Chapter 1. Create the LokiStack

Procedure

1. Go to the Operators Installed Operators page. Click the All instances tab.
2. From the Create new drop-down list, select LokiStack.

3. Select YAML view, and then use the following template to create a LokiStack CR:

   apiVersion: loki.grafana.com/v1
   kind: LokiStack
   metadata:
     name: logging-loki
     namespace: openshift-logging
   spec:
     size: 1x.small
     storage:
       schemas:
         - effectiveDate: '2023-10-15'
           version: v13
       secret:
         name: logging-loki-s3
         type: s3
         credentialMode:
     storageClassName: <storage_class_name>
     tenants:
       mode: openshift-logging

   metadata.name

   Use the name logging-loki.

   spec.size

   Specify the deployment size. In the logging 5.8 and later versions, the supported size options for production instances of Loki are 1x.extra-small, 1x.small, or 1x.medium.

   spec.storage.secret.name

   Specify the secret used for your log storage.

   spec.storage.secret.type

   Specify the corresponding storage type.

   spec.storage.secret.credentialMode

   Optional field, logging 5.9 and later. Supported user-configured values are as follows: static is the default authentication mode available for all supported object storage types that use credentials stored in a Secret. token for short-lived tokens retrieved from a credential source. In this mode the static configuration does not contain credentials needed for the object storage. Instead, they are generated during runtime by using a service, which provides shorter-lived credentials and more granular control. This authentication mode is not supported for all object storage types. token-cco is the default value when Loki is running on managed STS mode and using CCO on STS or WIF clusters.

   spec.storageClassName

   Enter the name of a storage class for temporary storage. For best performance, specify a storage class that allocates block storage. Available storage classes for your cluster can be listed by using the oc get storageclasses command.

Procedure

1. Query the actual log ingestion rate at the Loki distributor using Prometheus:

   sum(increase(loki_distributor_bytes_received_total[24h])) / 1024 / 1024 / 1024

   This query returns the total GB ingested per day. The measurement occurs at the Loki distributor, which is the entry point for all logs. Using a 24-hour window provides a more accurate daily average than shorter sampling periods.

2. Compare the result against the sizing table and choose the appropriate size:

   # Example: The query returns 421 GB
   # → Requires 1x.small (500 GB per day capacity)
   #
   # If the value falls between sizes (for example, 550 GB):
   # → Either choose 1x.medium (2 TB per day capacity)
   # → Or choose 1x.small and scale individual components based on observed bottleneck

   When choosing between a larger t-shirt size and scaling individual components, use the observed bottleneck as your guide:

   • If log ingestion is slow or distributors are dropping logs, increase distributor and ingester replicas.
   • If queries are slow but ingestion is working correctly, increase querier and queryFrontend replicas.

   • If both are struggling, move to the next t-shirt size to scale all components proportionally.

     For more information, see LokiStack sizing versus component scaling.

3. Update the LokiStack CR with the new size if needed:

   spec:
     size: 1x.small  # Updated from initial 1x.extra-small

4. Monitor CPU and memory utilization to ensure the deployment is not resource-constrained.

   Note

   Resizing a LokiStack triggers a rolling restart of components. Plan resizing during maintenance windows.