LBAC for data sources Loki requirements
LBAC for data sources is available on Grafana Cloud using a new Loki data source with basic authentication configured.
Grafana dashboards · all subjects
data-source/loki
16 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
LBAC Loki prerequisites - permissions needed
To configure LBAC for Loki, you must have the permission setup to create a Loki tenant in Grafana Cloud and admin data source permissions for Grafana.
LBAC Loki recommended permission strategy
It is recommended to remove all permissions for roles and teams that are not required to access the data source, then grant Admin permission to the data source and add Query permissions only to the teams that need LBAC for data sources rules.
Cloud Access Policy (CAP) configuration for Loki
When creating a Cloud Access Policy for a Loki data source in grafana.com, the CAP must include logs:read permissions and must not include labels rules.
Loki data source basic authentication setup
When setting up a Loki data source with basic authentication for LBAC, use the userID as the username and use the generated Cloud Access Policy token as the password.
LBAC for data sources rules access in Loki
LBAC for data sources rules for a Loki data source can be found and configured in the permissions tab of the Loki data source.
Loki data source overview
Grafana Loki is a set of components that form a fully featured logging stack. It is built around indexing only metadata about logs using labels, similar to Prometheus labels. Log data itself is compressed and stored in chunks in object stores such as S3 or GCS, or locally on a filesystem.
Supported Loki versions
The Loki data source in Grafana supports Loki version 2.9 and later.
Loki data source provisioning basic example
This example shows basic provisioning configuration for a Loki data source: apiVersion: 1, datasources with name 'Loki', type 'loki', access 'proxy', url 'http://localhost:3100', and jsonData with timeout 60 and maxLines 1000.
Loki data source provisioning with basic auth and derived fields
This example shows Loki provisioning with basicAuth enabled (basicAuth: true, basicAuthUser, basicAuthPassword in secureJsonData), and derivedFields configuration. Dollar signs ($) must be escaped as $${} in YAML due to environment variable interpolation. Derived fields can have datasourceUid pointing to internal Grafana data sources (like Jaeger), matcherRegex to extract values, name, url (which will be interpreted as a query for the datasource), and optional urlDisplayLabel for custom display labels.
Loki derived fields configuration
Derived fields in Loki data source provisioning support: datasourceUid (any unique value across defined data source UIDs, for internal links to Grafana data sources), matcherRegex (regex pattern to extract values), name (field name), url (interpreted as query for the datasource or external link), and optional urlDisplayLabel (custom display label for the link).
Loki template variables
Instead of hard-coding details such as server, application, and sensor names in metric queries, you can use template variables. Grafana lists these variables in dropdown select boxes at the top of the dashboard to help change the data displayed.
Loki data source uses LogQL query language
The Loki data source query editor uses LogQL as its query language for creating log and metric queries.
Troubleshoot Loki data source configuration
To troubleshoot configuration and other issues with Loki data source, check the log file located at /var/log/grafana/grafana.log on Unix systems, or in <grafana_install_dir>/data/log on other platforms and manual installations.
Exemplars with Loki logs and derived fields
You can view exemplar trace details from Loki logs in Explore by using regular expressions within Derived fields links for Loki to extract the traceID information. When you expand Loki logs, you can see a traceID property under the Detected fields section.
Usage insights Loki query examples
Example queries for usage insights in Loki: retrieve all logs for a specific datasource with {datasource="gdev-loki",kind="usage_insights"}; display top 10 most common errors for a datasource with topk(10, sum by (error) (count_over_time({kind="usage_insights", datasource="gdev-prometheus"} | json | error != "" [$__interval]))); show evolution of data request count with success/error split using sum by(host) (count_over_time({kind="usage_insights"} | json | eventName="data-request" | error != "" [$__interval])) and sum by(host) (count_over_time({kind="usage_insights"} | json | eventName="data-request" | error = "" [$__interval])).