{service_name="payments-api"} |= "timeout"One service, one word, no index to plan.
A label selector and a line filter. Nothing to declare up front.
Logs you can afford to keep in full.
Logs arrive from the OpenTelemetry Collector, Grafana Alloy or an SDK, and read back over a LogQL-compatible API. They sit in the same tenant as the trace that produced them, so a failing span and its output are one query apart.
Included on the free tier: 20,000 active series, 50 GB of logs and 50 GB of traces a month. No card.
Demonstration data
{service_name="payments-api"} |= "timeout"ERROR14:22:07.412
WARN14:22:07.418
ERROR14:22:07.902
INFO14:22:08.110
What you get
Included on every plan, including the free tier.
| Label | Values | Streams |
|---|---|---|
| service_name | 14 | 212 |
| level | 4 | 212 |
| k8s_namespace_name | 6 | 198 |
| k8s_pod_name | 88 | 188 |
| deployment_environment | 3 | 212 |
How it gets there
Three steps, then it is reporting.
Logs travel the same path as every other signal: into the agent, out with the tenant header.
Send logs to the agent over OTLP, or scrape files with Alloy.
The agent forwards them with the tenant header.
Query them by label in Insights, or from Grafana.
Demonstration data
// 01 · tail files and hand them to the OTLP pipeline
loki.source.file "app" {
targets = [{__path__ = "/var/log/app/*.log"}]
forward_to = [otelcol.receiver.loki.default.receiver]
}// 02 · the agent forwards with the tenant header
agent → xScaler · 1,284 lines/s
service_name "payments-api"
level "error"
trace_id "4f2c9a1b…"
lines / 5m 4,120
What you can ask
What that looks like as a query.
Paste any of these into Insights, or use them as an alert rule.
{service_name=~".+"} | json | status >= 500Structured fields filtered after parsing.
Parse the JSON body, then filter on a field inside it.
sum by (level) (
count_over_time({service_name="checkout"}[5m]))Error rate straight out of the log stream.
A metric query over logs, usable as a panel or an alert rule.
Questions
What teams ask about the log pipeline.
Something not here? Talk to an engineer who works on the platform.
Book thirty minutesThe query API is Loki-compatible, so your dashboards, alert rules and logcli habits carry over. What changes is that you are not running the storage behind it.
Start on the free tier.
20,000 active series, 50 GB of logs and 50 GB of traces a month, 90-day retention, and the whole of Insights.