$ helm repo add loki https://grafana.github.io/loki/charts

$ helm repo update

$ helm upgrade --install loki loki/loki-stack

$ helm upgrade --install loki --namespace=loki loki/loki

$ helm upgrade --install loki loki/loki --set "key1=val1,key2=val2,..."

$ helm upgrade --install loki loki/loki-stack --set grafana.enabled=true,prometheus.enabled=true,prometheus.alertmanager.persistentVolume.enabled=false,prometheus.server.persistentVolume.enabled=false

$ helm upgrade --install loki loki/loki-stack \    --set fluent-bit.enabled=true,promtail.enabled=false,grafana.enabled=true,prometheus.enabled=true,prometheus.alertmanager.persistentVolume.enabled=false,prometheus.server.persistentVolume.enabled=false

$ helm install stable/grafana -n loki-grafana

$ kubectl get secret --namespace  loki-grafana -o jsonpath="{.data.admin-password}" | base64 --decode ; echo

$ kubectl port-forward --namespace  service/loki-grafana 3000:80

loki:  serviceScheme: https  user: user  password: pass

apiVersion: extensions/v1beta1kind: Ingressmetadata:  annotations:    kubernetes.io/ingress.class: {{ .Values.ingress.class }}    ingress.kubernetes.io/auth-type: "basic"ingress.kubernetes.io/auth-secret: {{ .Values.ingress.basic.secret }}  name: lokispec:  rules:  - host: {{ .Values.ingress.host }}    http:      paths:      - backend:          serviceName: loki          servicePort: 3100  tls:  - secretName: {{ .Values.ingress.cert }}    hosts:    - {{ .Values.ingress.host }}

$ wget https://raw.githubusercontent.com/grafana/loki/v1.5.0/cmd/loki/loki-local-config.yaml -O loki-config.yaml$ docker run -v $(pwd):/mnt/config -p 3100:3100 grafana/loki:1.5.0 -config.file=/mnt/config/loki-config.yaml$ wget https://raw.githubusercontent.com/grafana/loki/v1.5.0/cmd/promtail/promtail-docker-config.yaml -O promtail-config.yaml$ docker run -v $(pwd):/mnt/config -v /var/log:/var/log grafana/promtail:1.5.0 -config.file=/mnt/config/promtail-config.yaml

$ wget https://raw.githubusercontent.com/grafana/loki/v1.5.0/production/docker-compose.yaml -O docker-compose.yaml$ docker-compose -f docker-compose.yaml up

$ git clone https://github.com/grafana/loki $GOPATH/src/github.com/grafana/loki

$ cd $GOPATH/src/github.com/grafana/loki$ make loki
# ./cmd/loki/loki 目录下面将会生成最终的二进制文件。

$ go get github.com/grafana/loki/cmd/logcli

$ export LOKI_ADDR=https://logs-us-west1.grafana.net$ export LOKI_USERNAME=$ export LOKI_PASSWORD=

$ export LOKI_ADDR=http://localhost:3100

$ logcli labels jobhttps://logs-dev-ops-tools1.grafana.net/api/prom/label/job/valuescortex-ops/consulcortex-ops/cortex-gw...
$ logcli query '{job="cortex-ops/consul"}'https://logs-dev-ops-tools1.grafana.net/api/prom/query?query=%7Bjob%3D%22cortex-ops%2Fconsul%22%7D&limit=30&start=1529928228&end=1529931828&direction=backward®exp=Common labels: {job="cortex-ops/consul", namespace="cortex-ops"}2018-06-25T12:52:09Z {instance="consul-8576459955-pl75w"} 2018/06/25 12:52:09 [INFO] raft: Snapshot to 475409 complete2018-06-25T12:52:09Z {instance="consul-8576459955-pl75w"} 2018/06/25 12:52:09 [INFO] raft: Compacting logs from 456973 to 465169...
$ logcli series -q --match='{namespace="loki",container_name="loki"}'{app="loki", container_name="loki", controller_revision_hash="loki-57c9df47f4", filename="/var/log/pods/loki_loki-0_8ed03ded-bacb-4b13-a6fe-53a445a15887/loki/0.log", instance="loki-0", job="loki/loki", name="loki", namespace="loki", release="loki", statefulset_kubernetes_io_pod_name="loki-0", stream="stderr"}

