Back to Blog
team@tinypod.app

Self-Hosting Grafana Loki: Log Aggregation Made Simple

Loki is a log aggregation system from Grafana Labs. Like Prometheus but for logs — efficient, label-based, and Grafana-integrated.

lokigrafanalogsobservability

What Is Loki?


Loki is a log aggregation system inspired by Prometheus. Instead of indexing the full text of every log, Loki indexes only labels (like Prometheus) — making it much more efficient.


How It Works


1. Promtail (agent) reads log files on your servers

2. Logs are labeled (app, host, level, etc.)

3. Loki stores logs indexed by labels

4. Query with LogQL in Grafana


Loki vs Elasticsearch vs CloudWatch


  • Loki: Lightest, label-indexed, Grafana-native
  • Elasticsearch: Full-text indexed, most powerful, heaviest
  • CloudWatch: AWS-native, no self-hosting

    • Key Concepts


    Labels

    Loki indexes labels, not log content:

    {app="nginx", level="error"}


    LogQL

    Query language (similar to PromQL):

    {app="nginx"} |= "500" | rate(5m)


    Streams

    Each unique label set is a stream. Keep cardinality low for performance.


    Features


  • Label-based log querying
  • Multi-tenancy
  • Retention policies
  • Alerting rules
  • S3/GCS storage backend
  • Structured metadata

    • Deployment


    1. Deploy Loki on TinyPod

    2. Deploy Promtail on your servers

    3. Add Loki as Grafana data source

    4. Build log dashboards


    Resources: Loki 1 CPU, 512 MB RAM. Promtail minimal.


    Loki completes the Grafana observability stack: Prometheus for metrics, Loki for logs, Tempo for traces.