Skip to main content
In this guide, we’ll verify that our Loki server is successfully receiving log messages and demonstrate how to query these logs using Grafana. Below is an excerpt from the Loki log output, confirming that various log files (e.g., auth.log, cloud-init-output.log, kern.log, etc.) have been processed:
If you’re running Loki locally for testing, you can use several commands based on your operating system.

​
Running Loki Locally

To run Loki on your local machine, choose the appropriate command:

​
Configuring Grafana

Open a new browser tab and navigate to your Grafana server (typically available at http://localhost:3000). In Grafana, follow these steps:
  1. Open the dropdown menu and select “Connections”.
  2. Add a new data source.
  3. Choose Loki from the available options.
  4. Name the data source “Loki”.
  5. Provide the URL to your Loki server (e.g., http://localhost:3100).
  6. Click Save & Test to verify the connection.
The image shows a Grafana interface for configuring a data source connection, specifically for Loki, with options for HTTP settings, authentication, and alerting. The interface indicates that the data source is successfully connected.

​
Querying Logs in Grafana

Switch to the Explore section in Grafana and ensure that Loki is selected as your data source. Grafana will automatically display various labels such as job names and file names from which the logs originated. These labels are useful for filtering the logs you wish to view.

​
Filtering Logs by Label

To filter logs by a specific label—such as logs where the label job is set to “varlogs”—use the following query:
To further narrow down the search for logs containing a keyword (e.g., “docker”), you can append a filter operator:
This refined query will return only the logs that contain the word “docker”. The log entries might resemble:
Selecting an individual log entry within Grafana will also reveal its associated labels, such as job and filename, providing additional context for deeper troubleshooting.

​
Querying Logs by Specific File

If you need to query logs from a specific file, such as /var/log/kern.log, adjust your query by filtering with the filename label. For example, to display logs from /var/log/kern.log that contain the term “docker”, use:
To view all logs from the same file without any additional keyword filter, simply use:

​
Querying Logs from Multiple Files

You can also query logs from multiple files by using a regular expression. For instance, to retrieve logs from either /var/log/kern.log or /var/log/syslog, use:
If you prefer to fetch all logs from the matched files without filtering based on text, use:
The image shows a Grafana Loki interface with a query being set up to filter logs from a specific file path. A graph and log output area are visible below the query builder.
These examples illustrate how you can leverage Loki’s powerful LogQL to filter logs using labels and search within log messages. Grafana’s intuitive query builder further simplifies the process, enabling you to quickly locate the logs relevant to your operations and troubleshooting needs.
By following this guide, you’ll gain confidence in using Loki and Grafana to manage and query your logs efficiently. For additional details, explore the Loki Documentation and the Grafana Documentation.

Watch Video