Grafana 集成

Grafana 是 Loki 的原生可视化平台，提供强大的日志查询和仪表板功能。

数据源配置

添加 Loki 数据源

# 通过 API 配置
curl -X POST http://admin:admin@localhost:3000/api/datasources \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Loki",
    "type": "loki",
    "url": "http://loki:3100",
    "access": "proxy",
    "isDefault": true
  }'

配置文件

# /etc/grafana/provisioning/datasources/loki.yaml
apiVersion: 1

datasources:
  - name: Loki
    type: loki
    access: proxy
    url: http://loki:3100
    jsonData:
      maxLines: 5000
      derivedFields:
        - name: TraceID
          matcherRegex: "trace_id=(\\w+)"
          url: "http://tempo:3100/api/traces/${1}"
          datasourceUid: tempo

Explore 面板

基本查询

# 基础日志查询
{job="nginx"}

过滤查询

# 错误日志
{job="nginx"} |= "error"

# 特定状态码
{job="api"} | json | status >= 500

格式化输出

# 格式化日志行
{job="api"} | json | line_format "[{{.status}}] {{.message}}"

日志面板配置

面板选项

选项	说明
`max lines`	最大显示行数
`wrap`	自动换行
`prettify JSON`	格式化 JSON
`show time`	显示时间戳
`show labels`	显示标签
`deduplicate`	去重

显示设置

# Grafana 面板 JSON
{
  "type": "logs",
  "options": {
    "showLabels": true,
    "showCommonLabels": false,
    "showTime": true,
    "wrapLogMessage": true,
    "prettifyLogMessage": true,
    "enableLogDetails": true,
    "sortOrder": "Descending",
    "dedupStrategy": "none"
  }
}

日志与指标关联

Derived Fields

# 添加派生字段
jsonData:
  derivedFields:
    - name: trace_id
      matcherRegex: "trace_id=([a-zA-Z0-9]+)"
      url: "http://tempo:3100/api/traces/${1}"
      datasourceUid: tempo

    - name: user_id
      matcherRegex: "user_id=(\\d+)"
      url: "http://user-service:8080/users/${1}"

日志链接

# 从指标跳转到日志
grafana变量:
  - name: job
    query: label_values({__name__=~".*"}, job)

仪表板模板

应用日志仪表板

{
  "title": "Application Logs",
  "panels": [
    {
      "title": "Error Logs",
      "type": "logs",
      "gridPos": {"h": 10, "w": 24},
      "options": {
        "showLabels": true,
        "showTime": true,
        "wrapLogMessage": true
      },
      "targets": [
        {
          "expr": "{job=\"myapp\"} |= \"error\"",
          "refId": "A"
        }
      ]
    },
    {
      "title": "Error Rate",
      "type": "timeseries",
      "gridPos": {"h": 8, "w": 12},
      "targets": [
        {
          "expr": "sum by (job) (rate({job=\"myapp\"} |= \"error\"[5m]))",
          "refId": "A"
        }
      ]
    },
    {
      "title": "Log Volume",
      "type": "timeseries",
      "gridPos": {"h": 8, "w": 12},
      "targets": [
        {
          "expr": "sum by (job) (rate({job=\"myapp\"}[5m]))",
          "refId": "A"
        }
      ]
    }
  ]
}

告警仪表板

{
  "title": "Alert Status",
  "panels": [
    {
      "title": "Firing Alerts",
      "type": "stat",
      "targets": [
        {
          "expr": "count(ALERTS{alertstate=\"firing\"})",
          "refId": "A"
        }
      ],
      "options": {
        "colorMode": "background",
        "colorScheme": "thresholds"
      },
      "fieldConfig": {
        "defaults": {
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {"color": "green", "value": null},
              {"color": "yellow", "value": 1},
              {"color": "red", "value": 5}
            ]
          }
        }
      }
    },
    {
      "title": "Alert Details",
      "type": "table",
      "targets": [
        {
          "expr": "ALERTS{alertstate=\"firing\"}",
          "refId": "A",
          "format": "table"
        }
      ]
    }
  ]
}

Loki Explore 功能

日志统计

# 显示日志统计
{job="nginx"} | json | stats

# 显示标签统计
{job="nginx"} | json | label_format service="{{.service}}" | stats

日志流

# 查看日志流
{job="nginx"} | json | stream

# 按标签分组
{job="nginx"} | json | stream | group_by(level)

变量模板

变量配置

{
  "name": "job",
  "type": "query",
  "datasource": "Loki",
  "query": "label_values({job=~\".+\"}, job)",
  "refresh": 2,
  "sort": 1
}

使用变量

{job="$job"}
{job="$job", namespace="$namespace"}
{job=~"$job", env=~"$env"}

下一步

接下来让我们学习集群部署。

👉 集群部署