Guides

Centralize Container Logs with Grafana Loki (Beginner Path)

By Ravindra Bagale, DevOps trainer · LinkedIn · Published: 28 October 2026 · Last updated: 28 October 2026

Run Loki, ship container logs with an agent, add a Grafana Loki data source, query with LogQL labels first, and keep label cardinality low.

Language: English · मराठी · हिंदी

Why Loki

Central search beats SSH on every node.

Why: Pod gone = logs gone without shipping. What: Agent → Loki → Explore. How: Labels index; lines store text.

Example 1: Why central logs

Type this:

printf '%s\n' 'ok: stop SSH-grep on eight nodes — ship logs to one place'

You will see:

ok: stop SSH-grep on eight nodes — ship logs to one place

What it means: Outages hide when logs stay on dying pods.

Example 2: Loki config sketch

Type this:

mkdir -p /tmp/loki && printf '%s\n' 'auth_enabled: false' 'server: {http_listen_port: 3100}' 'common:' '  path_prefix: /tmp/loki-data' '  storage: {filesystem: {chunks_directory: /tmp/loki-data/chunks}}' 'schema_config:' '  configs:' '  - from: 2024-01-01' '    store: tsdb' '    object_store: filesystem' '    schema: v13' '    index: {prefix: index_, period: 24h}' > /tmp/loki/loki.yml && head -3 /tmp/loki/loki.yml

You will see:

auth_enabled: false

What it means: Lab only — turn auth on for real clusters.

Example 3: Agent ships container logs

Type this:

printf '%s\n' 'Promtail/alloy/agent tails /var/log/containers and pushes to Loki push API'

You will see:

Promtail/alloy/agent tails /var/log/containers and pushes to Loki push API

What it means: Agent labels include namespace, pod, container.

Concept 1: Ship and query

Datasource + LogQL.

Why: Wrong time range looks empty. What: {app=} then |=; widen range. How: Prove in Explore.

Example 4: Grafana Loki datasource

Type this:

printf '%s\n' '{' '  "name": "Loki",' '  "type": "loki",' '  "url": "http://loki:3100"' '}' > /tmp/loki/ds.json && cat /tmp/loki/ds.json

You will see:

{

What it means: Explore uses this URL.

Example 5: LogQL by app

Type this:

printf '%s\n' '{app="payments"} |= "ERROR"'

You will see:

{app="payments"} |= "ERROR"

What it means: Label filter first; then line filter — cheaper.

Example 7: Time range tip

Type this:

printf '%s\n' 'Widen the Grafana time picker when the incident started earlier than you think'

You will see:

Widen the Grafana time picker when the incident started earlier than you think

What it means: Wrong range looks like "no logs".

Concept 2: Metrics + logs

When vs why.

Why: CPU spike without logs wastes time. What: Same time range and pod label. How: count_over_time for panels.

Example 6: Count errors

Type this:

printf '%s\n' 'sum(count_over_time({app="payments"} |= "ERROR" [5m]))'

You will see:

sum(count_over_time({app="payments"} |= "ERROR" [5m]))

What it means: Turn logs into a number for a panel.

Example 9: Correlate with metrics

Type this:

printf '%s\n' 'When CPU spikes, jump to Loki with the same time range and pod label'

You will see:

When CPU spikes, jump to Loki with the same time range and pod label

What it means: Metrics find when; logs find why.

Example 12: Prove with Explore

Type this:

printf '%s\n' 'Grafana Explore → Loki → {app="payments"} → Run query'

You will see:

Grafana Explore → Loki → {app="payments"} → Run query

What it means: If empty: agent, labels, time range, auth.

Concept 3: Cardinality and retention

Protect the index and disk.

Why: request_id labels melt clusters. What: Low-cardinality only; retention days. How: Parse JSON carefully.

Example 8: Label cardinality warning

Type this:

printf '%s\n' 'Do not put request_id as a label — keep it in the line; labels must stay low-cardinality'

You will see:

Do not put request_id as a label — keep it in the line; labels must stay low-cardinality

What it means: High cardinality melts Loki — interview favorite.

Example 10: Retention

Type this:

printf '%s\n' 'Set retention so demo logs do not fill the disk — e.g. 7 or 14 days for labs'

You will see:

Set retention so demo logs do not fill the disk — e.g. 7 or 14 days for labs

What it means: Prod retention follows compliance.

Example 11: Pipeline stages idea

Type this:

printf '%s\n' 'Agent can parse JSON and promote level=error into a label carefully'

You will see:

Agent can parse JSON and promote level=error into a label carefully

What it means: Only low-cardinality fields become labels.

Loki card

1 Run Loki 2 Agent tails containers 3 Grafana Loki DS 4 LogQL {app=} |= 5 Watch cardinality 6 Set retention

Suppose: No logs

Agent running? Correct labels? Time range?

Suppose: Loki OOM / slow

Too many unique label values — remove high-cardinality labels.

Check yourself (quiz)

agent → Loki → Explore → LogQL → fix. Did you understand? Let us try it once more.