loki-config.yaml

{{- /*gotype: github.com/grafana/loki/operator/internal/manifests/internal/config.Options*/ -}}
---
auth_enabled: true
chunk_store_config:
  chunk_cache_config:
    embedded_cache:
      enabled: true
      max_size_mb: 500
common:
  storage:
    {{- with .ObjectStorage.Azure }}
    azure:
      environment: {{ .Env }}
      container_name: {{ .Container }}
      account_name: ${AZURE_STORAGE_ACCOUNT_NAME}
      {{- if .WorkloadIdentity }}
      use_federated_token: true
      {{- else }}
      account_key: ${AZURE_STORAGE_ACCOUNT_KEY}
      {{- end }}
      {{- with .EndpointSuffix }}
      endpoint_suffix: {{ . }}
      {{- end }}
    {{- end }}
    {{- with .ObjectStorage.GCS }}
    gcs:
      bucket_name: {{ .Bucket }}
    {{- end }}
    {{- with .ObjectStorage.S3 }}
    s3:
      {{- if .STS }}
      bucketnames: {{.Buckets}}
      region: {{.Region}}
      s3forcepathstyle: false
      {{- else }}
      endpoint: {{ .Endpoint }}
      bucketnames: {{ .Buckets }}
      region: {{ .Region }}
      access_key_id: ${AWS_ACCESS_KEY_ID}
      secret_access_key: ${AWS_ACCESS_KEY_SECRET}
      {{- if .ForcePathStyle  }}
      s3forcepathstyle: true
      {{- end}}
      {{- end }}
      {{- with .SSE }}
      {{- if .Type }}
      sse:
        type: {{ .Type }}
        {{- if eq .Type "SSE-KMS" }}
        kms_key_id: {{ .KMSKeyID }}
        {{- with .KMSEncryptionContext }}
        kms_encryption_context: |
          ${AWS_SSE_KMS_ENCRYPTION_CONTEXT}
        {{- end }}
        {{- end}}
      {{- end }}
      {{- end }}
    {{- end }}
    {{- with .ObjectStorage.Swift }}
    swift:
      auth_url: {{ .AuthURL }}
      username: ${SWIFT_USERNAME}
      user_domain_name: {{ .UserDomainName }}
      user_domain_id: {{ .UserDomainID }}
      user_id: {{ .UserID }}
      password: ${SWIFT_PASSWORD}
      domain_id: {{ .DomainID }}
      domain_name: {{ .DomainName }}
      project_id: {{ .ProjectID }}
      project_name: {{ .ProjectName }}
      project_domain_id: {{ .ProjectDomainID }}
      project_domain_name: {{ .ProjectDomainName }}
      region_name: {{ .Region }}
      container_name: {{ .Container }}
    {{- end }}
    {{- with .ObjectStorage.AlibabaCloud}}
    alibabacloud:
      bucket: {{ .Bucket }}
      endpoint: {{ .Endpoint }}
      access_key_id: ${ALIBABA_CLOUD_ACCESS_KEY_ID}
      secret_access_key: ${ALIBABA_CLOUD_ACCESS_KEY_SECRET}
    {{- end }}
  compactor_grpc_address: {{ .Compactor.FQDN }}:{{ .Compactor.Port }}
  {{- with .GossipRing }}
  ring:
    kvstore:
      store: memberlist
    heartbeat_period: 5s
    heartbeat_timeout: 1m
    {{- with .InstanceAddr }}
    instance_addr: {{ . }}
    {{- end }}
    instance_port: {{ .InstancePort }}
    {{- if .EnableInstanceAvailabilityZone }}
    zone_awareness_enabled: true
    instance_availability_zone: ${INSTANCE_AVAILABILITY_ZONE}
    {{- end }}
  {{- end }}
compactor:
  compaction_interval: 2h
  working_directory: {{ .StorageDirectory }}/compactor
{{- if .Retention.Enabled }}{{- with .Retention }}
  retention_enabled: true
