Loki Configuration Guide (v3.4.3)

Note: Use aws configure when working with AWS access keys. For production, IAM Role is preferred.

Overview

This Loki configuration is designed to:

• Retain logs locally for 24 hours.
• Ship logs older than 1 hour to Amazon S3 every hour.
• Delete logs older than 24 hours from the local filesystem.

Configuration Breakdown

auth_enabled: false

Disables authentication for the Loki HTTP API.

server

• http_listen_port: HTTP server port (default: 3100).
• grpc_listen_port: gRPC server port.
• log_level: Enables debug-level logs for troubleshooting.
• grpc_server_max_concurrent_streams: Increases gRPC concurrency.

common

• instance_addr: IP address the service binds to.
• path_prefix: Base directory for storing Loki data.
• storage.filesystem.chunks_directory: Local path to store ingested log chunks.
• storage.filesystem.rules_directory: Local path to store alerting rules.
• replication_factor: No replication in single-node mode.
• ring.kvstore.store: Uses in-memory key-value store.

query_range.results_cache.cache.embedded_cache

• Enables embedded in-memory caching.
• Limits cache to 100 MB.

limits_config

• retention_period: Retains logs for 24 hours before deletion.

storage_config

• tsdb_shipper:

  • active_index_directory: Path to store active TSDB indexes.
  • cache_location: Path for TSDB cache.
  • cache_ttl: TTL for TSDB cache (24h).
  • resync_interval: Syncs data from disk to S3 every 1 hour.

• aws:

  • s3: Region endpoint for AWS S3.
  • bucketnames: Target S3 bucket for log archival.

schema_config

Defines how data is indexed and stored:

• from: Date from which schema applies.
• store: TSDB used for chunk storage.
• object_store: s3 specifies that chunks are stored in AWS S3.
• schema: Schema version used (v13).
• index.prefix: Prefix used for indexing.
• index.period: Rotation period for indexes (24 hours).

pattern_ingester

• Enables ingestion of log patterns.
• Aggregates metrics and sends to the specified Loki address.

ruler

• Integrates with Alertmanager.
• Routes alerts to http://localhost:9093.

frontend

• encoding: protobuf: Optimizes performance using Protobuf encoding.

compactor

• working_directory: Local directory for compaction operations.
• retention_enabled: Enables deletion of old logs.
• retention_delete_delay: Wait time before deletion starts.
• retention_delete_worker_count: Number of parallel delete workers.
• delete_request_store: Set to filesystem to track delete requests locally.

Data Flow Summary

1. Ingestion: Logs are received by Loki and stored in the local filesystem (/tmp/loki/chunks).
2. Indexing: Indexes are stored locally at /tmp/loki/index.
3. Archival: Every hour, the tsdb_shipper pushes chunks older than 1 hour to S3.
4. Retention: Logs older than 24 hours are deleted by the compactor from the local filesystem.

Operational Tips

• Monitor the /tmp/loki directory to ensure disk space availability.
• Ensure proper IAM permissions for S3 access if IAM roles are used.
• Set up alerting for failed uploads or compaction issues.

Security Recommendation

• Enable auth_enabled: true in production.
• Use secure network access and firewall rules.
• Integrate Loki with an authentication proxy (e.g., OAuth2 Proxy).

Version Compatibility

Tested and validated with:

loki, version 3.4.3
build date: 2025-04-03T13:36:49Z
go version: go1.23.6

For further enhancements, consider using Grafana Alloy for metrics/logs correlation, or integrating with Grafana Cloud for centralized observability.