Day 103: Loki: LogQL and structured logging
Loki: logs, indexed like Prometheus indexes metrics
Loki deliberately does NOT index the full text of every log line (unlike Elasticsearch) — it indexes only labels (service, environment, level), keeping the log content itself compressed and cheap to store. You query with LogQL, which filters by label first (cheap), then optionally greps/filters the actual log content within that already-narrowed set.
{service="api", environment="production"} |= "timeout" | json | duration > 5sStructured logging
A plain string log line (Request failed for user 42) is hard to query reliably. Structured logging emits logs as JSON with consistent fields ({ "event": "request_failed", "userId": 42, "durationMs": 340 }) — trivially filterable, aggregable, and joinable with other structured data, at the small cost of being less human-readable when eyeballed raw.
logger.error({
event: 'request_failed',
userId: 42,
path: '/api/orders',
durationMs: 340,
error: err.message,
});Key terms
- LogQL
- Loki's query language — filters by labels first, then log content.
- Structured logging
- Emitting logs as consistent, machine-parseable data (typically JSON) rather than free-form text.
Why is Loki's "index labels only, not full text" approach a deliberate trade-off rather than a limitation?