  retention_delete_delay: 4h
  retention_delete_worker_count: {{.DeleteWorkerCount}}
{{- end }}{{- end }}
frontend:
  tail_proxy_url: {{ .Querier.Protocol }}://{{ .Querier.FQDN }}:{{ .Querier.Port }}
{{- if .Gates.HTTPEncryption }}
  tail_tls_config:
    tls_cert_path: {{ .TLS.Paths.HTTP.Certificate }}
    tls_key_path: {{ .TLS.Paths.HTTP.Key }}
    tls_ca_path: {{ .TLS.Paths.CA }}
    tls_server_name: {{ .TLS.ServerNames.HTTP.Querier }}
    tls_cipher_suites: {{ .TLS.CipherSuitesString }}
    tls_min_version: {{ .TLS.MinTLSVersion }}
{{- end }}
  compress_responses: true
  max_outstanding_per_tenant: 4096
  log_queries_longer_than: 5s
frontend_worker:
  frontend_address: {{ .FrontendWorker.FQDN }}:{{ .FrontendWorker.Port }}
  grpc_client_config:
    max_send_msg_size: 104857600
{{- if .Gates.GRPCEncryption }}
    tls_enabled: true
    tls_cert_path: {{ .TLS.Paths.GRPC.Certificate }}
    tls_key_path: {{ .TLS.Paths.GRPC.Key }}
    tls_ca_path: {{ .TLS.Paths.CA }}
    tls_server_name: {{ .TLS.ServerNames.GRPC.QueryFrontend }}
    tls_cipher_suites: {{ .TLS.CipherSuitesString }}
    tls_min_version: {{ .TLS.MinTLSVersion }}
{{- end }}
  match_max_concurrent: true
ingester:
  chunk_block_size: 262144
  chunk_encoding: snappy
  chunk_idle_period: 1h
  chunk_retain_period: 5m
  chunk_target_size: 2097152
  flush_op_timeout: 10m
  max_chunk_age: 2h
  lifecycler:
    final_sleep: 0s
    join_after: 30s
    num_tokens: 512
    {{- if .GossipRing.EnableIPv6 }}
    enable_inet6: true
    {{- end}}
    ring:
      replication_factor: {{ .Stack.Replication.Factor }}
  max_transfer_retries: 0
  wal:
    enabled: true
    dir: {{ .WriteAheadLog.Directory }}
    replay_memory_ceiling: {{ .WriteAheadLog.ReplayMemoryCeiling }}
ingester_client:
  grpc_client_config:
    max_recv_msg_size: 67108864
{{- if .Gates.GRPCEncryption }}
    tls_enabled: true
    tls_cert_path: {{ .TLS.Paths.GRPC.Certificate }}
    tls_key_path: {{ .TLS.Paths.GRPC.Key }}
    tls_ca_path: {{ .TLS.Paths.CA }}
    tls_server_name: {{ .TLS.ServerNames.GRPC.Ingester }}
    tls_cipher_suites: {{ .TLS.CipherSuitesString }}
    tls_min_version: {{ .TLS.MinTLSVersion }}
{{- end }}
  remote_timeout: 1s
# NOTE: Keep the order of keys as in Loki docs
# to enable easy diffs when vendoring newer
# Loki releases.
# (See https://grafana.com/docs/loki/latest/configuration/#limits_config)
#
# Values for not exposed fields are taken from the grafana/loki production
# configuration manifests.
# (See https://github.com/grafana/loki/blob/main/production/ksonnet/loki/config.libsonnet)
limits_config:
  ingestion_rate_strategy: global
  ingestion_rate_mb: {{ .Stack.Limits.Global.IngestionLimits.IngestionRate }}
  ingestion_burst_size_mb: {{ .Stack.Limits.Global.IngestionLimits.IngestionBurstSize }}
  max_label_name_length: {{ .Stack.Limits.Global.IngestionLimits.MaxLabelNameLength }}
  max_label_value_length: {{ .Stack.Limits.Global.IngestionLimits.MaxLabelValueLength }}
  max_label_names_per_series: {{ .Stack.Limits.Global.IngestionLimits.MaxLabelNamesPerSeries }}
