Lab: Collecting and Shipping Logs to Loki

What you will learn in this TP

• Read log files
• Extract and add labels
• Send to Loki and check

Introduction #

What you will learn in this section

• Read log files
• Extract and add labels
• Send to Loki and check

Context. An application writes JSON logs to files, and nobody reads them before an incident. You centralize them in Loki.

Prerequisites: Docker Compose, curl  ·  Estimated time: 30 min

Logs searchable by level and environment.

Log pipeline #

Guided steps, with their solution.

1. 1. Prepare the stack

   Why? The volume keeps read positions: without it, Alloy would re-read everything at each restart.

   Write a Compose file with Loki and Alloy.

2. 2. Read the files

   Why? local.file_match finds files, loki.source.file reads them and remembers its position.

   In config.alloy, read /var/log/myapp/*.log with the job=myapp label.

3. 3. Process the lines

   Why? stage.labels takes an extracted value; a fixed value needs stage.static_labels.

   Extract level from the JSON to make it a label, add env=production and keep msg as text.

4. 4. Send to Loki

   Why? In the Compose network, Loki is reached by its service name.

   Add the sending component.

5. 5. Check

   Why? A healthy component does not prove that data arrives.

   Create a log file, start the stack and query Loki: you should see the env and level labels, and the texts paiement refusé and commande créée.

Difficulty level : ●●○○○ (2/5)