# ✅ 推荐：低基数标签
{job="api", namespace="production", service="user-service", instance="api-1"}

# ✅ 推荐：有限取值
{environment="prod", tier="frontend", region="us-east"}

# ❌ 避免：高基数标签
{user_id="12345"}              # 用户 ID
{request_id="abc-123"}        # 请求 ID
{timestamp="1705312800"}      # 时间戳
{ip="192.168.1.1"}            # IP 地址

# ❌ 避免：过多标签
{env="prod", app="myapp", ver="1.0", ns="default", pod="xyz", ip="...", host="..."}

# 生产环境存储配置
storage_config:
  aws:
    bucketnames: loki-chunks
    region: us-east-1
    s3forcepathstyle: false
    http_config:
      idle_conn_timeout: 90s
      response_header_timeout: 0s

ingester:
  chunk_target_size: 1572864        # 1.5MB
  chunk_encoding: gzip               # 或 snappy
  max_chunk_age: 1h

ingester:
  wal:
    enabled: true
    dir: /var/loki/wal
    flush_on_shutdown: true

limits_config:
  max_query_parallelism: 32

querier:
  max_outstanding_per_tenant: 4096

# 启用查询缓存
querier:
  query_ingesters_within: 3h

# Promtail 配置优化
client:
  batchwait: 1s
  batchsize: 102400

scrape_configs:
  - job_name: system
    pipeline_stages:
      - docker: {}              # 使用 docker 解析
    relabel_configs:
      - source_labels: ['__meta_kubernetes_pod_label_app']
        target_label: service

# 统一日志格式
# {"timestamp":"2024-01-15T10:00:00Z","level":"info","service":"api","message":"Request processed"}
pipeline_stages:
  - json:
      expressions:
        timestamp: timestamp
        level: level
        service: service
        message: message
  - labels:
      level:
      service:

# 存储容量估算
每日日志量 = 采集速率 × 86400 秒 × 压缩比

示例：
- 10000 logs/s
- 平均日志大小：500 bytes
- 压缩比：10:1
- 保留天数：30

每日日志量 = 10000 × 500 × 86400 / 10 = 43.2 GB
30 天总容量 = 43.2 GB × 30 = 1296 GB ≈ 1.3 TB

# 监控告警
- alert: LokiHighQueryLatency
  expr: histogram_quantile(0.99, sum(rate(loki_query_duration_seconds_bucket[5m])) by (le)) > 5
  for: 10m
  labels:
    severity: warning
  annotations:
    summary: "Loki query latency is high"

- alert: LokiHighMemoryUsage
  expr: (container_memory_usage_bytes{pod=~"loki-.*"}) / (container_spec_memory_limit_bytes{pod=~"loki-.*"}) > 0.9
  for: 5m
  labels:
    severity: warning