using LogQL (e.g., {job="varlogs"}).