Loki and Promtail

Piece	Where	Notes
Loki	infra/monitoring/loki/loki.yml	Listens on 3100, filesystem storage, compose service splick-loki
Promtail	infra/monitoring/promtail/config.yml	Job docker, pushes to http://loki:3100/loki/api/v1/push

Promtail tails containers whose names start with splick-. It parses Spring JSON logs and Kong access logs. The label set is enough to slice by service and trace id. It is not a long-term archive: filesystem retention is whatever the Loki config sets on that VM. Do not promise a year of logs from this stack.

If Loki is down, services still run. You lose search, not the request path. Alert ExporterDown covers a dead scrape target; a dead Loki shows up as empty dashboards. Check the splick-loki container before you restart application services.

Query examples: Log query cookbook.