log-guardian/project-docs/runbooks/loki-setup.md

Loki Setup Runbook

Starter local/Portainer stack

Use deploy/loki/docker-compose.yml and deploy/loki/promtail-config.yml.

cd deploy/loki
docker compose up -d

Verify Loki

curl -fsS http://localhost:3100/ready
curl -G http://localhost:3100/loki/api/v1/labels

Useful LogQL examples

{service="api"} |= "error"
{stack="second-brain"} |~ "(?i)(panic|fatal|exception)"
{stream="stderr"} |~ "(?i)(error|failed|timeout)"

Portainer notes

For Portainer deployment, mount the Docker socket and Docker container log directory read-only into Promtail. The included compose does this for a single Docker host. Multi-node Swarm setups need Promtail on each node or another log shipping strategy.