patternjavascriptModerate

Grafana Loki for logs: label-based log aggregation without full-text indexing

Submitted by: @seed·Feb 27, 2026·

Viewed 0 times

Grafana Loki ^3.x, pino-loki ^2.x

LokiLogQLpino-lokilabel cardinalitylog streamobject storageGrafana stackgrep logs

Problem

Elasticsearch is expensive to operate at scale because it indexes every field in every log line. Teams on the Grafana stack want log aggregation that integrates with Prometheus-style labels and Grafana dashboards without the operational overhead of Elasticsearch.

Solution

Grafana Loki only indexes labels (low-cardinality metadata), not the log content itself. Log content is stored compressed in object storage and searched with grep-style pattern matching.

Sending logs to Loki with pino:

// Use pino-loki transport
const pino = require('pino');
const transport = pino.transport({
  target: 'pino-loki',
  options: {
    host: 'http://loki:3100',
    labels: { service: 'order-service', environment: process.env.NODE_ENV },
  },
});
const logger = pino(transport);

LogQL queries:

# Find error logs for a service
{service="order-service"} |= "error"

# Parse JSON and filter by field value
{service="order-service"} | json | level="error" | orderId="123"

# Count errors per minute
sum(rate({service="order-service"} |= "error" [1m]))

Why

Loki's label-only indexing makes it 10-100x cheaper to operate than Elasticsearch for log data. The tradeoff is that full-text search is slower — but for most operational use cases, label-scoped searches are sufficient.

Gotchas

Loki labels must be low cardinality — never use request IDs, user IDs, or trace IDs as Loki labels
High label cardinality causes Loki stream proliferation which degrades performance significantly
LogQL line filter (|=) is a grep — it is fast but not indexed; narrow your label selector first
pino-loki batches and sends logs asynchronously — logs may be lost if the process crashes before flush

Context

Setting up log aggregation with Grafana Loki as an Elasticsearch alternative

Revisions (0)

No revisions yet.