Loki: Cost-effective log aggregation

What it’s for: Logs including application logs, system logs, and audit trails.

Trade-offs

ProsCons
Much cheaper than ElasticsearchNo full-text indexing
Same labels as PrometheusLimited search capabilities
LogQL similar to PromQLDifferent mental model
Scales horizontallyNewer ecosystem
Native Grafana integration

Best for

  • Teams already using Prometheus
  • Cost-conscious log aggregation
  • Correlating logs with metrics

Documentation

View the full documentation. Learning path coming soon!

Loki data source

Script

Loki is Grafana’s log aggregation system, and it takes a fundamentally different approach than traditional log systems. Here’s the key insight: Loki only indexes labels (metadata about your logs), not the log content itself. That means dramatically lower storage costs.

The trade-off? You can’t do arbitrary full-text search across all your logs. Instead, you filter by labels first, then search within that subset. For most log use cases, this works brilliantly.

If you’re already using Prometheus for metrics, Loki is the natural companion. They share the same label model, so your Prometheus labels carry over to Loki. The query language is LogQL, which feels similar to PromQL.

And because Loki is built by Grafana Labs, you get native integration. It scales horizontally and works seamlessly in both Grafana Cloud and self-managed environments. For cost-conscious log aggregation, especially alongside Prometheus, Loki is hard to beat.