How do I connect Grafana Loki logs to Tares?

You connect Grafana Loki logs to Tares by creating a source with the loki connector, giving it your Loki URL and a LogQL query, and marking one label as primary. Tares polls Loki every 5 seconds by default, including Grafana Cloud. You then confirm lines arrive on the Sources page and in Explore.

How it works

The loki connector is a poll connector. taresd runs your LogQL query against Loki on each poll interval and stores the returned log lines as events on the source. The default interval is 5 seconds, and it works with Grafana Cloud as well as your own Loki.

The connector takes these config keys:

• url and query: where Loki is and which streams to select with LogQL.
• bearer_token, or username and password: credentials for Loki.
• tenant_id: the tenant to read for multi-tenant setups.
• match and drop: keep or discard lines.
• key: the entity key for the events.

Every source also carries a labels array. The label marked primary is the key that ties the source’s events to one entity, so a Loki source labeled with the same service as your metrics and alerts lands on the same per-service timeline.

If your logs reach Tares another way, the choice depends on how they travel:

• Docker logs are polled from a running container.
• Vercel log drains are pushed to a source ingest URL.
• OpenTelemetry logs are pushed to Tares over OTLP.

The connectors index describes poll and push modes and shows every way to create a source.

Set it up

1. Open the console and go to Sources → Add source, then pick the loki connector. You can also ask a connected agent to set the source up with its setup tools, or declare it in the catalog YAML or through POST /api/sources.
2. Fill in the Loki url and your LogQL query. Add bearer_token, or username and password, if Loki needs them, and tenant_id if you run multi-tenant Loki. Leave the poll interval at 5 seconds unless you want a different cadence.
3. Add a labels array and mark one entry primary. Use the same label name your other sources use, such as service, so the logs join the same timeline:

labels:
  - { name: service, field: service, primary: true }   # the key
  - { name: env, const: prod }
  - { name: value, field: value, type: number }        # aggregatable in triggers

4. Save the source and check that lines arrive. On the Sources page, look at the source’s health, poll cadence and last ingest. Then open Explore, pick the entity, and confirm the log lines sit on the same clock as your other signals. The source’s Fields tab shows how much of each label field the events cover.

If your logs come from somewhere else

Docker. Create a docker_logs source and name the container from docker ps:

- name: logs
  connector: docker_logs
  poll: 5s
  config:
    container: tares-demo-api-server   # the container name (docker ps)
    labels:
      - { name: service, const: api-server, primary: true }

Vercel. Create a vercel source with a primary project label. Creating it gives you an ingest URL. Point a Vercel log drain at that URL.

OpenTelemetry. Create an otlp source with a primary service label, then set the exporter endpoint on your application:

OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:8787   # OTLP/HTTP → /v1/{logs,traces,metrics}
# or gRPC (otlp-grpc extra): OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317

For each of these, check arrival the same way: Sources page first, then Explore.

What you get

• Loki log lines on the same timeline as your metrics and alerts, keyed by the primary label you chose.
• A source health view with poll cadence and last ingest, so you see right away whether lines are flowing.
• Logs that triggers can watch, and that an agent reads in one correlated read. The Build an AI SRE guide shows how a trigger wakes an agent with metrics, logs and alerts for one service.
• The same setup shape for Docker, Vercel and OpenTelemetry logs, so you can mix log paths under one service label.

When something else fits

• Your logs live in a running container and you do not need Loki in the path: use the docker_logs connector, which tails the container directly.
• Your application already exports OpenTelemetry: send logs straight to Tares with the otlp connector instead of routing them through Loki.
• Your logs come from Vercel: a log drain pushed to a vercel source needs no polling.
• The system you want is not covered by a dedicated connector: the HTTP API connector polls any JSON endpoint, and the webhook connector accepts arbitrary JSON from anything that can POST. The connectors index describes both.

Related