EZ-Homelab/wiki/service-docs/loki.md

Loki - Log Aggregation

Table of Contents

• Overview
• What is Loki?
• Why Use Loki?
• Configuration in AI-Homelab
• Official Resources
• Docker Configuration

Overview

Category: Log Aggregation
Docker Image: grafana/loki
Default Stack: monitoring.yml
Web UI: Accessed via Grafana
Query Language: LogQL
Ports: 3100

What is Loki?

Loki is a log aggregation system inspired by Prometheus but for logs. It doesn't index log contents (like Elasticsearch), instead it indexes metadata labels, making it much more efficient. Designed to work seamlessly with Grafana for log visualization.

Key Features

• Label-Based Indexing: Efficient storage
• Grafana Integration: Native support
• LogQL: Prometheus-like queries
• Multi-Tenancy: Isolated logs
• Compression: Efficient storage
• Low Resource: Minimal overhead
• Promtail Agent: Log shipper
• Free & Open Source: CNCF project

Why Use Loki?

1. Efficient: Indexes labels, not content
2. Grafana Native: Seamless integration
3. Cheap: Low storage costs
4. Simple: Easy to operate
5. Prometheus-Like: Familiar for Prometheus users
6. Low Resource: Lightweight
7. LogQL: Powerful queries

Configuration in AI-Homelab

/opt/stacks/monitoring/loki/
  loki-config.yml     # Loki configuration
  data/              # Log storage

Official Resources

• Website: https://grafana.com/oss/loki
• Documentation: https://grafana.com/docs/loki/latest
• LogQL: https://grafana.com/docs/loki/latest/logql

Docker Configuration

loki:
  image: grafana/loki:latest
  container_name: loki
  restart: unless-stopped
  networks:
    - traefik-network
  ports:
    - "3100:3100"
  command: -config.file=/etc/loki/loki-config.yml
  volumes:
    - /opt/stacks/monitoring/loki/loki-config.yml:/etc/loki/loki-config.yml
    - /opt/stacks/monitoring/loki/data:/loki

loki-config.yml

auth_enabled: false

server:
  http_listen_port: 3100

ingester:
  lifecycler:
    ring:
      kvstore:
        store: inmemory
      replication_factor: 1
  chunk_idle_period: 5m
  chunk_retain_period: 30s

schema_config:
  configs:
    - from: 2020-05-15
      store: boltdb
      object_store: filesystem
      schema: v11
      index:
        prefix: index_
        period: 24h

storage_config:
  boltdb:
    directory: /loki/index
  filesystem:
    directory: /loki/chunks

limits_config:
  enforce_metric_name: false
  reject_old_samples: true
  reject_old_samples_max_age: 168h

chunk_store_config:
  max_look_back_period: 0s

table_manager:
  retention_deletes_enabled: true
  retention_period: 168h

Summary

Loki provides log aggregation offering:

• Efficient label-based indexing
• Grafana integration
• LogQL query language
• Low storage costs
• Minimal resource usage
• Promtail log shipping
• Free and open-source

Perfect for:

• Docker container logs
• Application logs
• System logs
• Centralized logging
• Grafana users
• Prometheus users

Key Points:

• Indexes labels, not content
• Much cheaper than Elasticsearch
• Works with Promtail
• Query in Grafana
• LogQL similar to PromQL
• Low resource usage
• 7-day retention typical

Remember:

• Use Promtail to send logs
• Add as Grafana data source
• LogQL for queries
• Configure retention
• Monitor disk space
• Label logs appropriately

Loki aggregates logs efficiently!