  reject_old_samples: true
  reject_old_samples_max_age: 168h
  creation_grace_period: 10m
  enforce_metric_name: false
  # Keep max_streams_per_user always to 0 to default
  # using max_global_streams_per_user always.
  # (See https://github.com/grafana/loki/blob/main/pkg/ingester/limiter.go#L73)
  max_streams_per_user: 0
  max_line_size: {{ .Stack.Limits.Global.IngestionLimits.MaxLineSize }}
  max_entries_limit_per_query: {{ .Stack.Limits.Global.QueryLimits.MaxEntriesLimitPerQuery }}
  max_global_streams_per_user: {{ .Stack.Limits.Global.IngestionLimits.MaxGlobalStreamsPerTenant }}
  max_chunks_per_query: {{ .Stack.Limits.Global.QueryLimits.MaxChunksPerQuery }}
  max_query_length: 721h
  max_query_parallelism: 32
  tsdb_max_query_parallelism: 512
  max_query_series: {{ .Stack.Limits.Global.QueryLimits.MaxQuerySeries }}
  cardinality_limit: {{ .Stack.Limits.Global.QueryLimits.CardinalityLimit }}
  max_streams_matchers_per_query: 1000
  query_timeout: {{ .Stack.Limits.Global.QueryLimits.QueryTimeout }}
{{- if .Retention.Enabled }}{{- with .Stack.Limits.Global.Retention }}
  retention_period: {{.Days}}d
{{- with .Streams }}
  retention_stream:
{{- range . }}
  - selector: '{{ .Selector }}'
    priority: {{ .Priority }}
    period: {{ .Days }}d
{{- end }}
{{- end }}
{{- end }}{{- end }}
  max_cache_freshness_per_query: 10m
  per_stream_rate_limit: {{ .Stack.Limits.Global.IngestionLimits.PerStreamRateLimit }}MB
  per_stream_rate_limit_burst: {{ .Stack.Limits.Global.IngestionLimits.PerStreamRateLimitBurst }}MB
  split_queries_by_interval: 30m
{{- with .Stack.Limits.Global.IngestionLimits.PerStreamDesiredRate }}
  shard_streams:
    enabled: true
    desired_rate: {{ . }}MB
{{- end }}
  allow_structured_metadata: true
{{- with .GossipRing }}
memberlist:
  abort_if_cluster_join_fails: true
  {{- with .InstanceAddr }}
  advertise_addr: {{ . }}
  {{- end }}
  advertise_port: {{ .BindPort }}
  bind_port: {{ .BindPort }}
  join_members:
    - {{ .MembersDiscoveryAddr }}:{{ .BindPort }}
  max_join_backoff: 1m
  max_join_retries: 10
  min_join_backoff: 1s
{{- end }}
querier:
  engine:
    max_look_back_period: 30s
  extra_query_delay: 0s
  query_ingesters_within: 3h
  tail_max_duration: 1h
  max_concurrent: {{ .MaxConcurrent.AvailableQuerierCPUCores }}
{{- if .Gates.GRPCEncryption }}
compactor_grpc_client:
  tls_enabled: true
  tls_cert_path: {{ .TLS.Paths.GRPC.Certificate }}
  tls_key_path: {{ .TLS.Paths.GRPC.Key }}
  tls_ca_path: {{ .TLS.Paths.CA }}
  tls_server_name: {{ .TLS.ServerNames.GRPC.Compactor }}
  tls_cipher_suites: {{ .TLS.CipherSuitesString }}
  tls_min_version: {{ .TLS.MinTLSVersion }}
{{- end }}
query_range:
  align_queries_with_step: true
  cache_results: true
  max_retries: 5
  results_cache:
    cache:
      embedded_cache:
        enabled: true
        max_size_mb: 500
  parallelise_shardable_queries: true
schema_config:
  configs:
    {{- $store := .ObjectStorage.SharedStore }}
    {{- range .ObjectStorage.Schemas }}
