Documentation Grafana Cloud Instrument and send data Grafana Alloy Reference Configuration blocks logging

logging

logging is an optional configuration block used to customize how Alloy produces log messages. logging is specified without a label and can only be provided once per configuration file.

Usage

Alloy Copy

logging {

}

Arguments

You can use the following arguments with logging:

level

The following strings are recognized as valid log levels:

• "error": Only write logs at the error level.
• "warn": Only write logs at the warn level or above.
• "info": Only write logs at info level or above.
• "debug": Write all logs, including debug level logs.

format

The following strings are recognized as valid log line formats:

• "json": Write logs as JSON objects.
• "logfmt": Write logs as logfmt lines.

write_to

The write_to argument allows Alloy to tee its log entries to one or more loki.* component log receivers in addition to the default location. This, for example can be the export of a loki.write component to send log entries directly to Loki, or a loki.relabel component to add a certain label first.

destination

The following strings are recognized as valid log destinations:

• "stderr": Write logs to stderr.
• "windows_event_log": Windows only. Write logs to the Windows Event Log under the “Alloy” source.

The default value of destination is set to "windows_event_log" when Alloy runs as a Windows service. Otherwise, destination defaults to "stderr".

Alloy fails to start if destination is set to "windows_event_log" and Alloy is not running on Windows.

Retrieve logs

You can retrieve the logs in different ways depending on your platform and installation method:

Linux:

• If you’re running Alloy with systemd, use journalctl -u alloy.

Docker:

• If you’re running Alloy in a Docker container, use docker logs CONTAINER_ID.

macOS:

• If you’re running Alloy with Homebrew as a service, use brew services info grafana/grafana/alloy to check status and tail -f $(brew --prefix)/var/log/alloy.log for logs.
• If you’re running Alloy with launchd, use log show --predicate 'process == "alloy"' --info or check /usr/local/var/log/alloy.log.
• If you’re running Alloy in a Docker container, use docker logs CONTAINER_ID.

Windows:

• If you’re running Alloy as a Windows service, check the Windows Event Viewer under Windows Logs > Application for Alloy-related events.
• If you’re running Alloy that is manually installed, check the log files in %PROGRAMDATA%\Grafana\Alloy\logs\ or the directory specified in your configuration.
• If you’re running Alloy in a Docker container, use docker logs CONTAINER_ID.

All platforms:

• Alloy writes logs to stderr if started directly without a service manager. Redirect stderr of the Alloy process to a file for logs to persist on disk.

Example

Alloy Copy

logging {
  level  = "info"
  format = "logfmt"
}