How to Centralize Logs with Grafana Loki

What and why

Grafana Loki is a log aggregation system that indexes only labels, not full log text, making it cheap to run at scale. Centralizing logs means you stop SSHing into hosts and instead search every service from one query interface, alongside your metrics and traces in Grafana.

Prerequisites

• Services emitting structured logs.
• A running Grafana instance.
• Docker installed.

Steps

1. Run Loki

docker run -p 3100:3100 grafana/loki

For production, back Loki with object storage and run it in microservices mode.

2. Ship logs with an agent

Use Grafana Alloy (or Promtail) to tail and forward logs:

scrape_configs:
  - job_name: app
    static_configs:
      - targets: [localhost]
        labels:
          job: checkout-service
          __path__: /var/log/app/*.log

The agent pushes lines to Loki's /loki/api/v1/push endpoint.

3. Apply labels carefully

Labels are indexed, so keep them low-cardinality: job, env, level. Never use unbounded values like user id or request id as labels; keep those in the log line and filter on them at query time. High-cardinality labels are the most common Loki misconfiguration.

4. Add Loki to Grafana

In Grafana, add a Loki data source with URL http://host.docker.internal:3100.

5. Query with LogQL

LogQL filters by labels then by line content:

{job="checkout-service", env="prod"} |= "error" | json | status >= 500

You can also derive metrics from logs:

sum(rate({job="checkout-service"} |= "error" [5m]))

Verification

• Loki's /ready endpoint returns ready.
• Logs from your service appear in Grafana Explore.
• A LogQL filter narrows to the expected lines.

Next Steps

Link Loki to traces with a derived field on trace id, set retention with compaction, and add log-based alerts so you can page on error-log spikes the same way you alert on metrics.