Grafana Loki – zentrales Log-Management 2025

Loki vs. Elasticsearch/ELK

ELK Stack (Elasticsearch + Logstash + Kibana):
✅ Volltext-Index, sehr schnelle Suche
❌ Hoher RAM-Bedarf (4-16 GB Minimum)
❌ Komplex zu betreiben

Grafana Loki:
✅ Schlanker (Labels statt Volltext-Index)
✅ Perfekte Grafana-Integration
✅ 500 MB RAM reicht für kleine Setups
❌ Langsamere Volltext-Suche

Loki Stack installieren

# docker-compose.yml
services:
  loki:
    image: grafana/loki:latest
    container_name: loki
    ports:
      - "3100:3100"
    volumes:
      - ./loki-config.yml:/etc/loki/local-config.yaml
      - loki-data:/loki
    command: -config.file=/etc/loki/local-config.yaml
    restart: unless-stopped

  promtail:
    image: grafana/promtail:latest
    container_name: promtail
    volumes:
      - /var/log:/var/log:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - ./promtail-config.yml:/etc/promtail/config.yml
    command: -config.file=/etc/promtail/config.yml
    restart: unless-stopped

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    volumes:
      - grafana-data:/var/lib/grafana
    restart: unless-stopped

volumes:
  loki-data:
  grafana-data:

Loki Konfiguration

# loki-config.yml
auth_enabled: false

server:
  http_listen_port: 3100

common:
  path_prefix: /loki
  storage:
    filesystem:
      chunks_directory: /loki/chunks
      rules_directory: /loki/rules
  replication_factor: 1

schema_config:
  configs:
    - from: 2024-01-01
      store: tsdb
      object_store: filesystem
      schema: v13
      index:
        prefix: index_
        period: 24h

limits_config:
  retention_period: 30d

Promtail – Logs senden

# promtail-config.yml
server:
  http_listen_port: 9080

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
  # System-Logs
  - job_name: system
    static_configs:
      - targets:
          - localhost
        labels:
          job: syslog
          server: web-01
          __path__: /var/log/syslog

  # Nginx-Logs
  - job_name: nginx
    static_configs:
      - targets:
          - localhost
        labels:
          job: nginx
          __path__: /var/log/nginx/*.log

  # Docker-Container-Logs
  - job_name: docker
    docker_sd_configs:
      - host: unix:///var/run/docker.sock
    relabel_configs:
      - source_labels: ['__meta_docker_container_name']
        target_label: container

LogQL Abfragen in Grafana

# Alle Nginx-Logs
{job="nginx"}

# Fehler-Logs
{job="nginx"} |= "error"

# HTTP 5xx-Fehler
{job="nginx"} | json | status >= 500

# Lograte pro Minute
rate({job="nginx"}[1m])

# Top-IPs nach Anfragen
topk(10, sum by (remote_addr) (rate({job="nginx"} | logfmt [5m])))

# Suche in Alle-Logs
{server="web-01"} |= "CRITICAL"

Grafana Loki Integration

Grafana → Configuration → Data Sources → Add:
  Type: Loki
  URL: http://loki:3100

Dashboard → Explore:
  Data Source: Loki
  Query: {job="nginx"} |= "error"

Logs mit Metriken korrelieren:
  Gleiche Zeit-Achse für Prometheus + Loki

FAQ

Wie viel Speicher braucht Loki für 10 Server?
Mit 30 Tage Retention: 5-20 GB je nach Log-Volume. Loki komprimiert effizient (10:1).

Fazit

Grafana Loki + Promtail ist die schlankste zentralisierte Log-Lösung – perfekt als Ergänzung zum Prometheus+Grafana Stack.

Log-Management für KMU in Heidelberg, Mannheim und der Rhein-Neckar-Region. Anfragen.