Loki

Definition

Loki is a horizontally scalable, open-source log aggregation system built by Grafana Labs that indexes only metadata (labels) rather than full log content, making it significantly cheaper to operate than traditional full-text log indexes.

Overview

Grafana Labs, the company behind Grafana and Prometheus-compatible monitoring tools, built Loki with a deliberately Prometheus-inspired design: rather than indexing every word in a log line, Loki indexes only a small set of labels—like namespace, pod, or job—and stores the raw log content compressed in cheap object storage. This trade-off means queries are less flexible than full-text search engines like Elasticsearch, but ingestion and storage costs are dramatically lower, since Loki avoids building large text indexes for every log line. Loki uses its own query language, LogQL, which mirrors Prometheus's PromQL syntax and lets teams filter by labels and then search or aggregate within the matching log streams. Loki is typically deployed alongside Prometheus and Grafana as part of a unified observability stack running on Kubernetes, where agents scrape and ship container logs. Because logs, metrics, and traces can all be explored from the same Grafana dashboards, Loki has become a popular alternative to heavier log stacks for cost-conscious, cloud-native teams.

Key Features

• Label-based indexing instead of full-text indexing, reducing storage costs
• LogQL query language modeled after Prometheus's PromQL
• Horizontally scalable microservices architecture, or single-binary mode for small setups
• Tight native integration with Grafana dashboards and alerting
• Compressed log storage in cheap object stores like S3 or MinIO
• Agents for scraping logs from Kubernetes and other sources
• Multi-tenancy support for isolating logs across teams or customers

Use Cases

Frequently Asked Questions

Related in DevOps