● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
G

Grafana Loki

Observability
Open source · AGPL-3.0

Loki is a log aggregation system built by Grafana Labs, designed explicitly to avoid full-text indexing.

updated 2026-07-01

What it is

Loki is a log aggregation system built by Grafana Labs, designed explicitly to avoid full-text indexing. Instead of indexing log content like Elasticsearch or Splunk, it indexes only a small set of labels per log stream (think namespace, pod, app) and stores the raw log content compressed in chunks. This is the core tradeoff: you lose fast arbitrary full-text search across unindexed fields, but you gain drastically lower storage and operational cost. Query performance depends on how well your label cardinality is designed — good label design gives you fast queries, bad label design gives you slow grep-style scans over compressed chunks.

It's built to look and feel like Prometheus for logs: same label model, same horizontal scaling philosophy, same object-storage-backed architecture (S3, GCS, or filesystem). It pairs natively with Grafana for visualization and with Promtail/Alloy/Fluentd/Fluent Bit for log shipping.

Who builds it and why

Grafana Labs is the primary maintainer and commercial sponsor — Loki is the logging pillar of their LGTM stack (Loki, Grafana, Tempo, Mimir), and it's a paid product line via Grafana Cloud. This isn't a side project: 1,337 contributors and continuous active development (last commit within days of writing) reflect sustained investment, not a maintenance-mode repo. The commercial incentive is clear — Grafana sells hosted Loki and enterprise support, and the open source project is both the funnel and the foundation for that business.

Production readiness signal

28.4k GitHub stars, 1,337 contributors, and a recent release cadence (v3.7.3) point to an actively maintained, widely adopted project — not a research prototype. It's not a CNCF project (maturity level not publicly available, and it's not in CNCF's project list at all — it's Grafana Labs IP), so you don't get the CNCF governance/vendor-neutrality signal some teams require. AGPL-3.0 licensing is a real consideration: unlike Apache 2.0 tools, AGPL has copyleft implications if you modify and offer Loki as a network service, which matters for vendors more than end users running it internally.

Operationally, Loki at scale requires real tuning — chunk sizing, compactor configuration, label cardinality discipline, and ring/index-gateway setup in microservices mode. Teams running it well have usually been burned once by high-cardinality labels blowing up their index.

Who should use this

  • Teams already running Prometheus/Grafana who want a consistent metrics+logs+traces stack with one query language family (LogQL mirrors PromQL).
  • Cost-sensitive teams with high log volume where full-text indexing (Elasticsearch-style) is financially painful.
  • Kubernetes-native shops that can enforce consistent, low-cardinality labeling (namespace, pod, container) as part of their logging convention.
  • Platform teams that want object-storage-backed, horizontally scalable logging without operating a Java-based search cluster.

Who should NOT use this

  • Teams needing frequent, ad-hoc full-text search across unstructured log content (e.g., security/forensics use cases scanning arbitrary strings) — Loki's grep-over-chunks approach is slow at scale compared to Elasticsearch/Splunk's inverted indexes.
  • Organizations with poor control over label cardinality (e.g., putting user IDs or request IDs in labels) — this is the #1 cause of Loki performance and cost blowups.
  • Teams wanting a single vendor-neutral CNCF-governed project as a hard requirement — Loki is Grafana Labs-controlled, not CNCF.
  • Shops needing complex log-based analytics/aggregations comparable to Splunk SPL out of the box — LogQL is capable but not as feature-rich for ad hoc analytics.

Alternatives

  • Elasticsearch/OpenSearch (ELK stack) — full-text indexing, richer query flexibility, but far more expensive to operate and store at scale.
  • Splunk — best-in-class log analytics and enterprise features, at enterprise-grade licensing cost.
  • Datadog Log Management — fully managed, tightly integrated with APM/metrics, but recurring SaaS cost scales fast with volume.

Pricing

Loki itself is fully open source (AGPL-3.0), free to self-host with no feature gating. Grafana Labs monetizes via Grafana Cloud (hosted Loki with usage-based pricing) and enterprise support/add-ons. Self-hosting cost is your infra + object storage + ops time, not a license fee.

Frequently asked

What is Grafana Loki?+
Loki is a log aggregation system built by Grafana Labs, designed explicitly to avoid full-text indexing. Instead of indexing log content like Elasticsearch or Splunk, it indexes only a small set of labels per log stream (think namespace, pod, app) and stores the raw log content compressed in chunks.
Who builds Grafana Loki?+
Grafana Labs is the primary maintainer and commercial sponsor — Loki is the logging pillar of their LGTM stack (Loki, Grafana, Tempo, Mimir), and it's a paid product line via Grafana Cloud.
Is Grafana Loki production ready?+
28.4k GitHub stars, 1,337 contributors, and a recent release cadence (v3.7.3) point to an actively maintained, widely adopted project — not a research prototype.
Who should use Grafana Loki?+
Teams already running Prometheus/Grafana who want a consistent metrics+logs+traces stack with one query language family (LogQL mirrors PromQL). Cost-sensitive teams with high log volume where full-text indexing (Elasticsearch-style) is financially painful.
Who should not use Grafana Loki?+
Teams needing frequent, ad-hoc full-text search across unstructured log content (e.g., security/forensics use cases scanning arbitrary strings) — Loki's grep-over-chunks approach is slow at scale compared to Elasticsearch/Splunk's inverted indexes. Organizations with poor control over label cardinality (e.g.
What are the alternatives to Grafana Loki?+
Elasticsearch/OpenSearch (ELK stack) — full-text indexing, richer query flexibility, but far more expensive to operate and store at scale. Splunk — best-in-class log analytics and enterprise features, at enterprise-grade licensing cost.
How much does Grafana Loki cost?+
Loki itself is fully open source (AGPL-3.0), free to self-host with no feature gating. Grafana Labs monetizes via Grafana Cloud (hosted Loki with usage-based pricing) and enterprise support/add-ons. Self-hosting cost is your infra + object storage + ops time, not a license fee.