$ logcli helpusage: logcli []  [ ...]
A command-line for loki.
Flags:      --help             Show context-sensitive help (also try --help-long and --help-man).      --version          Show application version.  -q, --quiet            Suppress query metadata.      --stats            Show query statistics.  -o, --output=default   Specify output mode [default, raw, jsonl]. raw suppresses log labels and timestamp.  -z, --timezone=Local   Specify the timezone to use when formatting output timestamps [Local, UTC].      --cpuprofile=""    Specify the location for writing a CPU profile.      --memprofile=""    Specify the location for writing a memory profile.      --addr="http://localhost:3100"                         Server address. Can also be set using LOKI_ADDR env var.      --username=""      Username for HTTP basic auth. Can also be set using LOKI_USERNAME env var.      --password=""      Password for HTTP basic auth. Can also be set using LOKI_PASSWORD env var.      --ca-cert=""       Path to the server Certificate Authority. Can also be set using LOKI_CA_CERT_PATH env var.      --tls-skip-verify  Server certificate TLS skip verify.      --cert=""          Path to the client certificate. Can also be set using LOKI_CLIENT_CERT_PATH env var.      --key=""           Path to the client certificate key. Can also be set using LOKI_CLIENT_KEY_PATH env var.      --org-id=""        adds X-Scope-OrgID to API requests for representing tenant ID. Useful for requesting tenant data when                         bypassing an auth gateway.
Commands:  help [...]    Show help.
  query [] <query>    Run a LogQL query.
    The "query" command is useful for querying for logs. Logs can be returned in a few output modes:
      raw: log line      default: log timestamp + log labels + log line      jsonl: JSON response from Loki API of log line
    The output of the log can be specified with the "-o" flag, for example, "-o raw" for the raw output format.
    The "query" command will output extra information about the query and its results, such as the API URL, set of common labels,    and set of excluded labels. This extra information can be suppressed with the --quiet flag.
    While "query" does support metrics queries, its output contains multiple data points between the start and end query time.    This output is used to build graphs, like what is seen in the Grafana Explore graph view. If you are querying metrics and just    want the most recent data point (like what is seen in the Grafana Explore table view), then you should use the "instant-query"    command instead.
  instant-query [] <query>    Run an instant LogQL query.
    The "instant-query" command is useful for evaluating a metric query for a single point in time. This is equivalent to the    Grafana Explore table view; if you want a metrics query that is used to build a Grafana graph, you should use the "query"    command instead.
    This command does not produce useful output when querying for log lines; you should always use the "query" command when you    are running log queries.
    For more information about log queries and metric queries, refer to the LogQL documentation:
    https://grafana.com/docs/loki/latest/logql/
  labels [] []    Find values for a given label.
  series []     Run series query.
$ logcli help queryusage: logcli query [] <query>
Run a LogQL query.
The "query" command is useful for querying for logs. Logs can be returned in a few output modes:
  raw: log line  default: log timestamp + log labels + log line  jsonl: JSON response from Loki API of log line
The output of the log can be specified with the "-o" flag, for example, "-o raw" for the raw output format.
The "query" command will output extra information about the query and its results, such as the API URL, set of common labels, andset of excluded labels. This extra information can be suppressed with the --quiet flag.
While "query" does support metrics queries, its output contains multiple data points between the start and end query time. Thisoutput is used to build graphs, like what is seen in the Grafana Explore graph view. If you are querying metrics and just want themost recent data point (like what is seen in the Grafana Explore table view), then you should use the "instant-query" commandinstead.
Flags:      --help               Show context-sensitive help (also try --help-long and --help-man).      --version            Show application version.  -q, --quiet              Suppress query metadata.      --stats              Show query statistics.  -o, --output=default     Specify output mode [default, raw, jsonl]. raw suppresses log labels and timestamp.  -z, --timezone=Local     Specify the timezone to use when formatting output timestamps [Local, UTC].      --cpuprofile=""      Specify the location for writing a CPU profile.      --memprofile=""      Specify the location for writing a memory profile.      --addr="http://localhost:3100"                           Server address. Can also be set using LOKI_ADDR env var.      --username=""        Username for HTTP basic auth. Can also be set using LOKI_USERNAME env var.      --password=""        Password for HTTP basic auth. Can also be set using LOKI_PASSWORD env var.      --ca-cert=""         Path to the server Certificate Authority. Can also be set using LOKI_CA_CERT_PATH env var.      --tls-skip-verify    Server certificate TLS skip verify.      --cert=""            Path to the client certificate. Can also be set using LOKI_CLIENT_CERT_PATH env var.      --key=""             Path to the client certificate key. Can also be set using LOKI_CLIENT_KEY_PATH env var.      --org-id=""          adds X-Scope-OrgID to API requests for representing tenant ID. Useful for requesting tenant data when                           bypassing an auth gateway.      --limit=30           Limit on number of entries to print.      --since=1h           Lookback window.      --from=FROM          Start looking for logs at this absolute time (inclusive).      --to=TO              Stop looking for logs at this absolute time (exclusive).      --step=STEP          Query resolution step width, for metric queries. Evaluate the query at the specified step over the time                           range.      --interval=INTERVAL  Query interval, for log queries. Return entries at the specified interval, ignoring those between.                           **This parameter is experimental, please see Issue 1779**.      --batch=1000         Query batch size to use until 'limit' is reached.      --forward            Scan forwards through logs.      --no-labels          Do not print any labels.      --exclude-label=EXCLUDE-LABEL ...                           Exclude labels given the provided key during output.      --include-label=INCLUDE-LABEL ...                           Include labels given the provided key during output.      --labels-length=0    Set a fixed padding to labels.      --store-config=""    Execute the current query using a configured storage from a given Loki configuration file.  -t, --tail               Tail the logs.      --delay-for=0        Delay in tailing by number of seconds to accumulate logs for re-ordering.      --colored-output     Show ouput with colored labels.
Args:  <query>  eg '{foo="bar",baz=~".*blip"} |~ ".*error.*"'
$ logcli help labelsusage: logcli labels [] []
Find values for a given label.
Flags:      --help             Show context-sensitive help (also try --help-long and --help-man).      --version          Show application version.  -q, --quiet            Suppress query metadata.      --stats            Show query statistics.  -o, --output=default   Specify output mode [default, raw, jsonl]. raw suppresses log labels and timestamp.  -z, --timezone=Local   Specify the timezone to use when formatting output timestamps [Local, UTC].      --cpuprofile=""    Specify the location for writing a CPU profile.      --memprofile=""    Specify the location for writing a memory profile.      --addr="http://localhost:3100"                         Server address. Can also be set using LOKI_ADDR env var.      --username=""      Username for HTTP basic auth. Can also be set using LOKI_USERNAME env var.      --password=""      Password for HTTP basic auth. Can also be set using LOKI_PASSWORD env var.      --ca-cert=""       Path to the server Certificate Authority. Can also be set using LOKI_CA_CERT_PATH env var.      --tls-skip-verify  Server certificate TLS skip verify.      --cert=""          Path to the client certificate. Can also be set using LOKI_CLIENT_CERT_PATH env var.      --key=""           Path to the client certificate key. Can also be set using LOKI_CLIENT_KEY_PATH env var.      --org-id=""        adds X-Scope-OrgID to API requests for representing tenant ID. Useful for requesting tenant data when                         bypassing an auth gateway.      --since=1h         Lookback window.      --from=FROM        Start looking for labels at this absolute time (inclusive).      --to=TO            Stop looking for labels at this absolute time (exclusive).
Args:  []  The name of the label.
$ logcli help seriesusage: logcli series --match=MATCH []
Run series query.
Flags:      --help             Show context-sensitive help (also try --help-long and --help-man).      --version          Show application version.  -q, --quiet            Suppress query metadata.      --stats            Show query statistics.  -o, --output=default   Specify output mode [default, raw, jsonl]. raw suppresses log labels and timestamp.  -z, --timezone=Local   Specify the timezone to use when formatting output timestamps [Local, UTC].      --cpuprofile=""    Specify the location for writing a CPU profile.      --memprofile=""    Specify the location for writing a memory profile.      --addr="http://localhost:3100"                         Server address. Can also be set using LOKI_ADDR env var.      --username=""      Username for HTTP basic auth. Can also be set using LOKI_USERNAME env var.      --password=""      Password for HTTP basic auth. Can also be set using LOKI_PASSWORD env var.      --ca-cert=""       Path to the server Certificate Authority. Can also be set using LOKI_CA_CERT_PATH env var.      --tls-skip-verify  Server certificate TLS skip verify.      --cert=""          Path to the client certificate. Can also be set using LOKI_CLIENT_CERT_PATH env var.      --key=""           Path to the client certificate key. Can also be set using LOKI_CLIENT_KEY_PATH env var.      --org-id=""        adds X-Scope-OrgID to API requests for representing tenant ID. Useful for requesting tenant data when                         bypassing an auth gateway.      --since=1h         Lookback window.      --from=FROM        Start looking for logs at this absolute time (inclusive).      --to=TO            Stop looking for logs at this absolute time (exclusive).      --match=MATCH ...  eg '{foo="bar",baz=~".*blip"}'

