observability
Loki Log Storage Calculator
Calculate Grafana Loki disk, S3 storage, and RAM requirements based on pod count, log rate, compression ratio, and retention period.
Sizing Grafana Loki for Kubernetes
Loki stores logs in two places: an index (labels only) and compressed chunks (raw log lines). This split is what makes Loki dramatically cheaper than Elasticsearch.
Storage Architecture
Raw logs → Promtail/Alloy → Loki Ingester (RAM) → chunks → disk or S3
→ index → BoltDB / DynamoDB / etc.Sizing Formula
compressed_gb_per_day = (pods × log_rate_mb_per_pod) / 1024 / compression_ratio
total_disk = compressed_gb_per_day × retention_days × 1.1S3 Backend Setup (Hetzner)
With the S3 backend, Loki ingesters only keep ~1–2 days of data locally (the "flush window"). Everything else lives in object storage:
storage_config:
aws:
s3: s3://hetzner-fsn1/loki-chunks
endpoint: fsn1.your-objectstorage.comReducing Log Volume
Drop noisy logs at the Promtail/Alloy level before they reach Loki:
pipeline_stages:
- drop:
expression: "health|readiness|liveness"This can cut log volume 30–60% for typical Kubernetes clusters with frequent health check endpoints.
Frequently Asked Questions
How much does Loki compress log data?
Loki uses snappy compression on log chunks before storing them. Typical JSON logs from Kubernetes compress 6–10×. A cluster producing 10 GB/day raw logs will need ~1–2 GB/day of storage.
Should I use S3 backend for Loki?
Yes, for any retention >7 days. With S3 backend (Hetzner Object Storage at €0.0119/GB/mo), you avoid large PVCs and get unlimited retention at low cost. Local disk is simpler for development clusters.
How is Loki different from Elasticsearch for logs?
Loki only indexes log labels (namespace, pod, container) — not the log content. This makes it 5–10× cheaper in storage and RAM. The trade-off: full-text search is slower (scans chunks rather than an inverted index). For Kubernetes log tailing and label-based filtering, Loki is sufficient.
What's the difference between Loki ingester RAM and querier RAM?
Ingesters hold unflushed log chunks in memory (~15 min of data) before writing to disk/S3. Querier RAM is used for executing LogQL queries and caching recent results. For small clusters, a single-binary Loki deployment consolidates both.