    - from: "{{ .EffectiveDate }}"
      index:
        period: 24h
        prefix: index_
      object_store: {{ $store }}
      schema: {{ .Version }}
      {{- if or (eq .Version "v11") (eq .Version "v12")}}
      store: boltdb-shipper
      {{- else }}
      store: tsdb
      {{- end}}
    {{- end }}
{{ if .Ruler.Enabled }}
ruler:
  enable_api: true
  enable_sharding: true
  {{- with .Ruler.EvaluationInterval }}
  evaluation_interval: {{ . }}
  {{- end }}
  {{- with .Ruler.PollInterval }}
  poll_interval: {{ . }}
  {{- end }}
  {{- with .Ruler.AlertManager }}
  {{- with .ExternalURL }}
  external_url: {{ . }}
  {{- end}}
  {{- with .ExternalLabels }}
  external_labels:
    {{- range $name, $value := . }}
    {{ $name }}: {{ $value }}
    {{- end }}
  {{- end}}
  alertmanager_url: {{ .Hosts }}
  {{- if .EnableV2 }}
  enable_alertmanager_v2: {{ .EnableV2 }}
  {{- end }}
  {{- if .EnableDiscovery }}
  enable_alertmanager_discovery: {{ .EnableDiscovery }}
  alertmanager_refresh_interval: {{ .RefreshInterval }}
  {{- end }}
  {{- if .QueueCapacity }}
  notification_queue_capacity: {{ .QueueCapacity }}
  {{- end }}
  {{- if .Timeout }}
  notification_timeout: {{ .Timeout }}
  {{- end }}
  {{- if .Notifier }}
  {{- with .Notifier }}
  alertmanager_client:
    {{- if .TLS.CertPath }}
    tls_cert_path: {{ .TLS.CertPath }}
    {{- end }}
    {{- if .TLS.KeyPath }}
    tls_key_path: {{ .TLS.KeyPath }}
    {{- end }}
    {{- if .TLS.CAPath }}
    tls_ca_path: {{ .TLS.CAPath }}
    {{- end }}
    {{- if .TLS.ServerName }}
    tls_server_name: {{ .TLS.ServerName }}
    {{- end }}
    {{- if .TLS.InsecureSkipVerify }}
    tls_insecure_skip_verify: {{ .TLS.InsecureSkipVerify }}
    {{- end }}
    {{- if .TLS.CipherSuites }}
    tls_cipher_suites: {{ .TLS.CipherSuites }}
    {{- end }}
    {{- if .TLS.MinVersion }}
    tls_min_version: {{ .TLS.MinVersion }}
    {{- end }}
    {{- if .BasicAuth.Username }}
    basic_auth_username: {{ .BasicAuth.Username }}
    {{- end }}
    {{- if .BasicAuth.Password }}
    basic_auth_password: {{ .BasicAuth.Password }}
    {{- end }}
    {{- if .HeaderAuth.Type }}
    type: {{ .HeaderAuth.Type }}
    {{- end }}
    {{- if .HeaderAuth.Credentials }}
    credentials: {{ .HeaderAuth.Credentials }}
    {{- end }}
    {{- if .HeaderAuth.CredentialsFile }}
    credentials_file: {{ .HeaderAuth.CredentialsFile }}
    {{- end }}
  {{- end }}
  {{- end }}

  {{- with .RelabelConfigs }}
  alert_relabel_configs:
    {{- range $k, $cfg := . }}
    - {{ if $cfg.SourceLabels}}
      source_labels: {{ $cfg.SourceLabelsString }}
      {{- end }}
      {{- if $cfg.Regex }}
      regex: {{ $cfg.Regex }}
      {{- end }}
      {{- if $cfg.Action }}
      action: {{ $cfg.Action }}
      {{- end }}
      separator: {{ $cfg.SeparatorString }}
      {{- if $cfg.Replacement }}
      replacement: {{ $cfg.Replacement }}
      {{- end }}
      {{- if $cfg.TargetLabel }}
      target_label: {{ $cfg.TargetLabel }}
