Logs centralizados com Grafana Loki

services:
  loki:
    image: grafana/loki:latest
    restart: always
    volumes:
      - ./loki/config.yml:/etc/loki/config.yml:ro
      - loki_data:/loki
    command: -config.file=/etc/loki/config.yml
    ports:
      - "127.0.0.1:3100:3100"
    networks:
      - monitoring

  promtail:
    image: grafana/promtail:latest
    restart: always
    volumes:
      - ./promtail/config.yml:/etc/promtail/config.yml:ro
      - /var/log:/var/log:ro           # logs do sistema host
      - /var/lib/docker/containers:/var/lib/docker/containers:ro  # logs Docker
    command: -config.file=/etc/promtail/config.yml
    networks:
      - monitoring

volumes:
  loki_data:

# loki/config.yml
auth_enabled: false

server:
  http_listen_port: 3100
  grpc_listen_port: 9096

common:
  instance_addr: 127.0.0.1
  path_prefix: /loki
  storage:
    filesystem:
      chunks_directory: /loki/chunks
      rules_directory: /loki/rules
  replication_factor: 1
  ring:
    kvstore:
      store: inmemory

query_range:
  results_cache:
    cache:
      embedded_cache:
        enabled: true
        max_size_mb: 100

schema_config:
  configs:
    - from: 2024-01-01
      store: tsdb
      object_store: filesystem
      schema: v13
      index:
        prefix: index_
        period: 24h

limits_config:
  retention_period: 30d    # manter logs por 30 dias

compactor:
  working_directory: /loki/compactor
  retention_enabled: true

# promtail/config.yml
server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml    # estado de leitura dos logs

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
  # Logs de containers Docker
  - job_name: docker
    static_configs:
      - targets:
          - localhost
        labels:
          job: docker
          __path__: /var/lib/docker/containers/*/*.log
    pipeline_stages:
      - json:
          expressions:
            stream: stream
            log: log
      - labels:
          stream:
      - output:
          source: log

  # Logs do sistema (syslog, auth, etc.)
  - job_name: syslog
    static_configs:
      - targets:
          - localhost
        labels:
          job: syslog
          host: vps-prod-01
          __path__: /var/log/{syslog,auth.log,kern.log}

# Adicionar datasource Loki via API
curl -X POST http://localhost:3000/api/datasources \
  -H "Content-Type: application/json" \
  -u admin:senha \
  -d '{
    "name": "Loki",
    "type": "loki",
    "url": "http://loki:3100",
    "access": "proxy"
  }'

# Queries LogQL básicas (aba Explore no Grafana):

# Ver todos os logs de um container
{job="docker", container="minha_api"}

# Filtrar por nível de log
{job="docker"} |= "ERROR"

# Regex para padrões específicos
{job="docker"} |~ "exception|traceback|fatal"

# Contar erros por minuto (metric query)
sum(rate({job="docker"} |= "ERROR" [1m])) by (container)

# Ver logs de SSH do sistema
{job="syslog", filename="/var/log/auth.log"} |= "Invalid user"

# Instalar plugin Loki para Docker
docker plugin install grafana/loki-docker-driver:latest --alias loki --grant-all-permissions

# Verificar instalação
docker plugin ls | grep loki

# Configurar como driver padrão: /etc/docker/daemon.json
{
  "log-driver": "loki",
  "log-opts": {
    "loki-url": "http://localhost:3100/loki/api/v1/push",
    "loki-batch-size": "400",
    "loki-external-labels": "host=vps-prod-01,env=production"
  }
}

# Ou por container no docker-compose.yml:
services:
  app:
    logging:
      driver: loki
      options:
        loki-url: "http://loki:3100/loki/api/v1/push"
        loki-external-labels: "service=minha-api,env=production"