Guides

Grafana Loki ने Container Logs एकत्र करा (Beginner Path)

By Ravindra Bagale, DevOps trainer · LinkedIn · Published: 28 October 2026 · Last updated: 28 October 2026

Loki + agent + Grafana DS + LogQL labels first + low cardinality + retention.

Language: English · मराठी · हिंदी

Loki का

central > SSH.

Why: pod गेला = logs गेले. What: agent→Loki→Explore. How: labels index.

Example 1: Why central logs

Type this:

printf '%s\n' 'ok: stop SSH-grep on eight nodes — ship logs to one place'

You will see:

ok: stop SSH-grep on eight nodes — ship logs to one place

What it means: Outages hide when logs stay on dying pods.

Example 2: Loki config sketch

Type this:

mkdir -p /tmp/loki && printf '%s\n' 'auth_enabled: false' 'server: {http_listen_port: 3100}' 'common:' '  path_prefix: /tmp/loki-data' '  storage: {filesystem: {chunks_directory: /tmp/loki-data/chunks}}' 'schema_config:' '  configs:' '  - from: 2024-01-01' '    store: tsdb' '    object_store: filesystem' '    schema: v13' '    index: {prefix: index_, period: 24h}' > /tmp/loki/loki.yml && head -3 /tmp/loki/loki.yml

You will see:

auth_enabled: false

What it means: Lab only — turn auth on for real clusters.

Example 3: Agent ships container logs

Type this:

printf '%s\n' 'Promtail/alloy/agent tails /var/log/containers and pushes to Loki push API'

You will see:

Promtail/alloy/agent tails /var/log/containers and pushes to Loki push API

What it means: Agent labels include namespace, pod, container.

Concept 1: Ship/query

DS + LogQL.

Why: wrong range = empty. What: {app=} then |=. How: Explore.

Example 4: Grafana Loki datasource

Type this:

printf '%s\n' '{' '  "name": "Loki",' '  "type": "loki",' '  "url": "http://loki:3100"' '}' > /tmp/loki/ds.json && cat /tmp/loki/ds.json

You will see:

{

What it means: Explore uses this URL.

Example 5: LogQL by app

Type this:

printf '%s\n' '{app="payments"} |= "ERROR"'

You will see:

{app="payments"} |= "ERROR"

What it means: Label filter first; then line filter — cheaper.

Example 7: Time range tip

Type this:

printf '%s\n' 'Widen the Grafana time picker when the incident started earlier than you think'

You will see:

Widen the Grafana time picker when the incident started earlier than you think

What it means: Wrong range looks like "no logs".

Concept 2: Metrics+logs

when vs why.

Why: CPU without logs. What: same range/pod. How: count_over_time.

Example 6: Count errors

Type this:

printf '%s\n' 'sum(count_over_time({app="payments"} |= "ERROR" [5m]))'

You will see:

sum(count_over_time({app="payments"} |= "ERROR" [5m]))

What it means: Turn logs into a number for a panel.

Example 9: Correlate with metrics

Type this:

printf '%s\n' 'When CPU spikes, jump to Loki with the same time range and pod label'

You will see:

When CPU spikes, jump to Loki with the same time range and pod label

What it means: Metrics find when; logs find why.

Example 12: Prove with Explore

Type this:

printf '%s\n' 'Grafana Explore → Loki → {app="payments"} → Run query'

You will see:

Grafana Explore → Loki → {app="payments"} → Run query

What it means: If empty: agent, labels, time range, auth.

Concept 3: Cardinality

index/disk वाचवा.

Why: request_id label = melt. What: low-card; retention. How: JSON care.

Example 8: Label cardinality warning

Type this:

printf '%s\n' 'Do not put request_id as a label — keep it in the line; labels must stay low-cardinality'

You will see:

Do not put request_id as a label — keep it in the line; labels must stay low-cardinality

What it means: High cardinality melts Loki — interview favorite.

Example 10: Retention

Type this:

printf '%s\n' 'Set retention so demo logs do not fill the disk — e.g. 7 or 14 days for labs'

You will see:

Set retention so demo logs do not fill the disk — e.g. 7 or 14 days for labs

What it means: Prod retention follows compliance.

Example 11: Pipeline stages idea

Type this:

printf '%s\n' 'Agent can parse JSON and promote level=error into a label carefully'

You will see:

Agent can parse JSON and promote level=error into a label carefully

What it means: Only low-cardinality fields become labels.

Loki card

1 Loki 2 agent 3 DS 4 LogQL 5 cardinality 6 retention

Suppose: no logs

agent/labels/range.

Suppose: slow

high cardinality.

Check yourself (quiz)

agent → Loki → Explore → LogQL → fix. Did you understand? Let us try it once more.