1. Why Loki? #
A different philosophy from Elasticsearch.
Index the labels, not the content #
Available in: ✓ OSS ✓ Enterprise ✓ Cloud Loki open source, Enterprise Logs and Grafana Cloud Logs
Loki is a log aggregation system created by Grafana Labs, inspired by Prometheus. Where Elasticsearch builds an inverted index of every word, Loki only indexes the labels of a log stream (app, namespace, env...). The content of the lines is simply compressed and stored, then filtered at read time. The result: a tiny index, cheap storage and simpler operations.
| Criterion | Loki | Elasticsearch / ELK |
|---|---|---|
| Index | Labels only | Full-text inverted index |
| Storage cost | Low (compressed chunks, object storage) | High (large indexes, fast disks) |
| Full-text search | Filtering at read time (distributed grep) | Very fast thanks to the index |
| Metrics integration | LogQL close to PromQL, metrics from logs | Elastic-specific aggregations |
| Operations | Simpler, largely stateless | More complex (shards, mappings) |
2. The architecture #
Write path, read path.
The components #
| Component | Role |
|---|---|
| Distributor | Receives logs, validates them, distributes streams to ingesters (hash of the labels) |
| Ingester | Keeps recent logs in memory + WAL, builds chunks, then sends them to storage |
| Query Frontend | Splits and caches queries, fair queueing |
| Querier | Runs queries against the ingesters (recent) and storage (historical) |
| Compactor | Compacts indexes, applies retention and deletions |
| Ruler | Evaluates LogQL alerting and recording rules |
| Index Gateway | Serves the index to queriers (optional) |
3. Deployment modes #
From the laptop to massive production.
Three modes #
| Mode | Principle | When to use it |
|---|---|---|
Monolithic (-target=all) | A single binary, all components | Testing, small volumes (< ~20 GB/day) |
| Simple scalable (read / write / backend) | Three groups of components to scale | Medium production, up to a few TB/day |
| Microservices | Each component is a separate deployment | Very large volumes, fine-grained control |
# Un même binaire, plusieurs cibles
loki -config.file=loki.yaml -target=all # monolithique
loki -config.file=loki.yaml -target=write # simple scalable : chemin d'écriture
loki -config.file=loki.yaml -target=read # lecture
loki -config.file=loki.yaml -target=backend # compactor, ruler, index gateway
loki -config.file=loki.yaml -modules # lister les modulesUse cases #
- Application and container logs collected from Kubernetes with the same labels as Prometheus metrics.
- Correlation: go from an alert or a metric to the corresponding logs in Grafana in one click.
- Metrics from logs: count errors, compute latencies from access logs.
- Audit and security: low-cost long-term retention.
Good practice: If you very often search for rare words in terabytes of logs without knowing the stream, a full-text engine will remain faster. Loki excels when you start from a context (service, pod, environment).
