Grafana Cloud fundamentalsUnderstanding logs usage with Grafana Explore

Understanding logs usage with Grafana Explore

Grafana Cloud provides a managed Loki environment for storing logs. Similar to metrics labels in Prometheus, Loki only indexes the log metadata using labels. This guide will help you analyze and understand logs usage in Grafana Cloud.

Before you begin

To view and manage logs, you must have the following:

  • A Grafana Cloud account
  • Admin or Editor user permissions for the managed Grafana Cloud instance

Limitations

If you expect queries to return a large number of results, you can use a smaller duration of time to avoid timeout errors as Grafana Cloud limits the size of expensive queries. For more information on setting query duration limits, see Prometheus querying basics.

If you would prefer to explore logs with a command line interface, see the LogCLI documentation.

View log usage

  1. Log in to your instance and click the Explore (magnifying glass) icon in the menu sidebar.

  2. Use the data sources dropdown located at the top of the page to select the data source corresponding to your Grafana Cloud Logs endpoint. The data source name should be similar to grafanacloud-<yourstackname>-logs.

  3. Select Instant for the Query Type and use the following LogQL searches in the query toolbar to explore usage for your environment (logs generated by Synthetic Monitoring checks will also be returned):

    • Number of entries for each log stream over a five minute interval:

      count_over_time({job=~".+"}[5m])
      

      This count will be listed on the far right hand column of the results table under Value #A.

    • Bytes used by each log stream for the past five minutes:

      bytes_over_time({job=~".+"}[5m])
      
    • Count the number of entries within the last minute and return any job with greater than 100 log lines. Adjust the number of log lines as needed for more insight:

      count_over_time({job=~".+"}[1m]) > 100
      
    • Count of logs ingested over the past hour and specify filename, host, and job names if those labels exist:

      sum(count_over_time({job=~".+"}[1h])) by (filename, host, job)
      

    NOTE: The job label is used in these statements, but you can use other labels. If you are not sure which labels your environment might be using, click on the Log browser tab in Explore to review the available labels. If an expected label is missing, this is a good indication that these logs are not being successfully received by your Grafana Cloud environment.

  4. Save your queries (optional).

    You can save a query in your query history to quickly access your favorites.

    You can also download the query results as a text file directly from Explore using Grafana Inspector. For more information, see Grafana Inspector.

Reduce unnecessary log usage

When you have identified the excessive log streams, you can optimize labeling to reduce usage and cost. To learn more, see Loki labeling best practices.