      {{- end }}
      {{- if $cfg.Modulus }}
      modulus: {{ $cfg.Modulus }}
      {{- end }}
    {{- end }}
  {{- end }}

  {{- if .ForOutageTolerance }}
  for_outage_tolerance: {{ .ForOutageTolerance }}
  {{- end }}
  {{- if .ForGracePeriod }}
  for_grace_period: {{ .ForGracePeriod }}
  {{- end }}
  {{- if .ResendDelay }}
  resend_delay: {{ .ResendDelay }}
  {{- end }}
  {{- end}}
  {{- with .Ruler.RemoteWrite }}
  {{- if .Enabled }}
  remote_write:
    enabled: {{ .Enabled }}
    config_refresh_period: {{ .RefreshPeriod }}
    client:
      {{- with .Client }}
      name: {{ .Name }}
      url: {{ .URL }}
      remote_timeout: {{ .RemoteTimeout }}
      proxy_url: {{ .ProxyURL }}
      follow_redirects: {{ .FollowRedirects }}
      headers:
      {{- range $key, $val := .Headers }}
        "{{ $key }}": "{{ $val }}"
      {{- end }}
      {{- if and .BasicAuthUsername .BasicAuthPassword }}
      basic_auth:
        username: {{ .BasicAuthUsername }}
        password: {{ .BasicAuthPassword }}
      {{- end }}
      {{- if .BearerToken }}
      authorization:
        type: bearer
        credentials: {{ .BearerToken }}
      {{- end }}
      {{- end}}
      {{- with .RelabelConfigs }}
      write_relabel_configs:
        {{- range $k, $cfg := . }}
        - {{- if $cfg.SourceLabels}}
          source_labels: {{ $cfg.SourceLabelsString }}
          {{- end }}
          {{- if $cfg.Regex }}
          regex: {{ $cfg.Regex }}
          {{- end }}
          {{- if $cfg.Action }}
          action: {{ $cfg.Action }}
          {{- end }}
          separator: {{ $cfg.SeparatorString }}
          {{- if $cfg.Replacement }}
          replacement: {{ $cfg.Replacement }}
          {{- end }}
          {{- if $cfg.TargetLabel }}
          target_label: {{ $cfg.TargetLabel }}
          {{- end }}
          {{- if $cfg.Modulus }}
          modulus: {{ $cfg.Modulus }}
          {{- end }}
        {{- end}}
      {{- end }}
      {{- with .Queue }}
      queue_config:
        {{- if .Capacity }}
        capacity: {{ .Capacity }}
        {{- end }}
        {{- if .MaxShards }}
        max_shards: {{ .MaxShards }}
        {{- end }}
        {{- if .MinShards }}
        min_shards: {{ .MinShards }}
        {{- end }}
        {{- if .MaxSamplesPerSend }}
        max_samples_per_send: {{ .MaxSamplesPerSend }}
        {{- end }}
        {{- if .BatchSendDeadline }}
        batch_send_deadline: {{ .BatchSendDeadline }}
        {{- end }}
        {{- if .MinBackOffPeriod }}
        min_backoff: {{ .MinBackOffPeriod }}
        {{- end }}
        {{- if .MaxBackOffPeriod }}
        max_backoff: {{ .MaxBackOffPeriod }}
        {{- end }}
      {{- end }}
  {{- end }}
  {{- end }}
  wal:
    dir: {{ .WriteAheadLog.Directory }}
    truncate_frequency: 60m
    min_age: 5m
    max_age: 4h
  rule_path: {{ .StorageDirectory }}
  storage:
    type: local
    local:
      directory: {{ .Ruler.RulesStorageDirectory }}
  ring:
