Loki

Loki is Grafana's answer to the ELK stack — a log aggregation system that indexes only metadata (labels), not full log content, making it dramatically cheaper to run. If you already use Grafana for dashboards, Loki plugs in as the native logging backend with the same label-based query model as Prometheus.

For teams already in the Grafana ecosystem, Loki is the natural choice. It's 10x cheaper to operate than Elasticsearch because it stores compressed log chunks in object storage instead of maintaining full-text indexes. Elasticsearch/ELK is the powerful but expensive alternative with superior search. Datadog is the fully-managed commercial option.

The catch: AGPL license means your modifications must be open-sourced. Loki's label-based querying (LogQL) can't do the arbitrary full-text searches that Elasticsearch handles effortlessly. You must know your labels upfront. High-cardinality labels kill performance. And if you need to search across terabytes of logs for a random string, Elasticsearch is still the right tool. Loki is for structured, label-driven log analysis.