Skip to main content
Gå til innhold

Logs

Logs are timestamped records of events in your application. They are the most detailed record of what happened and when, and are essential for debugging, auditing, and post-hoc investigation.

On Platon, logs live in Loki and are accessed through your team's Grafana organization.

When to use logs​

Logs are well-suited to debugging individual errors, audit trails, and reconstructing what happened on a specific request. They are not the right tool for counting events, computing rates, or driving alerts at scale — for those, emit a metric instead. See Metrics and, if you are considering OpenTelemetry, Choosing your signals.

How logs reach Loki​

Depending on your setup:

SetupHow logs are collected
PaaS (stdout)Vector automatically collects container logs
PaaS (OTLP)Your app sends logs via OpenTelemetry (coming soon)
Puppet VMspmodule_vector ships logs from files
ExternalYour collector sends logs with authentication

Logs are retained for 180 days by default. See Data Retention for details.

Viewing logs in Grafana​

  1. Go to Grafana.
  2. Open Explore.
  3. Select your Loki data source.
  4. Write a LogQL query.

Basic queries​

Find logs from a specific namespace:

{namespace="my-namespace"}

Find error logs:

{namespace="my-namespace"} |= "error"

Filter by multiple conditions:

{namespace="my-namespace", app="my-app"} |= "error" != "expected"

Parse a JSON log and filter on a field:

{namespace="my-namespace"} | json | status_code >= 500

Query language​

Loki uses LogQL. Key concepts:

  • Stream selectors — {label="value"} — filter by labels.
  • Line filters — |= "text" — filter log content.
  • Parsers — | json, | logfmt — parse structured logs.
  • Aggregations — count_over_time(), rate() — compute statistics.

See LogQL Best Practices for writing efficient queries.

Correlation between logs and traces​

If your application is instrumented with OpenTelemetry, log lines include trace_id and span_id attributes. In Grafana's Loki view, click the trace ID to open the full trace in Tempo. On a logs-only setup, this section does not apply.

See Choosing your signals — Correlating the three signals for the full pattern.

Next steps​