Labels, Streams & "Prometheus for Logs"

Index Labels, Not Full Text

Grafana Loki is a horizontally scalable, cost-effective log aggregation system integrating tightly with Grafana. Its core distinguishing idea: index only metadata (labels) about log streams, not the full text of every log line — dramatically smaller and cheaper than full-text-indexing systems like Elasticsearch. This deliberately borrows Prometheus's label-based approach to metrics and applies it to logs — "like Prometheus, but for logs."

Streams & the Cardinality Trap

{app="checkout", env="production"}  ← a stream: all log lines sharing this exact label set

# BAD: request_id as a label explodes stream count
{app="checkout", request_id="a1b2c3"}

# GOOD: request_id stays in the log line content, filtered via LogQL
{app="checkout"} |= "request_id=a1b2c3"

A stream is a unique label-value combination grouping its log lines. High-cardinality values (a request ID, a user ID) used as labels create an enormous number of distinct streams, dramatically inflating the index and undermining Loki's whole cost/performance advantage — the standard fix is keeping such identifiers in the searchable log content instead, queried via LogQL at query time.

LogQL

LogQL is Loki's query language, syntactically inspired by PromQL — label selectors plus pipeline-style filtering. It also supports metric queries, deriving numeric time series (like an error rate) directly from log content, visualized as a graph in Grafana just like a native Prometheus metric.