最佳实践
- 使用静态标签
比如host、application、environment
- 尽可能少使用动态标签
{app=”loki”} |= “level=error” 比 {app=”loki”,level=”error”}快
{app=”loki”} != “level=debug” 会比 {app=”loki”,level!=”debug”} 加载较少的chunks
Too many label value combinations leads to too many streams. The penalties for that in Loki are a large index and small chunks in the store, which in turn can actually reduce performance.
-
标签值必须有清晰的边界值
-
注意动态标签与客户端的适配
-
配置缓存
-
每条日志采集流必须按时间递增顺序采集日志
{job=”syslog”, instance=”host1”} 00:00:00 i’m a syslog!
{job=”syslog”, instance=”host1”} 00:00:02 i’m a syslog!
{job=”syslog”, instance=”host2”} 00:00:01 i’m a syslog! <- Accepted, this is a new stream!
{job=”syslog”, instance=”host1”} 00:00:03 i’m a syslog! <- Accepted, still in order for stream 1
{job=”syslog”, instance=”host2”} 00:00:02 i’m a syslog! <- Accepted, still in order for stream 2 -
Use
chunk_target_size
This was added earlier in the Loki v1.3.0 release, and we’ve been experimenting with it for several months. We have
chunk_target_size: 1536000
in all our environments now. This instructs Loki to try to fill all chunks to a target compressed size of 1.5MB. These larger chunks are more efficient for Loki to process. -
Use
-print-config-stderr
or-log-config-reverse-order