Lion Cipher Lab
Set up centralized logging with Loki and Grafana
- SOC Analyst / Blue Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Centralizing logs is the foundation of every investigation, but the Elastic Stack asks for a lot of RAM and disk before you have learned anything. Grafana Loki is the lean alternative a huge number of home labs and small SOCs actually run: it indexes only labels and stores the raw lines compressed, so you can keep far more log history on modest hardware. Learning to ship logs with an agent, query them with LogQL, and build a dashboard — for free, on your own box — gives you the same collect-store-query-visualize muscle a SOC analyst uses every shift, at a size you can run at home. It also…
What you'll learn
- what centralized logging is and what Loki does (index labels, store compressed logs cheaply)
- the label-not-full-text tradeoff and how to design labels carefully
- standing up Loki, Promtail, and Grafana with Docker Compose
- shipping logs with Promtail as an agent
- querying logs in Grafana with LogQL (label selectors, |= filters)
- turning logs into metrics with rate and count_over_time
- building a simple panel and dashboard
- where a lightweight log store fits in a home lab or small SOC, and why it is not a SIEM by itself
Steps in this lab
- What centralized logging is, and what Loki is
- The tradeoff: labels, not full text
- Stand it up with Docker Compose
- Ship logs with Promtail
- Connect Grafana to Loki
- Query with LogQL: label selectors and filters
- Turn logs into metrics: rate and count
- Build a panel and a dashboard, and where this fits