Grafana Loki is a horizontally scalable, highly available, multi-tenant log aggregation system inspired by Prometheus. It is designed to be very cost effective and easy to operate. It does not index the contents of the logs, but rather a set of labels for each log stream.

Compared to other log aggregation systems, Loki:

• Does not do full text indexing on logs. By storing compressed, unstructured logs and only indexing metadata, Loki is simpler to operate and cheaper to run.
• Indexes and groups log streams using the same labels you’re already using with Prometheus, enabling you to seamlessly switch between metrics and logs using the same labels that you’re already using with Prometheus.
• Is an especially good fit for storing Kubernetes Pod logs. Metadata such as Pod labels is automatically scraped and indexed.
• Has native support in Grafana (needs Grafana v6.0). Loki is like Prometheus, but for logs: we prefer a multidimensional label-based approach to indexing, and want a single-binary, easy to operate system with no dependencies. Loki differs from Prometheus by focussing on logs instead of metrics, and delivering logs via push, instead of pull.

After you deploy the stack you will have the following deployed to your cluster in the loki-stack namespace:

1. Loki: The log-aggregation system and the queriers.
2. Promtail: The agent that is used to collect the logs.
3. Grafana: The UI using which you can now query your logs.

Check that the Loki pods are running as expected:

kubectl --namespace loki-stack get pods

NAME                            READY   STATUS    RESTARTS   AGE
loki-0                          1/1     Running   0          47h
loki-grafana-5dc6466b8d-2xkwf   1/1     Running   0          47h
loki-promtail-8ggnr             1/1     Running   0          47h
loki-promtail-fhxjw             1/1     Running   0          47h
loki-promtail-hpq7j             1/1     Running   0          47h

Then grab the admin password for grafana:

kubectl get secret --namespace loki-stack loki-grafana -o jsonpath="{.data.admin-password}" | base64 --decode

Now port-forward to Grafana (using your own loki-grafana-xxxxxxxxx-xxxx pod name) and login using the username admin and password you got above. To access Grafana, port-forward:

kubectl --namespace loki-stack port-forward svc/loki-grafana 8080:80

and visit http://localhost:8080/explore

In the explore UI, enter the query {app="loki"} or similar to get the logs. Happy querying!

Uninstalling
To uninstall Loki, you'll need to have Helm 3 installed. Once install, run the following:

helm uninstall loki -n loki-stack

followed by:

kubeclt delete ns loki-stack