scrape_configs: - job_name: system   pipeline_stages:   static_configs:   - targets:      - localhost     labels:      job: syslog      __path__: /var/log/syslog

{job="syslog"}

scrape_configs: - job_name: system   pipeline_stages:   static_configs:   - targets:      - localhost     labels:      job: syslog      __path__: /var/log/syslog - job_name: system   pipeline_stages:   static_configs:   - targets:      - localhost     labels:      job: apache      __path__: /var/log/apache.log

{job="apache"} <- 显示 job 标签为 apache 的日志{job="syslog"} <- 显示 job 标签为 syslog 的日志{job=~"apache|syslog"} <- 显示 job 标签为 apache 或者 syslog 的日志

scrape_configs: - job_name: system   pipeline_stages:   static_configs:   - targets:      - localhost     labels:      job: syslog      env: dev      __path__: /var/log/syslog - job_name: system   pipeline_stages:   static_configs:   - targets:      - localhost     labels:      job: apache      env: dev      __path__: /var/log/apache.log

{env="dev"} <- 将返回所有带有 env=dev 标签的日志

11.11.11.11 - frank [25/Jan/2000:14:00:01 -0500] "GET /1986.js HTTP/1.1" 200 932 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 GTB6"

- job_name: system   pipeline_stages:      - regex:        expression: "^(?P<ip>\\S+) (?P<identd>\\S+) (?P<user>\\S+) \\[(?P<timestamp>[\\w:/]+\\s[+\\-]\\d{4})\\] \"(?P<action>\\S+)\\s?(?P<path>\\S+)?\\s?(?P<protocol>\\S+)?\" (?P<status_code>\\d{3}|-) (?P<size>\\d+|-)\\s?\"?(?P<referer>[^\"]*)\"?\\s?\"?(?P<useragent>[^\"]*)?\"?$"    - labels:        action:        status_code:   static_configs:   - targets:      - localhost     labels:      job: apache      env: dev      __path__: /var/log/apache.log

action (例如 action="GET", action="POST") status_code (例如 status_code="200", status_code="400")

11.11.11.11 - frank [25/Jan/2000:14:00:01 -0500] "GET /1986.js HTTP/1.1" 200 932 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 GTB6"11.11.11.12 - frank [25/Jan/2000:14:00:02 -0500] "POST /1986.js HTTP/1.1" 200 932 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 GTB6"11.11.11.13 - frank [25/Jan/2000:14:00:03 -0500] "GET /1986.js HTTP/1.1" 400 932 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 GTB6"11.11.11.14 - frank [25/Jan/2000:14:00:04 -0500] "POST /1986.js HTTP/1.1" 400 932 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 GTB6"

{job="apache",env="dev",action="GET",status_code="200"} 11.11.11.11 - frank [25/Jan/2000:14:00:01 -0500] "GET /1986.js HTTP/1.1" 200 932 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 GTB6"{job="apache",env="dev",action="POST",status_code="200"} 11.11.11.12 - frank [25/Jan/2000:14:00:02 -0500] "POST /1986.js HTTP/1.1" 200 932 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 GTB6"{job="apache",env="dev",action="GET",status_code="400"} 11.11.11.13 - frank [25/Jan/2000:14:00:03 -0500] "GET /1986.js HTTP/1.1" 400 932 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 GTB6"{job="apache",env="dev",action="POST",status_code="400"} 11.11.11.14 - frank [25/Jan/2000:14:00:04 -0500] "POST /1986.js HTTP/1.1" 400 932 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 GTB6"

{job="apache"} |= "11.11.11.11"