Monitoring and ObservabilityLogs and AlertingIntermediate60-90 minutesLab

Build a Loki Log Aggregation Starter Lab with Grafana Alloy

Run Grafana's current Loki quickstart as an evaluation Lab, collect generated logs with Grafana Alloy, query them through Grafana, and capture the exact downloaded configuration...

Last reviewed8/19/2026

Loki starter labsGrafana Alloyalert routing and triage

Docker Compose v2Grafana LokiGrafana AlloyGrafanaLogQL

Expected Outcome

A disposable Loki/Grafana/Alloy environment that ingests sample logs, returns ready status from Loki components, and answers LogQL queries through the preconfigured Grafana data source.

Assumptions

A Linux host with Docker Engine and Docker Compose v2.
At least 4 GB of free RAM for the multi-container quickstart.
Network access to Grafana's official GitHub repository and container images.
This is an evaluation Lab, not a production Loki deployment.

Bill of Materials

Grafana Loki's official `examples/getting-started` configuration files.
A browser that can reach the Lab's Grafana and readiness endpoints.
A local directory where the downloaded configuration and hashes can be retained.

Build Steps

Verify the container runtime
Use Docker Compose v2. The old standalone docker-compose executable is not required.
Read-only command: verify target and scope
```
docker --version
docker compose version
```

Download the current official Loki quickstart files

Grafana's current quickstart uses Loki, Grafana Alloy, Grafana, a gateway, MinIO, and generated sample logs. Download the three source files to disk rather than recreating an old BoltDB/Promtail configuration from memory.

Changes system state: review before running

mkdir -p ~/evaluate-loki && cd ~/evaluate-loki
curl -fLo loki-config.yaml https://raw.githubusercontent.com/grafana/loki/main/examples/getting-started/loki-config.yaml
curl -fLo alloy-local-config.yaml https://raw.githubusercontent.com/grafana/loki/main/examples/getting-started/alloy-local-config.yaml
curl -fLo docker-compose.yaml https://raw.githubusercontent.com/grafana/loki/main/examples/getting-started/docker-compose.yaml

Manual or UI step

sha256sum loki-config.yaml alloy-local-config.yaml docker-compose.yaml | tee SOURCE-SHA256SUMS

Read-only command: verify target and scope

docker compose -f docker-compose.yaml config --quiet

Review what the quickstart will run
Inspect the Compose and configuration files before pulling images. The current quickstart is deliberately more complex than a single-binary tutorial because it demonstrates several Loki roles, a gateway, object storage, Alloy collection, and Grafana wiring.
Read-only command: verify target and scope
```
sed -n '1,260p' docker-compose.yaml
sed -n '1,260p' loki-config.yaml
sed -n '1,260p' alloy-local-config.yaml
```
Start the evaluation stack
Bring up the official quickstart unchanged first. Do not add authentication, persistence, or custom retention until the supplied example has proven that your host can run the baseline.
Read-only command: verify target and scope
```
docker compose -f docker-compose.yaml up -d
docker compose -f docker-compose.yaml ps
```
Validate Loki readiness and Alloy
Grafana documents readiness endpoints for the read and write components and an Alloy UI. Wait for the components to converge rather than treating successful container creation as a passing result.
Read-only command: verify target and scope
```
curl -fsS http://127.0.0.1:3101/ready
curl -fsS http://127.0.0.1:3102/ready
curl -I http://127.0.0.1:12345/
```
Query generated logs through Grafana
Open Grafana at http://localhost:3000, select the preconfigured Loki data source in Explore, and run a simple label query such as {container="evaluate-loki-flog-1"}. Then narrow the result to log lines containing an HTTP status field. The exact generated container label can vary with the Compose project name, so confirm it in the label browser if needed.
Capture operational evidence
Record container state and retain a small log sample so the Lab result is reproducible without screenshots alone.
Read-only command: verify target and scope
```
docker compose -f docker-compose.yaml ps > lab-container-state.txt
docker compose -f docker-compose.yaml logs --no-color --tail=200 > lab-stack-tail.log
cat SOURCE-SHA256SUMS
```
Understand the production boundary
Grafana marks the simple scalable deployment mode used by this quickstart as deprecated and scheduled for removal in Loki 4.0. Loki also has no built-in authentication layer. Use this stack to learn ingestion/query concepts; do not publish its ports or copy it directly into production. For a durable deployment, choose the currently recommended deployment mode, authentication boundary, storage, retention, and sizing from the Loki documentation.

Validation

The official Compose configuration parses successfully with Compose v2.
Loki read and write readiness endpoints return ready after convergence.
Grafana Alloy is running and sample logs are being forwarded to Loki.
Grafana Explore can query the preconfigured Loki data source and display generated log lines.
The exact downloaded configuration hashes are retained with the Lab evidence.
The operator can explain why this quickstart is not a production deployment template.

Troubleshooting

If a readiness endpoint is not ready immediately, inspect component logs and allow the documented startup convergence period before changing configuration.
Read-only command: verify target and scope
```
docker compose -f docker-compose.yaml ps
docker compose -f docker-compose.yaml logs --tail=150 read write backend gateway alloy
```
If Grafana has no logs, confirm the Loki data source exists, Alloy is running, and the generated `flog` container is producing records before modifying LogQL queries.
If the downloaded example changes and no longer matches this Lab, use Grafana's current quickstart as the source of truth and update the retained files/hashes rather than restoring old BoltDB Shipper or Promtail-era configuration.

Cleanup or Rollback

Stop the disposable evaluation stack after preserving any Lab evidence you need.
Read-only command: verify target and scope
```
cd ~/evaluate-loki && docker compose -f docker-compose.yaml down
```
Remove downloaded data/volumes only after confirming nothing from the Lab needs to be retained. Do not apply broad Docker prune commands as generic cleanup.

Next Improvements

Build a single-binary or other currently recommended Loki deployment with explicit authentication and retention if you want a persistent homelab service.
Replace generated logs with a small Grafana Alloy collection path from one real non-sensitive service.
Add recovery, storage-capacity, and upgrade testing before relying on self-hosted logs operationally.

References

Keep Moving

Build on what you just completed

Continue with a related Lab or return to this build path for a different implementation.

Build a Targeted Windows Event Log Collector with PowerShell Create a Homelab Uptime Dashboard with Prometheus, Blackbox Exporter, and Grafana Browse Monitoring and Observability