What is Grafana Loki?
Grafana Loki is an open-source log aggregation system for collecting, storing and querying logs. Inspired by Prometheus, it groups log streams using labels and stores compressed, unstructured log data without full-text indexing. Shared labels help teams move between metrics and logs when investigating infrastructure issues.
Loki serves as the storage and query-processing service in a logging stack where Grafana Alloy collects and forwards logs, and Grafana provides the query and display interface. It supports single-host operation as a single binary, alongside horizontal scaling, high availability and multi-tenancy. Kubernetes Pod labels can be collected and indexed as metadata.
Grafana Labs started the project in 2018 and releases it under the AGPLv3 license, and Grafana provides native support for querying it. Loki differs from Prometheus by handling logs instead of metrics and by receiving logs through push rather than pull. In the current stack, Grafana Alloy replaced Promtail as the collection agent, because Promtail is considered feature complete.
Key capabilities
- Label-based indexing Groups log streams by metadata without creating a full-text index of log contents.
- Log ingestion Receives pushed logs from collectors such as Grafana Alloy and from the Docker logging driver.
- Log querying Processes log queries for Grafana and the LogCLI command-line client.
- Kubernetes logging Stores Pod logs and indexes metadata such as Pod labels.
- Deployment flexibility Supports single-host operation and horizontally scalable, highly available deployments.
- Ingestion monitoring Loki Canary checks a Loki installation for missing logs.
Where Grafana Loki fits
Loki fits into infrastructure troubleshooting and incident investigation workflows, particularly where teams already use Prometheus labels and Grafana. In Kubernetes environments, indexed Pod metadata provides context for locating relevant log streams. Docker workloads can forward logs through the documented logging driver.
Before deployment, teams should verify that label-based indexing suits their query patterns rather than expecting full-text indexing. They should also plan the collector and display components, review tenant configuration when sharing an installation, and check the documented Helm chart migration if deploying through Helm.
Install
go build ./cmd/lokiReviews of Grafana Loki
Be the first to share your experience with Grafana Loki.
Write a review
Loading review form…
Alternatives to Grafana Loki
SplunkSplunk offers a data platform for search and analysis, with a separate Enterprise Security product for SecOps.
ElasticElastic Security is a SIEM, EDR and XDR product built on Elasticsearch, offered on Elastic Cloud Serverless, Elastic Cloud Hosted or self-managed.
OpenObserveOpenObserve (O2) is an AGPL-3.0 observability platform written in Rust for logs, metrics, traces, RUM, dashboards, alerts, pipelines and LLM observability, self-hosted as a single binary or HA cluster, or used as a cloud service.