1
services:
2
  loki:
3
    image: grafana/loki:3.7
4
    container_name: loki
5
    volumes:
6
      - ./loki/loki-config.yaml:/etc/loki/config.yaml
7
      - loki-data:/loki
8
    command: -config.file=/etc/loki/config.yaml
9
    ports:
10
      - "3100:3100"
11
    restart: unless-stopped
12
    healthcheck:
13
      test: ["CMD-SHELL", "wget -q --spider http://localhost:3100/ready || exit 1"]
14
      interval: 10s
15
      timeout: 5s
16
      retries: 5
17

18
  fluent-bit:
19
    image: fluent/fluent-bit:3.0
20
    container_name: fluent-bit
21
    volumes:
22
      - ./fluent-bit/fluent-bit.conf:/fluent-bit/etc/fluent-bit.conf
23
      - /var/log:/var/log:ro                   # 宿主机日志目录
24
      - /var/lib/docker/containers:/var/lib/docker/containers:ro  # Docker 容器日志
25
    ports:
26
      - "2020:2020"   # Fluent Bit 监控端点
27
      - "24224:24224" # Forward 协议端口（供其他服务推送日志）
28
    restart: unless-stopped
29
    depends_on:
30
      loki:
31
        condition: service_healthy
32

33
  # 若选择 Alloy 替代 Fluent Bit
34
  alloy:
35
    image: grafana/alloy:latest
36
    container_name: alloy
37
    volumes:
38
      - ./alloy/config.alloy:/etc/alloy/config.alloy
39
      - /var/log:/var/log:ro
40
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
41
      - /run/systemd/journal:/run/systemd/journal:ro  # systemd journal
42
    user: "0:0"        # 需要 root 权限读取系统日志
43
    restart: unless-stopped
44
    depends_on:
45
      loki:
46
        condition: service_healthy
47

48
  grafana:
49
    image: grafana/grafana:latest
50
    container_name: grafana
51
    volumes:
52
      - ./grafana/datasources:/etc/grafana/provisioning/datasources
53
      - grafana-data:/var/lib/grafana
54
    environment:
55
      - GF_SECURITY_ADMIN_USER=admin
56
      - GF_SECURITY_ADMIN_PASSWORD=changeme
57
    ports:
58
      - "3000:3000"
59
    restart: unless-stopped
60
    depends_on:
61
      - loki
62

63
volumes:
64
  loki-data:
65
  grafana-data:

1
auth_enabled: false
2

3
server:
4
  http_listen_port: 3100
5

6
common:
7
  path_prefix: /loki
8
  storage:
9
    filesystem:
10
      chunks_directory: /loki/chunks
11
      rules_directory: /loki/rules
12
  replication_factor: 1
13
  ring:
14
    kvstore:
15
      store: inmemory
16

17
schema_config:
18
  configs:
19
    - from: 2024-01-01
20
      store: tsdb
21
      object_store: filesystem
22
      schema: v13
23
      index:
24
        prefix: index_
25
        period: 24h
26

27
limits_config:
28
  ingestion_rate_mb: 16
29
  ingestion_burst_size_mb: 32
30
  max_streams_per_user: 10000
31
  max_entries_limit_per_query: 5000
32
  reject_old_samples: true
33
  reject_old_samples_max_age: 168h
34
  retention_period: 720h   # 30 天，需与 compactor.retention_enabled 配合使用
35

36
compactor:
37
  working_directory: /loki/compactor
38
  retention_enabled: true
39
  retention_delete_delay: 2h
40
  delete_request_store: filesystem
41

42
query_range:
43
  results_cache:
44
    cache:
45
      embedded_cache:
46
        enabled: true
47
        max_size_mb: 100
48

49
analytics:
50
  reporting_enabled: false

1
[SERVICE]
2
    Flush        1
3
    Log_Level    info
4
    Daemon       off
5
    Parsers_File parsers.conf
6

7
# ---- 系统日志 ----
8
[INPUT]
9
    Name         tail
10
    Path         /var/log/syslog
11
    Tag          system.syslog
12
    Parser       syslog-rfc3164
13
    Mem_Buf_Limit 5MB
14
    Skip_Long_Lines On
15

