Grafana (LGTM)
Loki — Log Aggregation
Store logs cheaply by indexing labels, not full text, the Prometheus way.
Loki is Grafana's log aggregation system, designed to be cost-effective by borrowing Prometheus's model: it indexes only a small set of labels per stream (service, namespace, level) rather than the full text of every line. The raw log content is compressed and stored in object storage (S3/GCS), while the tiny index just maps label sets to chunks. This makes ingestion cheap and storage even cheaper than full-text engines.
A library that does not index every word of every book, only the title and section labels. Find the right shelf by label first, then skim those few books — far cheaper than indexing every page.
Key Concepts
1
You query Loki with LogQL, which looks like PromQL: first select streams by labels ({service="api"}), then filter lines (|= "error"), and optionally extract fields or compute metrics from logs (rate of errors over time). Because Loki and Prometheus share the same label conventions, a metric spike and its logs line up naturally in Grafana. The trade-off is that Loki is not built for arbitrary full-text analytics across everything — it is fastest when your label selectors narrow the search first.