Loki

Why it's ranked here

The engineering backs its own design goals: the write path requires quorum-acknowledged writes across replicated ingesters before returning success, and the storage layer indexes only labels, not full text, which keeps it cheap at scale. Continuous fuzzing and a working automated check suite point to real maintenance discipline rather than a dormant project. The tradeoff a self-hoster has to weigh going in is the license: AGPL-3.0-only, with just a narrow Apache-2.0 carve-out, a stricter term than most log-shipping tools carry.

What's good

Writes only succeed once a quorum of replicated ingesters confirm them, so a single node failure mid-ingest does not lose data. Index files and log chunks both land in the same object storage backend, S3, GCS, or Azure Blob among others, so there is no separate database to operate. A dedicated canary tool ships in the same repository purely to catch missing or delayed log entries in a live deployment, and large queries are automatically split into parallel sub-queries by the query frontend.

Tradeoffs

Licensing is AGPL-3.0-only outside a narrow Apache-2.0 carve-out, the kind of term that sends most companies to legal review before self-hosting for a product. The Helm chart is mid-migration into a separate repository, so current Kubernetes install instructions will shift. The older BoltDB index format is deprecated in favor of the newer time-series index, so long-running deployments carry migration work. There is no packaged install shown beyond building the Go binary from source or running it as a container image.

How to use it well

Pair it with Grafana Alloy for log shipping and Grafana itself for querying and dashboards; Promtail still works but Grafana has stopped developing it further. Run a single binary for small setups, or split into read, write, and backend roles once you need to scale each independently. Use the LogCLI client for scripting and ad hoc queries outside Grafana, and run the Loki Canary tool alongside it to catch silent log loss. Skip it if you actually need full-text search across log content rather than label-scoped queries.

Observed

License

AGPL-3.0-only, with Apache-2.0 exceptions for select components (see LICENSING.md)

Language

Go

Interfaces

Binary log-aggregation service (loki), command-line query client (logcli), synthetic-monitoring canary (Loki Canary)

Install surface

Build from source with go build or make; no package-manager install documented in the README

Query language

LogQL, a Prometheus-inspired query language for logs

Storage backends

Object storage: Amazon S3, Google Cloud Storage, Azure Blob Storage, IBM Cloud Object Storage, Alibaba Cloud OSS

Deployment modes

Single binary, or split into read, write, and backend targets via a command-line target flag

Multi-tenancy

Tenant ID read from an HTTP header; defaults to a single shared tenant when unset

CI and testing signals

Automated check workflow, code-quality report badge, and continuous fuzz testing integration

Companion agent

Grafana Alloy is the recommended log-shipping agent; Promtail is feature-complete but no longer under active development