Centralized Logging with Grafana Loki and Promtail

Every application generates logs. Web servers log every request. Databases log slow queries. Applications log errors. When a problem occurs, the first step is checking logs. But checking logs one application at a time, across multiple servers, is slow and frustrating. Centralized logging solves this by pulling all logs into one searchable, indexed system.

Why Loki?

Grafana Loki is the logging platform built for modern infrastructure. Unlike the ELK stack (Elasticsearch, Logstash, Kibana) which is powerful but resource-intensive, Loki is lightweight and designed for small-to-medium deployments. It indexes only metadata (labels like application name, server, severity) and leaves the log content unindexed, which dramatically reduces storage requirements. A typical Loki deployment uses a fraction of the RAM and disk space of a comparable Elasticsearch setup.

How It Works

Promtail, a lightweight log collector, runs on each server and tails log files from your Docker containers and system services. It attaches labels (which application, which server, which environment) and ships logs to Loki. Loki stores them efficiently in object storage or local disk. Grafana, which you may already use for monitoring, provides the query interface.

With everything in one place, you can answer questions like: Show all error-level logs across all applications in the last 15 minutes. Show every request to the CRM from a specific IP address. Show database slow queries across all databases.

What to Log

• Web server access logs: Every HTTP request with status code and response time
• Application logs: Errors, warnings, and audit events from your self-hosted apps
• Database logs: Slow queries, connection failures, replication status
• System logs: Authentication failures, sudo usage, service start and stop events
• Docker logs: Container stdout and stderr from every running service

Getting Started

Loki and Promtail run in Docker alongside your existing stack. They add minimal overhead: maybe 200MB RAM for Loki and 50MB for Promtail. The Grafana instance you already use for monitoring becomes your log viewer. VPS1 includes Loki and Promtail in our standard monitoring stack for managed clients.