we’ve been testing out Loki with idea to implement it and help us with logs. We’ve read the official documentation on Grafana website, and configured Promtail to send data to server running Loki as a monolith service and Grafana.
The problem occurs when trying to parse large data of logs (parsing 10GB of logs takes about 25 seconds) so we figured out we need to make Loki work in parallelism, running more queriers. Can we configure Loki to run on a single machine, in monolitic mode, but with multiple queriers to speed up the reading process?
Here is our Promtail configuration on machine sending the data:
- url: http://192.168.xxx.xxx:3100/loki/api/v1/push # concealed for privacy options
- job_name: system
This is the configuration on machine running Loki (currently in monolith mode):
chunk_idle_period: 1h # Any chunk not receiving new logs in this time will be flushed
max_chunk_age: 1h # All chunks will be flushed when they hit this age, default is 1h
chunk_target_size: 1048576 # Loki will attempt to build chunks up to 1.5MB, flushing first if chunk_idle_period or max_chunk_age is reached first
chunk_retain_period: 30s # Must be greater than index read cache TTL if using an index cache (Default index read cache TTL is 5m)
max_transfer_retries: 0 # Chunk transfers disabled
- from: 2020-10-24
cache_ttl: 24h # Can be increased for faster performance over longer query periods, uses more disk space
So, for the testing purposes we tried executing the following command in Loki explorer:
and we get the response, but in between 24-26 seconds. We tried that before adding the split_queries_by_interval attribute (we first tried 24h figuring it will spawn 4 query microprocesses because the timeframe was 4 days long) and that the query will be 4 times faster. Well, I’m writing this because it was not
Are we missing something? Is there a link to some other, more detailed, documentation?