16
[INPUT]
17
    Name         tail
18
    Path         /var/log/auth.log
19
    Tag          system.auth
20
    Mem_Buf_Limit 5MB
21

22
# ---- Docker 容器日志 ----
23
[INPUT]
24
    Name         tail
25
    Path         /var/lib/docker/containers/*/*.log
26
    Tag          docker.*
27
    Parser       docker
28
    Mem_Buf_Limit 10MB
29
    Skip_Long_Lines On
30

31
# ---- Nginx 访问日志（示例）----
32
[INPUT]
33
    Name         tail
34
    Path         /var/log/nginx/access.log
35
    Tag          nginx.access
36
    Parser       nginx
37
    Mem_Buf_Limit 5MB
38

39
# ---- Nginx 错误日志 ----
40
[INPUT]
41
    Name         tail
42
    Path         /var/log/nginx/error.log
43
    Tag          nginx.error
44
    Mem_Buf_Limit 5MB
45

46
# ---- 输出到 Loki ----
47
[OUTPUT]
48
    Name         loki
49
    Match        *
50
    Host         loki
51
    Port         3100
52
    Labels       job=fluent-bit
53
    Label_keys   service,level
54
    structured_metadata container_id,node_name
55
    Line_format  json
56
    Auto_kubernetes_labels off

1
// ---- 发现日志文件 ----
2
local.file_match "syslog" {
3
    path_targets = [{"__path__" = "/var/log/syslog"}]
4
}
5
local.file_match "auth" {
6
    path_targets = [{"__path__" = "/var/log/auth.log"}]
7
}
8
local.file_match "nginx_access" {
9
    path_targets = [{"__path__" = "/var/log/nginx/access.log"}]
10
}
11
local.file_match "nginx_error" {
12
    path_targets = [{"__path__" = "/var/log/nginx/error.log"}]
13
}
14

15
// ---- Docker 容器日志 ----
16
local.file_match "docker_logs" {
17
    path_targets = [{"__path__" = "/var/lib/docker/containers/*/*.log"}]
18
}
19

20
// ---- systemd journal ----
21
loki.source.journal "journal" {
22
    forward_to    = [loki.write.default.receiver]
23
    relabel_rules = loki.relabel.journal.rules
24
    labels        = {job = "systemd-journal"}
25
}
26

27
loki.relabel "journal" {
28
    rule {
29
        source_labels = ["__journal__systemd_unit"]
30
        target_label  = "unit"
31
    }
32
    rule {
33
        source_labels = ["__journal__hostname"]
34
        target_label  = "host"
35
    }
36
    rule {
37
        source_labels = ["__journal_priority_keyword"]
38
        target_label  = "level"
39
    }
40
}
41

42
// ---- 日志文件采集 ----
43
loki.source.file "system_logs" {
44
    targets    = concat(
45
        local.file_match.syslog.targets,
46
        local.file_match.auth.targets,
47
    )
48
    forward_to = [loki.write.default.receiver]
49
}
50

51
loki.source.file "nginx_logs" {
52
    targets    = concat(
53
        local.file_match.nginx_access.targets,
54
        local.file_match.nginx_error.targets,
55
    )
56
    forward_to = [loki.write.default.receiver]
57
}
58

59
loki.source.file "docker_containers" {
60
    targets    = local.file_match.docker_logs.targets
61
    forward_to = [loki.process.docker_parse.receiver]
62
}
63

64
// ---- Docker JSON 日志解析 ----
65
loki.process "docker_parse" {
66
    stage.json {
67
        expressions = {log = "log", time = "time", stream = "stream"}
68
    }
69
    stage.timestamp {
70
        source = "time"
71
        format = "RFC3339"
72
    }
73
    stage.labels {
74
        values = {stream = ""}
75
    }
76
    forward_to = [loki.write.default.receiver]
77
}
78

79
// ---- 写入 Loki ----
80
loki.write "default" {
81
    endpoint {
82
        url = "http://loki:3100/loki/api/v1/push"
83
    }
84
    external_labels = {agent = "alloy"}
85
}

1
apiVersion: 1
2

3
datasources:
4
  - name: Loki
5
    type: loki
6
    access: proxy
7
    url: http://loki:3100
8
    isDefault: true
9
    editable: true