Loki

Grafana Loki indexes log **labels** (like Prometheus) rather than full-text of every line—keeping costs lower at scale. Queries use LogQL to filter and parse JSON payloads.

					{service="checkout-api"} |= "error" | json | status >= 500
				

| Practice | Why | |----------|-----| | Low-cardinality labels | service, env, level | | JSON in log line | Parse fields in queries | | Retention tiers | Hot vs cold storage cost |

Pair Loki with Grafana for correlated metrics-to-logs clicks when labels align.

On interviews: Loki vs Elasticsearch trade-offs, label cardinality limits, and agent deployment (Promtail, Alloy).

Common pitfalls: high-cardinality labels (user ID); treating Loki as full-text search for everything; no retention planning.

The trade-off is cost-efficient log storage versus weaker ad-hoc full-text search.

Checklist:

• Label like Prometheus (bounded sets).
• Structure logs as JSON.
• Define retention and compaction.
• Correlate labels with metrics.