• Github
  > git clone git@github.com:grafana/loki.git
• Docker
  > cd loki/production
> docker-compose pull
> docker-compose up
• Grafana
  Used for visualization of log file data.
  • Open Browser
    http://localhost:3000
  • Credentials
    Username: admin
Password: admin
  • Activate Loki
    • Menu – Configuration – Data Sources – Loki (http://localhost:3000/datasources)
      • Url
        http://loki:3100
• promtail
  Pushes log file content to Grafana Loki.
  1. Open https://github.com/grafana/loki/releases
  2. Download e.g. promtail-windows-amd64.exe.zip
  3. Unzip
  4. Configuration
     1. Create config.yaml, for content see appendix
     2. Hints
        1. Keep attention to parse your timestamp correctly, otherwise you will see only the date/time of the import timestamp. Timestamps are handled by go, so use online editors to check your parsings, https://play.golang.org/
        2. Keep attention on multilines.
        3. Regular expressions can be quiet comprehensive to read, so use online regex parser/checker, e.g. https://regex101.com/

• Start promtail
  promtail.exe -config.file=config.yaml
• Back to Grafana
  • Menu – Explore – Log browser (http://localhost:3000/explore)
    Hint: Wait a few minutes until you will see your logs in this area.

Appendix

config.yaml

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: D:/promtail/positions.yaml # will be created automatically by promtail. This location needs to be writeable by promtail.

client:
  url: http://localhost:3100/loki/api/v1/push
  basic_auth:
    username: admin
    password: admin

scrape_configs:
  - job_name: MyApp
    pipeline_stages:
    - multiline: # identify timestamps as first line of a multiline block.
        firstline: '^\d{4}-\d{2}-\d{2}.\d{1,2}:\d{2}:\d{2}.\d{4}'
        max_wait_time: 3s
    - regex: #https://regex101.com/ #http://www.rexegg.com/regex-quickstart.html#modifiers
        expression: '^(?P<date>\d{1,4}.\d{1,2}.\d{1,2}).(?P<time>\d{1,4}.\d{1,2}.\d{1,2}).(?P<ms>\d{1,3})..(?P<level>[\w\s]+)'
    - template:
        source: time
        template: '{{ .date }}T{{ .time }}.{{ .ms }}+02:00'
    - timestamp:
        source: time
        format: "2006-01-02T15:04:05.000-07:00" # https://play.golang.org/ #time.Parse
    - labels:
        level:
    static_configs:
      - targets:
          - localhost
        labels:
          job: MyApp # A `job` label is fairly standard in prometheus and useful for linking metrics and logs.
          host: workstation # A `host` label will help identify logs from this machine vs others
          agent: promtail
          __path__: D:/logs/*.log