Grafana Loki

Grafana Loki is the cost-efficient alternative to Elasticsearch/Splunk for log aggregation — indexes only labels (not log content), which dramatically reduces storage cost while maintaining label-based filtering. Pairs with Grafana for visualization and Prometheus for metrics in the standard observability stack (metrics: Prometheus, logs: Loki, traces: Tempo). For agents: the push API ingests log streams directly, LogQL queries filter and aggregate logs, and Grafana Cloud provides managed hosting (50GB/month free). Self-hostable as a single binary with S3/GCS/Azure Blob backend for log storage. Confidence is docs-derived.

HTTP API at {loki_host}. Push API: POST /loki/api/v1/push ingests logs ({streams: [{stream: {job: "app", env: "prod"}, values: [["<timestamp_ns>", "<log line>"]]}]}). Query: GET /loki/api/v1/query_range?query={logql_expr}&start={}&end={}&limit=100. GET /loki/api/v1/query for instant query. GET /loki/api/v1/labels lists label names. GET /loki/api/v1/label/{name}/values lists label values. GET /loki/api/v1/series lists series matching selector. LogQL filter: {job="app"} |= "error" | json | level="error" | rate[5m]. Python logging handler: loki_handler.LokiHandler(url, tags) sends logs directly to Loki. Grafana datasource: connect Loki as a Grafana data source for dashboard visualization.

Default: no authentication (same as Prometheus/Grafana — network-isolate in production). Basic auth: configure via --auth.enabled and HTTP proxy. Grafana Cloud: API key as Authorization: Bearer {api_key} for cloud-hosted Loki. HTTPS enforced on Grafana Cloud; operator-managed for self-hosted. Multi-tenancy: X-Scope-OrgID header for tenant isolation. Promtail agent: scrapes log files and pushes to Loki with auto-labeling. Docker: grafana/promtail for containerized log collection.

Standard HTTP status codes. Push: 204 on success. Query: 200 with JSON result. Invalid LogQL: 400 with syntax error detail. Label cardinality: high-cardinality labels (user IDs as labels) cause performance issues — use log line parsing instead. Log line parsing: | json, | logfmt, | regexp for structured log extraction. Grafana Cloud uptime at status.grafana.com. Self-hosted: operator-managed. Ingestion backpressure: 429 if ingestion rate exceeds capacity. Out-of-order ingestion: Loki requires logs within a time window (configure ingester.max_chunk_age). Storage backend: requires object storage (S3, GCS, Azure) for production deployments.

grafana.com/docs/loki covers LogQL reference, push API, configuration guide, deployment modes, and Grafana Cloud setup. Getting started: Grafana Cloud free account, configure Loki datasource, push first logs in under 10 minutes. Self-hosted: docker run grafana/loki. Promtail: automatic log collection agent. python-logging-loki: pip install python-logging-loki. Community via Grafana Community (community.grafana.com) and GitHub (24k+ stars). Loki is the standard choice in the Prometheus/Grafana ecosystem for log aggregation.