ELK Stack vs Loki

Overview

What is being compared

Both are log aggregation stacks. The ELK Stack (Elasticsearch, Logstash, Kibana) indexes every field of every log line for full-text search and analytics. Grafana Loki indexes only log stream labels, not log content, and stores compressed log chunks in object storage.

• What is indexed — Every field of every log line — Stream labels only (pod, namespace, app)
• Storage — Index overhead plus replicas, 3 to 5x raw size — Compressed chunks in S3, about 0.2x raw size
• Query — KQL and Lucene: full-text, regex, fuzzy, aggregations — LogQL: filter by labels, then line filters or metric queries
• Collection — Logstash or Beats — Promtail or the OpenTelemetry Collector
• Operations — Capacity planning, JVM tuning, ILM, snapshots — Much less attention with an S3 backend
• Best at — Free-text search, security analytics (SIEM), compliance — Cheap operational log viewing with Grafana

A log line's life in each stack

The indexing choice decides how a search executes. ELK looks up the answer in an index; Loki narrows by label and then scans the raw lines. Each row is one phase of the same line's life, in order. Yellow marks where a stack spends more storage, compute or upkeep; green marks where it stays light.

> [!WARNING] Only low-cardinality values belong in Loki labels. Request IDs, user IDs or IP addresses as labels create too many streams and overwhelm the index.

> [!TIP] Both pipelines side by side, one search taking each path, and the choice between them play step by step in Visual Explanation below.

More Comparisons topics

• Containers vs Serverless
• EC2 Instance Type Selection
• EC2 vs Lambda
• ECS vs EKS
• ECS vs Lambda Deployment Patterns
• ElastiCache Redis vs Memcached
• Fargate vs EC2 Launch Type
• GitHub Actions vs Jenkins
• GitLab CI vs GitHub Actions
• Grafana vs Kibana
• Helm vs Kustomize
• Jaeger vs Zipkin