Grafana (LGTM)
Loki — Log Aggregation
Store logs cheaply by indexing labels, not full text, the Prometheus way.
Loki is Grafana's log aggregation system, designed to be cost-effective by borrowing Prometheus's model: it indexes only a small set of labels per stream (service, namespace, level) rather than the full text of every line. The raw log content is compressed and stored in object storage (S3/GCS), while the tiny index just maps label sets to chunks. This makes ingestion cheap and storage even cheaper than full-text engines.
A library that does not index every word of every book, only the title and section labels. Find the right shelf by label first, then skim those few books — far cheaper than indexing every page.
Key Concepts
1
You query Loki with LogQL, which looks like PromQL: first select streams by labels ({service="api"}), then filter lines (|= "error"), and optionally extract fields or compute metrics from logs (rate of errors over time). Because Loki and Prometheus share the same label conventions, a metric spike and its logs line up naturally in Grafana. The trade-off is that Loki is not built for arbitrary full-text analytics across everything — it is fastest when your label selectors narrow the search first.
2
What the interviewer is probing.
What the interviewer is probing.
3
1. "How does Loki differ from Elasticsearch for logs?" *Probing:* the central idea. *Stalls:*
"It is newer." *Moves up:* it indexes only labels, not the log content, so storage and cost are far
lower — at the price of slower full-text search.
1. "How does Loki differ from Elasticsearch for logs?"
4
2. "What is the label cardinality rule?" *Probing:* the critical constraint. *Stalls:* "None."
*Moves up:* the same as Prometheus — labels must be low cardinality, and putting a request id in one
will destroy it.
2. "What is the label cardinality rule?"
5
3. "How do you search content then?" *Probing:* the mechanism. *Stalls:* "You cannot." *Moves
up:* narrow by labels and time first, then a LogQL filter expression scans those streams.
3. "How do you search content then?"
6
4. "Why does it pair naturally with Prometheus?" *Probing:* the integration. *Stalls:* "Same
company." *Moves up:* shared label semantics mean the same selector moves between metrics and logs,
and from a spike to its log lines.
4. "Why does it pair naturally with Prometheus?"