# Loki integration

[Loki](https://grafana.com/oss/loki/) is a horizontally scalable, highly available, multi-tenant log aggregation system inspired by [Prometheus](https://prometheus.io/). With ilert integrated with Loki, log-based triggers, such as error bursts or unusual log patterns, generate alerts sent to on-call responders. These alerts enable focused and contextual escalation workflows, helping teams quickly diagnose and resolve critical issues.

{% hint style="info" %}
You can use our [example prometheus setup](https://github.com/iLert/prometheus-integration-docs) to test the Loki integration 
{% endhint %}

## In ilert <a href="#create-alert-source" id="create-alert-source"></a>

## Create a Loki alert source <a href="#create-alert-source" id="create-alert-source"></a>

1. Go to **Alert sources** -> **Alert sources** and click on **Create new alert source**<br>

<figure><img src="https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M76ygPnS4HUcFSX8ulm%2Fuploads%2FjX0cS4q7woTXKajZmc1W%2FScreenshot%202023-08-28%20at%2010.21.10.png?alt=media&#x26;token=8ef3666b-84eb-4b51-abee-f07303313941" alt=""><figcaption></figcaption></figure>

1. Search for **Loki** in the search field, click on the Loki tile, and click on **Next**. <br>

   <figure><img src="https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M76ygPnS4HUcFSX8ulm%2Fuploads%2FlXzQlJpaTFSR49AZk0xA%2FScreenshot%202023-08-28%20at%2010.24.23.png?alt=media&#x26;token=cffeacb4-57b9-47d4-827d-b0f6b1afd914" alt=""><figcaption></figcaption></figure>
2. Give your alert source a name, optionally assign teams, and click **Next**.
3. Select an **escalation policy** by creating a new one or assigning an existing one.<br>

   <figure><img src="https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M76ygPnS4HUcFSX8ulm%2Fuploads%2FNnuZqONaIhbOf6fn4OkZ%2FScreenshot%202023-08-28%20at%2011.37.47.png?alt=media&#x26;token=8a74f7b5-5bd2-4eea-97fa-1c1dbb041333" alt=""><figcaption></figcaption></figure>
4. Select your [Alert grouping](https://docs.ilert.com/alerting/configure-alerting/alert-sources#alert-grouping) preference and click **Continue setup**. You may click **Do not group alerts** for now and change it later. <br>

   <figure><img src="https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M76ygPnS4HUcFSX8ulm%2Fuploads%2FueugN4JgHn1c90ggFA6u%2FScreenshot%202023-08-28%20at%2011.38.24.png?alt=media&#x26;token=b8009daf-3ca8-4264-a6fa-e42ef7333205" alt=""><figcaption></figcaption></figure>
5. The next page shows additional settings such as customer alert templates or notification prioritiy. Click on **Finish setup** for now.
6. On the final page, a Loki URL will be generated that you will need later in this guide.

<figure><img src="https://3394882078-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M76ygPnS4HUcFSX8ulm%2Fuploads%2FY0dmAnoUNCcvT0UGgmcH%2Fimage.png?alt=media&#x26;token=e0daebba-bfa8-4e88-9c0b-52e1f3156f85" alt=""><figcaption></figcaption></figure>

## In Prometheus Alertmanager  <a href="#create-alert-source" id="create-alert-source"></a>

> In order to be able to use Loki alerts and receive notifications, you need first configure and start alertmanager

1. Install Prometheus Alertmanager in any way that suits your needs. For more information about the alertmanager installation process please visit <https://prometheus.io/docs/alerting/latest/alertmanager/>
2. Configure Alertmanager receivers in order to inform ilert every time there's an alert. In the example below replace the previously created Loki URL:

{% code title="alertmanager.yaml" lineNumbers="true" %}

```yaml
receivers:
  - name: "ilert"
    webhook_configs:
      - url: "<your alert source url here>"
        send_resolved: true
```

{% endcode %}

{% hint style="info" %}
You could also split alert to high and low priority by creating two alert sources accordingly
{% endhint %}

<pre class="language-yaml" data-title="alertmanager.yaml" data-line-numbers><code class="lang-yaml"><strong>receivers:
</strong>  - name: "high-priority"
    webhook_configs:
      # high priority alert source url
      - url: "&#x3C;your high priority alert source url here>"
        send_resolved: true
  - name: "low-priority"
    webhook_configs:
      # low priority alert source url
      - url: "&#x3C;your low priority alert source url here>"
        send_resolved: true
</code></pre>

## In Loki  <a href="#create-alert-source" id="create-alert-source"></a>

1. Install Loki in any way that suits your needs.&#x20;
2. Configure the Loki alert rules in order to trigger alerts regarding the rule expression. For example:

{% code title="loki-alert-rules.yaml" lineNumbers="true" %}

```yaml
groups:
  - name: loki-critical
    rules:
      - alert: stackoverflow
        expr: |
          count_over_time({app=~".+"} |= "StackOverflow" [5m]) > 0
        for: 0m
        labels:
          severity: critical
        annotations:
          summary: StackOverflow alert
          description: "StackOverflow logs found\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
```

{% endcode %}

3. Configure the Loki ruler to send alerts to an external alertmanager and point the alert rules folder:

{% code title="loki-config.yaml" lineNumbers="true" %}

```yaml
ruler:
  alertmanager_url: http://alertmanager:9093
  enable_api: true
  enable_alertmanager_v2: true
  storage:
    type: local
    local:
      directory: /etc/alertmanager
```

{% endcode %}

## FAQ

**Will alerts in ilert be resolved automatically?**

Yes, as soon as the Alertmanager sends a "RESOLVE" event, the associated alert is automatically resolved in ilert.