# Loki

Loki is the log aggregation backend of the observability stack. It stores and queries container and system logs, and it feeds the log panels in Grafana. It replaces the need for a full ELK stack.

**Host:** Dankclaw — **Docs:** https://grafana.com/docs/loki/latest

## Facts (from research)

| Item | Value |
|------|-------|
| Image | `grafana/loki:latest` |
| Port | 3100 (host) → 3100 (container) |
| Mode | single-binary (all components in one process) |
| Storage | filesystem (bind mount) |
| Auth | `auth_enabled: false` (single-tenant homelab) |
| Schema | v13 / TSDB |

## Configuration

Config lives at `shared/loki/loki-config.yaml`. Key settings:

- `schema_config` v13 with `store: tsdb` and filesystem object store.
- `compactor` with `retention_enabled: true` so logs do not grow without bound.
- `replication_factor: 1` for a single instance.

## Volumes

| Container path | Host path (convention) |
|----------------|------------------------|
| `/loki` | `/opt/loki/data` |
| `/etc/loki/loki-config.yaml` | `shared/loki/loki-config.yaml` (bind mount) |

## Healthcheck

Loki responds on `/ready` with 200.

## Log Shipping

The [[Alloy]] agent on each host ships container and journal logs to Loki. Grafana queries Loki through the datasource in [[Observability]].

## Gotchas

- Filesystem storage grows; enable compactor retention.
- Loki and Promtail/Alloy must agree on the push URL: `http://loki:3100/loki/api/v1/push`.
- For multi-host shipping, Loki's HTTP listener binds `0.0.0.0`.

## See Also

- [[Observability]]
- [[Alloy]] — the log shipper
- [[Grafana]] — the query frontend