    kvstore:
      store: memberlist
{{- if .Gates.GRPCEncryption }}
  ruler_client:
    tls_enabled: true
    tls_cert_path: {{ .TLS.Paths.GRPC.Certificate }}
    tls_key_path: {{ .TLS.Paths.GRPC.Key }}
    tls_ca_path: {{ .TLS.Paths.CA }}
    tls_server_name: {{ .TLS.ServerNames.GRPC.Ruler }}
    tls_cipher_suites: {{ .TLS.CipherSuitesString }}
    tls_min_version: {{ .TLS.MinTLSVersion }}
{{- end }}
{{ end }}
{{- if .Gates.HTTPEncryption }}
internal_server:
  enable: true
  http_listen_address: ""
  tls_min_version: {{ .TLS.MinTLSVersion }}
  tls_cipher_suites: {{ .TLS.CipherSuitesString }}
  http_tls_config:
    cert_file: {{ .TLS.Paths.HTTP.Certificate }}
    key_file: {{ .TLS.Paths.HTTP.Key }}
{{- end }}
server:
  graceful_shutdown_timeout: 5s
  grpc_server_min_time_between_pings: '10s'
  grpc_server_ping_without_stream_allowed: true
  grpc_server_max_concurrent_streams: 1000
  grpc_server_max_recv_msg_size: 104857600
  grpc_server_max_send_msg_size: 104857600
  http_listen_port: 3100
  http_server_idle_timeout: {{ .HTTPTimeouts.IdleTimeout }}
  http_server_read_timeout: {{ .HTTPTimeouts.ReadTimeout }}
  http_server_write_timeout: {{ .HTTPTimeouts.WriteTimeout }}
{{- if or .Gates.HTTPEncryption .Gates.GRPCEncryption }}
  tls_min_version: {{ .TLS.MinTLSVersion }}
  tls_cipher_suites: {{ .TLS.CipherSuitesString }}
{{- if .Gates.HTTPEncryption }}
  http_tls_config:
    cert_file: {{ .TLS.Paths.HTTP.Certificate }}
    key_file: {{ .TLS.Paths.HTTP.Key }}
    client_auth_type: RequireAndVerifyClientCert
    client_ca_file: {{ .TLS.Paths.CA }}
{{- end }}
{{- if .Gates.GRPCEncryption }}
  grpc_tls_config:
    cert_file: {{ .TLS.Paths.GRPC.Certificate }}
    key_file: {{ .TLS.Paths.GRPC.Key }}
    client_auth_type: RequireAndVerifyClientCert
    client_ca_file: {{ .TLS.Paths.CA }}
{{- end }}
{{- end }}
  log_level: info
storage_config:
{{- range $_, $ship := .Shippers }}
{{- if eq $ship "boltdb" }}
  boltdb_shipper:
    active_index_directory: {{ $.StorageDirectory }}/index
    cache_location: {{ $.StorageDirectory }}/index_cache
{{- end }}
{{- if eq $ship "tsdb" }}
  tsdb_shipper:
    active_index_directory: {{ $.StorageDirectory }}/tsdb-index
    cache_location: {{ $.StorageDirectory }}/tsdb-cache
{{- end }}
    cache_ttl: 24h
    resync_interval: 5m
    shared_store: {{ $.ObjectStorage.SharedStore }}
    index_gateway_client:
      server_address: dns:///{{ $.IndexGateway.FQDN }}:{{ $.IndexGateway.Port }}
{{- if $.Gates.GRPCEncryption }}
      grpc_client_config:
        tls_enabled: true
        tls_cert_path: {{ $.TLS.Paths.GRPC.Certificate }}
        tls_key_path: {{ $.TLS.Paths.GRPC.Key }}
        tls_ca_path: {{ $.TLS.Paths.CA }}
        tls_server_name: {{ $.TLS.ServerNames.GRPC.IndexGateway }}
        tls_cipher_suites: {{ $.TLS.CipherSuitesString }}
        tls_min_version: {{ $.TLS.MinTLSVersion }}
{{- end }}
{{- end }}
tracing:
  enabled: false
analytics:
  reporting_enabled: {{ .EnableRemoteReporting }}