# Loki Setup Runbook

## Starter local/Portainer stack

Use `deploy/loki/docker-compose.yml` and `deploy/loki/promtail-config.yml`.

```sh
cd deploy/loki
docker compose up -d
```

## Verify Loki

```sh
curl -fsS http://localhost:3100/ready
curl -G http://localhost:3100/loki/api/v1/labels
```

## Useful LogQL examples

```logql
{service="api"} |= "error"
{stack="second-brain"} |~ "(?i)(panic|fatal|exception)"
{stream="stderr"} |~ "(?i)(error|failed|timeout)"
```

## Portainer notes

For Portainer deployment, mount the Docker socket and Docker container log directory read-only into Promtail. The included compose does this for a single Docker host. Multi-node Swarm setups need Promtail on each node or another log shipping strategy.