How do I confirm lines from Grafana Loki logs are arriving in Tares?

Tares shows you Loki lines in two places: the source’s page in the console, and an agent’s read of the service. After you create the Loki source, check its health and last ingest on the Sources page, open Explore for the service, then ask a connected agent to read the same service. If the same lines show up in both, the logs are arriving.

How it works

The Loki connector is a poll connector. taresd queries your Loki instance, including Grafana Cloud, with the LogQL query you set, every 5 seconds by default. Each log line becomes an event in Tares.

The connector takes these fields: url, query, bearer_token, username, password, tenant_id, match, drop and key. Like every connector, it also takes a labels array. The label marked primary is the key that ties the lines to a service, and that key is what puts them on the service’s timeline next to your metrics and alerts.

You can check arrival at three levels:

• The source. The Sources page lists every source with its health, poll cadence and last ingest. A recent last ingest means Tares is pulling lines from Loki.
• The fields. The source’s Fields tab shows each field’s actual coverage, so you can see whether your labels are filled in on the lines that arrived.
• The timeline. Explore merges the service’s metrics, logs and alerts on one clock. What an agent gets from a read is the same correlated timeline.

Set it up

1. Create the source. In the console, go to Sources → Add source, pick the Loki connector and fill the form with your Loki url, your LogQL query and your credentials. You can also ask a connected agent to set it up, or declare it in the catalog YAML. The Connectors page lists all three paths.

2. Add a primary label that names the service, so the lines land on that service’s timeline. The label model looks like this:

labels:
  - { name: service, field: service, primary: true }   # the key
  - { name: env, const: prod }
  - { name: value, field: value, type: number }        # aggregatable in triggers

3. Open the Sources page and find your source. Within a few poll intervals, its health should be good and its last ingest should be recent.

4. Open the source and look at its Fields tab. Check that the labels you set, especially the primary one, have coverage on the lines that arrived.

5. Open Explore and pick the service. Your Loki lines appear on the timeline with that service’s other evidence. Flip to What the agent gets to see the exact text an agent receives.

6. Read the service from an agent. Start Tares and the MCP endpoint, each in its own shell:

tares up
tares mcp        # MCP endpoint on http://127.0.0.1:8788/mcp

7. Connect your MCP client (per-client setup) and ask it about the service, for example: “Use tares: what happened to checkout in the last 15 minutes?” Use the service name from your primary label. The client reads the correlated timeline for that service. If your Loki lines are quoted in the answer, they are arriving and correlating.

What you get

• Proof at the source. The Sources page shows health, cadence and last ingest, so you know the poll works before you look at any lines.
• Proof in the data. The Fields tab tells you whether your labels are populated, and Explore shows the lines themselves on the service’s clock.
• Proof from the agent’s side. A read from your MCP client returns what an agent works from, so you confirm that lines are not only stored but reachable and tied to the right service.
• A foundation for the rest of the loop. Once Loki lines sit on the timeline, the same service key lets triggers and agents use them alongside metrics and alerts, as described in Build an AI SRE.

When something else fits

• If the Sources page shows the source but no recent ingest, review the url, query, credentials and tenant_id on the source, and check that the match and drop filters are not removing every line.
• If you would rather push logs than poll them, the OTLP connector covers anything instrumented with OpenTelemetry, and the Connectors page lists the other options.

Related