---
sidebar_label: Loki
doc_id: 67aca3d4-94d8-43b8-b239-28d5a6b9b661
description: >-
  Guide for integrating Loki logging with nullplatform in Kubernetes
  environments, including authentication setup.
keywords:
  - Loki
  - nullplatform
  - Kubernetes
  - logging
  - observability
---

# Integrate Loki

Nullplatform supports Loki as a log provider. This guide explains how to use Loki's capabilities while working with nullplatform.

## Loki Logs

When you set Loki as your logging provider, nullplatform will configure the underlying logging infrastructure of your instances to directly send logs to Loki.

:::info
Currently, the Loki logs integration is available for container-based scopes only (not serverless).
:::

## Configuration for Kubernetes

To configure Loki in your Kubernetes environment, follow these steps:

### 1. Update null-metrics

In the [null-metrics](https://docs.nullplatform.com/docs/scopes-legacy/kubernetes/#metrics) configuration, update the `env` section of the `nullplatform-log-controller` container as follows:

```yaml
env:
  - name: LOKI_LOGS_ENABLED
    value: 'true'
  - name: LOKI_HOST
    value: 'your-loki-host'
  - name: LOKI_PORT
    value: 'your-loki-port'
  - name: LOKI_MATCH_REGEX
    value: 'your-match-regex'  # Optional, defaults to "container.*.application"
  # Choose either username/password OR bearer token for authentication
  - name: LOKI_USER
    valueFrom:
      secretKeyRef:
        name: loki-secret
        key: LOKI_USER
  - name: LOKI_PASSWORD
    valueFrom:
      secretKeyRef:
        name: loki-secret
        key: LOKI_PASSWORD
  # OR
  - name: LOKI_BEARER_TOKEN
    valueFrom:
      secretKeyRef:
        name: loki-secret
        key: LOKI_BEARER_TOKEN
```

### 2. Create a Kubernetes secret

Before applying the `null-metrics` configuration, create a Kubernetes secret named `loki-secret` containing your Loki credentials. Use one of the following templates based on your authentication method:

For username/password authentication:

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: loki-secret
  namespace: nullplatform-tools
type: Opaque
data:
  LOKI_USER: <base64-encoded-username>
  LOKI_PASSWORD: <base64-encoded-password>
```

For bearer token authentication:

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: loki-secret
  namespace: nullplatform-tools
type: Opaque
data:
  LOKI_BEARER_TOKEN: <base64-encoded-token>
```

### Kubernetes agent variables

The following variables can be configured in the Kubernetes agent:

- `LOKI_LOGS_ENABLED`: Set to "true" to enable Loki logging.
- `LOKI_HOST`: The hostname of your Loki server.
- `LOKI_PORT`: The port number for your Loki server.
- `LOKI_MATCH_REGEX`: (Optional) A regex pattern to match log streams. Defaults to "container.*.application" if not set.
- `LOKI_USER`: (Optional) Username for Loki authentication.
- `LOKI_PASSWORD`: (Optional) Password for Loki authentication.
- `LOKI_BEARER_TOKEN`: (Optional) Bearer token for Loki authentication.

Remember to use either the username/password combination or the bearer token for authentication, not both.

## Granting Loki Access to nullplatform

To give Loki access to nullplatform, create the following `nrn` keys:

```json
{
  "loki.host": "<loki-host>",
  "loki.port": "<loki-port>",
  "loki.logKey": "<log-key>" // Optional, defaults to all logs
}
```

Then, depending on your authentication method, add either:

For username/password authentication:
```json
{
  "loki.username": "<loki-username>",
  "loki.password": "<loki-password>"
}
```

OR

For token authentication:
```json
{
  "loki.token": "<loki-token>"
}
```

To configure Loki as the log provider in any branch of NRN, specify:

```json
{
  "global.logProvider": "loki"
}
```