SecureAnyCloud
Deployment guide

Loki 3

Videos

Overview: Grafana Loki 3 on Azure: overview (watch on YouTube)

Launch and log in: Grafana Loki 3 on Azure: launch and log in (watch on YouTube)

Deep Dive: Grafana Loki 3 on Azure: deep dive (watch on YouTube)

Overview

Grafana Loki is the log-aggregation system from the Grafana Labs ecosystem. It indexes only labels, with no full-text index, and scales horizontally. It is cheap to operate and integrates with Promtail, Fluent Bit, OpenTelemetry and the Grafana Explore view.

The SecureAnyCloud image installs Loki 3.7 as a single Go binary (about 60 MB resident), configured for single-tenant filesystem storage. It is ready to ingest logs from day one, and you can scale up to S3, GCS or Azure Blob as your traffic grows.

What you get:

  • Loki 3.7.x single Go binary at /usr/local/bin/loki (from the official grafana/loki GitHub release)
  • Single-tenant filesystem store at /var/lib/loki/ (chunks, rules and WAL)
  • HTTP API on TCP 3100: /loki/api/v1/push, /loki/api/v1/query, /loki/api/v1/query_range, /metrics and /ready
  • gRPC API on TCP 9096 (cluster, internal)
  • loki.service running as the loki:loki system user
  • Prometheus-format /metrics endpoint for scraping
  • 24/7 SecureAnyCloud support

Prerequisites

  • An active Azure subscription
  • An SSH key
  • A VNet and subnet

Standard_B2s (4 GB RAM) is sufficient for moderate single-tenant workloads, such as a few thousand log lines per second. For high-volume production, scale up to D4s or D8s and switch the storage backend from filesystem to Azure Blob (storage_config.azure).

Step 1-3: Deploy and connect over SSH

ssh azureuser@<vm-ip>
4

Verify the service and version

sudo systemctl status loki --no-pager | head -10 /usr/local/bin/loki -version | head -5
5

Check the HTTP endpoints

curl -s -o /dev/null -w 'GET /ready: HTTP %{http_code}\n' http://127.0.0.1:3100/ready
curl -s -o /dev/null -w 'GET /metrics: HTTP %{http_code}\n' http://127.0.0.1:3100/metrics
6

Read your endpoints

sudo cat /stage/scripts/loki-credentials.log

The credentials file lists the push, query, metrics and ready URLs for your VM. They are filled in with the VM's reachable IP at first boot.

7

Push and query a log line

TS=$(date +%s)000000000 curl -X POST -H 'Content-Type: application/json' \
  -d "{\"streams\":[{\"stream\":{\"job\":\"demo\",\"host\":\"web01\"},\"values\":[[\"${TS}\",\"hello from sac\"]]}]}" \
  http://127.0.0.1:3100/loki/api/v1/push sleep 2 curl -sG --data-urlencode 'query={job="demo"}' \
  --data-urlencode "start=$(($(date +%s) - 300))000000000" \
  --data-urlencode "end=$(date +%s)000000000" \
  http://127.0.0.1:3100/loki/api/v1/query_range | head -c 200
8

Components

  • Loki binary: /usr/local/bin/loki
  • Config: /etc/loki/loki.yaml
  • Data directory: /var/lib/loki/ (chunks, rules, wal)
  • systemd unit: /etc/systemd/system/loki.service
  • Run-as user: loki:loki
  • HTTP port: 3100
  • gRPC port: 9096 (internal cluster communication)
  • Credentials: /stage/scripts/loki-credentials.log
9

Send logs from your applications

Loki accepts logs over HTTP from any Loki-compatible client:

  • Promtail (Grafana's official agent) scrapes files, the journal and syslog, and ships them to Loki.
  • Fluent Bit and Fluentd have a native loki output plugin.
  • OpenTelemetry Collector has a loki exporter.
  • Direct curl or SDK: any language can POST /loki/api/v1/push with the JSON shape shown in Step 7.

Point your client at http://<vm-ip>:3100/loki/api/v1/push. There is no auth by default. See the hardening step below to add auth.

10

View logs in Grafana

In your Grafana instance:

  • Go to Configuration > Data sources > Add data source and choose Loki.
  • Set the URL to http://<vm-ip>:3100.
  • Select Save & test. It should report "Data source connected and labels found".
  • Open Explore, select Loki and run LogQL queries such as {job="demo"}, {host="web01"} |= "error" or rate({job="demo"}[1m]).
11

Harden for production

  • Add auth. Place Loki behind nginx, Apache or HAProxy with HTTP basic auth or TLS client certificates. Loki itself ships with auth_enabled: false (single-tenant) for simplicity.
  • Switch storage to Azure Blob. Edit the storage_config.azure block in /etc/loki/loki.yaml, point it at a Blob container and restart loki.service.
  • Set retention. Default retention is unlimited. Set limits_config.retention_period: 720h (30 days) and enable the compactor in the compactor: block of the config to enforce it.
  • Patch monthly. Run apt-get update && apt-get upgrade && reboot. Watch the GitHub releases at https://github.com/grafana/loki/releases and redeploy /usr/local/bin/loki with the new binary.
  • Restrict the NSG so port 3100 is reachable only from your log-shipping clients and Grafana, not the public internet.

Licensing

Loki is AGPL-3.0 and free to use commercially. The SecureAnyCloud distribution adds packaging, hardening and 24/7 support. SecureAnyCloud provides commercial support separately. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Grafana Loki 3 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure