Skip to main content
Look back at where we started. We began with a wall of camera footage — hours of raw logs — and the task of finding one clue quickly without paying a fortune to store everything. This lesson showed a practical, cost-effective way to do that using Grafana Loki and Alloy. What makes Loki different is simple: it indexes only a small set of labels and keeps the log text compressed and cheap. That single design choice makes searches fast and storage affordable. For example, you might have raw log lines like:
and a compact index that looks like:
A large portion of the course builds on that core idea: keep the index small and push the heavy payload to inexpensive object storage. You also traced a log’s full journey. Along the way you:
  • Deployed a Loki server and placed Grafana Alloy in front of it to collect and ship logs.
  • Learned LogQL: select streams by labels, then filter text in those streams.
  • Observed a log line travel from an application, through an agent, into object storage, and back onto your screen.
  • Saw how Loki writes compressed chunks to object storage so you can retain huge volumes at lower cost.
Then you took all of that into Kubernetes.
A simple architecture diagram of a logging pipeline: an application (with an Alloy agent) pushes logs to Loki (stores + indexes), which uses object storage for compressed chunks. Grafana queries Loki via LogQL to display the logs on-screen.
You installed Loki, Alloy, and Grafana with Helm using three separate charts. You ran an Alloy DaemonSet so logs are collected from every pod on every node automatically — including applications deployed after the agent runs. You also converted raw JSON logs into structured metadata and extracted a small set of indexable labels with a processing pipeline, for example:
This pattern keeps high-cardinality fields as structured metadata while indexing only the small set of labels you actually need for fast queries. That’s a complete, modern logging stack — built piece by piece and deployable on Kubernetes.
Avoid indexing high-cardinality fields (unique IDs, long strings, timestamps). Index only the labels you need for querying; keep the rest in JSON or as unindexed message text to prevent high storage costs and degraded query performance.
You’re also up to date with where the ecosystem is heading. Teams are moving from Promtail to Alloy and from a single bundled chart to separate, focused charts for each component. To go deeper, read the official docs for advanced topics such as tiered storage, retention, advanced pipelines, alerting, and third‑party integrations:
A slide titled "Where to go next" with two rounded link cards: a blue one for grafana.com/docs/loki and an orange one for grafana.com/docs/alloy. Each card shows a small logo and an ellipsis.
And remember: logs are only one pillar of observability. The same Grafana and Alloy agent can ingest metrics and traces as well, so the workflow you built here naturally extends toward full observability. If anything felt fast, repeat the hands-on exercises at your own pace. Intentionally break something and then find it in the logs. Practicing deliberate failure will make the patterns stick. For example, try searching for error traces with a small set of sample lines:
A simple LogQL filter finds the failure quickly:
Quick reference
Want to learn more? Explore LogQL examples in the Loki docs, try advanced pipeline stages in Alloy, and experiment with retention and compaction settings to optimize cost versus query performance.
Thank you for going through this lesson. Now go and turn your logs into something you can navigate, reason about, and act on.

Watch Video