Grafana Loki

What it is

Grafana Loki is an open-source log aggregation system built by Grafana Labs and first released in 2018, explicitly modeled on Prometheus — the project’s own tagline is “like Prometheus, but for logs.” Its defining architectural choice is to index only a small set of low-cardinality labels (such as namespace, app, or env) rather than the full text of every log line. The log content itself is compressed into chunks and stored cheaply in object storage (S3, GCS, or compatible), and full-text matching happens at query time over the chunks that a label match narrows down to.

That trade-off — cheap ingestion and storage in exchange for query-time text scanning — is the whole point: Loki is dramatically less resource-intensive to run at scale than full-text-indexed systems like Elasticsearch, provided label cardinality stays disciplined. Loki is queried with LogQL, a PromQL-inspired query language, and is most commonly paired with Grafana for visualization and with Promtail, Grafana Alloy, or the OpenTelemetry Collector for log shipping. The project reached its 3.x release line and Grafana Labs has continued to invest in its architecture, including a redesign introduced alongside Grafana 13 in 2026 aimed at easier operation at scale.

Why teams choose it

• Much lower storage and operational cost than full-text-indexed logging. Because the index only tracks label-to-chunk mappings, Loki’s index stays small even as raw log volume grows into the terabytes, and object storage is cheap.
• Tight Grafana integration. Loki logs correlate naturally with Prometheus/Mimir metrics and Tempo traces inside a single Grafana dashboard, using the same label model across all three signals.
• LogQL’s familiarity for Prometheus users. Teams already fluent in PromQL pick up LogQL quickly, including its metric-from-logs capabilities (turning log patterns into rate/count time series).
• Cardinality discipline is mandatory, not optional. Loki’s low cost depends on keeping labels low-cardinality; teams that label by request ID or user ID effectively defeat the design and can end up with as many small streams and as much index pressure as a traditional indexer — this is Loki’s most common operational pitfall.

Pricing model

Loki itself is free, open-source software (AGPLv3) that you can self-host, with cost driven mainly by the object storage backing it and whatever compute runs the query and ingestion path. Grafana Labs also offers Loki as part of its managed Grafana Cloud offering, which uses usage-based pricing (typically metered on ingested log volume and active series/labels) and includes a free tier for small-scale or evaluation use.

Alternatives

The most common full-text-indexed alternative is the Elasticsearch / ELK stack, which indexes complete log content and supports richer ad hoc search at meaningfully higher storage and compute cost. Commercial SaaS options like Datadog Log Management and Splunk offer similar full-indexing search capability with less operational burden but higher, usage-based cost. Within the Grafana ecosystem, Loki is typically deployed alongside Grafana Mimir for metrics and Grafana Tempo for traces as a complete open-source LGTM (Loki/Grafana/Tempo/Mimir) stack.