Grafana Loki

Push audit logs to a Grafana Loki instance for querying with LogQL.

Prerequisites

1. A running Loki instance with a push endpoint available (typically at /loki/api/v1/push).
2. Basic auth credentials with permission to push logs to the target tenant.
3. Network connectivity from your deployment to the Loki URL.

Configuration fields

Field	Required	Description
URL	Yes	Your Loki base URL (e.g., https://loki.example.com). The /loki/api/v1/push path is appended automatically.
Username	Yes	Basic auth username.
Password	Yes	Basic auth password.
App Label	No	Sets the app label on log streams (e.g., my-app).
Environment Label	No	Sets the env label (e.g., production, staging).
Service Label	No	Sets the service label (e.g., api).
Anonymous Mode	No	Toggle to send only statistical data (see Anonymous Mode).

How it works

Each audit log is pushed as a Loki stream entry with the following default labels:

• app: mcp-s-db-service
• level: info
• action: the audit log action
• org_id: the organization ID

Any custom labels you configure are merged with these defaults.

Tips

• Labels help you filter and query logs efficiently in Grafana. Keep cardinality low.
• Ensure your credentials have permission to push logs to the correct tenant.
• Test connectivity by running a curl to your Loki endpoint before configuring.

Troubleshooting

• Confirm the tenant and basic auth credentials.
• Check that labels are not over-constraining your queries.

If no logs appear at all, confirm the provider credentials and URL are correct and that outbound egress is allowed. See Log Settings for shared guidance.

Related

• Log Settings: retention, content options, and Anonymous Mode
• Logs: view and search the logs themselves