Grafana Loki

Definition

Grafana Loki is an open source log aggregation system designed by Grafana Labs to be cost-efficient at scale by indexing only metadata labels rather than the full text of every log line.

Overview

Loki was built by Grafana Labs with a deliberately narrow design goal: make log storage and querying feel similar to how Prometheus handles metrics. Instead of indexing the full content of every log line (which is expensive at scale), Loki indexes only a small set of labels — like service name, environment, or pod name — and stores the compressed raw log content separately. This label-based indexing is the key trade-off that defines Loki: queries first filter by labels to narrow down which log streams to search, then scan the actual log content within that narrowed set using LogQL, a query language deliberately similar to Prometheus's PromQL. The result is significantly lower storage and indexing cost compared to full-text-indexed systems like Elasticsearch-based stacks, at the cost of less flexible ad-hoc full-text search across unindexed fields. Loki is designed to run alongside Prometheus and Grafana Tempo as part of Grafana Labs' broader open source observability stack (sometimes referred to as the LGTM stack — Loki, Grafana, Tempo, Mimir/VictoriaMetrics-style metrics), giving teams metrics, logs, and traces that can be correlated through shared labels within a single Grafana interface, a common setup covered conceptually in SkillVeris's Kubernetes course.

Key Features

• Label-based indexing that avoids full-text indexing of log content
• LogQL query language modeled closely on Prometheus's PromQL
• Designed to integrate tightly with Grafana dashboards for visualization
• Horizontally scalable architecture for high log volume ingestion
• Object storage backend support (e.g., S3-compatible storage) for cost efficiency
• Correlated querying across logs, metrics, and traces when paired with Prometheus and Tempo

Use Cases

Frequently Asked Questions

Related in DevOps