Grafana Cloud: getting started with the managed platform (Mimir, Loki, Tempo, Alloy)

1. What is Grafana Cloud? #

Grafana and its ecosystem as SaaS.

The managed components #

Available in: ✕ OSS ✕ Enterprise ✓ Cloud

Without installing anything, Grafana Cloud offers Grafana, Mimir (Prometheus-compatible metrics), Loki (logs), Tempo (traces), Pyroscope (profiles) and advanced features: alerting, OnCall, SLOs, Synthetic Monitoring, Application Observability, Kubernetes Monitoring.

Offering: A free tier lets you get started with limited volumes of metrics, logs and traces and a few users: ideal for labs. Check the current quotas at grafana.com/pricing.

2. Creating your stack and getting your credentials #

A few clicks.

Steps #

1. Create an account on grafana.com, then a stack (choose the closest region).
2. In the portal: open the Details of each service (Prometheus, Loki, Tempo) to get the URL and the user ID.
3. Administration > Cloud access policies: create a policy with the metrics:write, logs:write, traces:write and profiles:write scopes, then a token.
4. Store the token in a vault or an environment variable, never in Git.

export GC_PROM_URL="https://prometheus-prod-01-eu-west-0.grafana.net/api/prom/push"
export GC_PROM_USER="123456"
export GC_LOKI_URL="https://logs-prod-eu-west-0.grafana.net/loki/api/v1/push"
export GC_LOKI_USER="654321"
export GC_TOKEN="glc_eyJ..."      # token d'une access policy

# Tester l'authentification
curl -u "$GC_PROM_USER:$GC_TOKEN" "https://prometheus-prod-01-eu-west-0.grafana.net/api/prom/api/v1/labels" 

3. Sending your data with Alloy #

One configuration for all three signals.

Alloy configuration #

// config.alloy
prometheus.exporter.unix "host" { }

prometheus.scrape "host" {
  targets    = prometheus.exporter.unix.host.targets
  forward_to = [prometheus.remote_write.cloud.receiver]
}

prometheus.remote_write "cloud" {
  endpoint {
    url = sys.env("GC_PROM_URL")
    basic_auth {
      username = sys.env("GC_PROM_USER")
      password = sys.env("GC_TOKEN")
    }
  }
}

local.file_match "syslog" {
  path_targets = [{"__path__" = "/var/log/syslog", "job" = "syslog"}]
}

loki.source.file "syslog" {
  targets    = local.file_match.syslog.targets
  forward_to = [loki.write.cloud.receiver]
}

loki.write "cloud" {
  endpoint {
    url = sys.env("GC_LOKI_URL")
    basic_auth {
      username = sys.env("GC_LOKI_USER")
      password = sys.env("GC_TOKEN")
    }
  }
}

docker run -d --name alloy -p 12345:12345 --env-file .env \
  -v "$PWD/config.alloy:/etc/alloy/config.alloy" \
  grafana/alloy:latest run --server.http.listen-addr=0.0.0.0:12345 /etc/alloy/config.alloy

# Vérifier dans Grafana Cloud > Explore :   up   et   {job="syslog"}

4. Alerting, managing costs and security #

Operating sustainably.

Alerts and OnCall #

• Create alerts in Alerting > Alert rules with the same queries as your panels.
• Configure contact points (email, Slack, webhook) and notification policies (routing by labels).
• Use Grafana OnCall for on-call rotations and escalation.

Controlling the bill #

# Dans Prometheus/Mimir : trouver les métriques les plus coûteuses (séries actives)
topk(10, count by (__name__) ({__name__=~".+"}))

# Supprimer à la source avec Alloy ce qui ne sert pas
prometheus.relabel "reduce" {
  forward_to = [prometheus.remote_write.cloud.receiver]
  rule { source_labels = ["__name__"]  regex = "go_gc_.*|promhttp_.*"  action = "drop" }
}

Good practice: Watch the Usage & billing tab and set alerts on active series and ingested log volume: cardinality is the biggest cost item.

Common mistake: An overly permissive token (admin scope) copied into a public repository means a complete compromise of your stack: one token per use, with an expiry date.