Loki
inari.loki
A Docker Compose file for Loki alone, generated from the catalog and checked by the safety inspector. No account needed.
Log aggregation system that indexes only a small set of labels per stream and stores log content compressed in object storage, keeping cost proportional to volume rather than cardinality.
Loki treats logs as streams identified by labels and builds no full-text index, which is what makes its storage cheap; a query selects streams by label first and then scans their content with LogQL filter expressions. LogQL also derives metrics from logs — rates, counts and quantiles over time — so a log line can drive an alert without a parallel metrics pipeline. Storage is a compressed chunk store, usually object storage, with an index small enough that cost stays predictable as retention grows. A first deployment runs the single-binary mode against filesystem storage and confirms that an agent's pushed lines are queryable.
You know it worked when
- The service reports ready on its health endpoint.
- A shipper's pushed lines are accepted without rejection errors.
- A LogQL query by label returns those lines.
- A filter expression narrows the result as expected.
- A metric query derived from the logs returns a series.
Known sharp edges
- Label cardinality is what breaks Loki: a request id, user id or timestamp used as a label creates one stream per value and degrades the whole instance.
- The single-binary filesystem configuration is not a production layout, and moving to object storage later means migrating chunks rather than changing a setting.
- Ingesters buffer recent chunks in memory and flush on a schedule, so an unclean shutdown loses whatever has not yet been flushed.
- Lines that are too old or out of order are rejected by default, which makes a backfill fail quietly at the ingest end.