Administering Keen
Loki
Chapter 10 of 30
Loki
Loki turns log lines matched by a named LogQL query into events, so the logs you already keep can stand as evidence.
| Setting | Purpose |
|---|---|
KEEN_LOKI_ENABLED | Turns the adapter on. |
KEEN_LOKI_BASE_URL | The Loki server. |
KEEN_LOKI_USERNAME, KEEN_LOKI_PASSWORD | Basic authentication. |
KEEN_LOKI_HEADER_NAME, KEEN_LOKI_HEADER_VALUE | Header authentication instead. |
Each collection is a named LogQL query; start with a narrow stream selector and a small time window. Set the normalised source, system, action, outcome and severity fields where appropriate so mapping rules have stable values to match.
The payload retains labels and line; JSON lines also expose json and, where recognised, extracted.
Going deeper: backlogs and catch-up
Initial lookback, maximum query range, overlong-range strategy and catch-up chunks constrain backlog processing. Set catch-up limits according to upstream query capacity and inspect runner errors when a backlog stops advancing.
Inspect and map evidence
Inspect a collected event and use Create mapping from this event. Structured selectors expose the payload that this source actually returns; a useful starting path is labels → job. Action and outcome filters use Keen's normalised event values. Preview matching and non-matching examples.
For file-managed deployments, collection inputs live in config/loki.yml. See the common collection workflow for UI configuration and override behaviour.