The Ops Community ⚙️

Alex
Alex

Posted on

loki && curl && logcli

#devops #loki #logs #sre

With https://community.ops.io/la3mmchen/grafana-loki-28b9 I've shared some words on Loki as an introduction.

Lets follow up with some practical stuff: How can we run Loki an our local notebook with docker-compose?

Loki

As Grafana provides a good enough container images we just use the one from docker hub to get a local instance running.

---
version: "3.9"

services:
  loki:
    image: "grafana/loki:2.5.0"
    ports:
      - "3100:3100"
Enter fullscreen mode Exit fullscreen mode

As Loki follows the unix philosophy "Do One Thing and Do It Well" it's just a backend to send logs to and to query logs from.
Plain speaking: there is no graphical user interface in the Loki server.

We interact with the Loki instance with curl using the http api:

$  curl http://localhost:3100/ready  
ready
$ curl http://localhost:3100/loki/api/v1/labels
{"status":"success","data":["__name__"]}
Enter fullscreen mode Exit fullscreen mode

As the second request shows there are not many labels in the system yet.

Lets change this.

interact with curl

Loki offers a http api to send metrics. The data format is described at http push api, we use the following curl to create a new event stream:

$ curl -S -H "Content-Type: application/json" -XPOST -s http://localhost:3100/loki/api/v1/push --data-raw '{"streams": [{ "stream": { "app": "app1" }, "values": [ [ "1653855518000000000", "random log line" ] ] }]}'
$ curl http://localhost:3100/loki/api/v1/labels
{"status":"success","data":["__name__","app"]}
Enter fullscreen mode Exit fullscreen mode

As you can see in the second curl there is now a new label named "app". We can explore possible values for this label with the following curl.

$ curl http://localhost:3100/loki/api/v1/label/app/values
{"status":"success","data":["app1"]}
Enter fullscreen mode Exit fullscreen mode

And finaly see the stream with this label:

$ curl -G -Ss  http://localhost:3100/loki/api/v1/query_range --data-urlencode 'query={app="app1"}' | jq .
{
  "status": "success",
(...)
        "values": [
          [
            "1653855518000000000",
            "random log line"
          ]
        ]
      }
(...)
Enter fullscreen mode Exit fullscreen mode

(output shorted)

logcli

A more covenient way to interact with Loki from the command line is using logcli

$ LOKI_ADDR=http://localhost:3100 logcli labels
http://localhost:3100/loki/api/v1/labels?end=1653856566774536000&start=1653852966774536000
__name__
app
$ LOKI_ADDR=http://localhost:3100 logcli query '{app=~".+"}'
http://localhost:3100/loki/api/v1/query_range?direction=BACKWARD&end=1653856568404563000&limit=30&query=%7Bapp%3D~%22.%2B%22%7D&start=1653852968404563000
Common labels: {app="app1"}
2022-05-29T22:18:38+02:00 {} random log line
http://localhost:3100/loki/api/v1/query_range?direction=BACKWARD&end=1653855518000000001&limit=30&query=%7Bapp%3D~%22.%2B%22%7D&start=1653852968404563000
Common labels: {app="app1"}
Enter fullscreen mode Exit fullscreen mode

in case you do not want to install logcli locally just add another container to our docker-compose setup from the beginning of this article:

(..)
  logcli:
    image: "grafana/logcli:2.5.0-amd64"
    environment:
      - "LOKI_ADDR=http://loki:3100"
Enter fullscreen mode Exit fullscreen mode

with this container you can just do:

$ docker-compose run logcli labels
Creating loki_logcli_run ... done
(..)
__name__
app
Enter fullscreen mode Exit fullscreen mode

following up

in the next post we will add a grafana instance to our docker-compose that will enable us to click something ;-)

references

links

code reference 

---
version: "3.9"

services:
  loki:
    image: "grafana/loki:2.5.0"
    ports:
      - "3100:3100"
  logcli:
    image: "grafana/logcli:2.5.0-amd64"
    environment:
      - "LOKI_ADDR=http://loki:3100"
Enter fullscreen mode Exit fullscreen mode

Top comments (0)