Managed Loki Hosting — production-ready from $15 a month
Log aggregation system by Grafana Labs. Deployed on your own dedicated instance in AWS, Azure, or GCP, kept patched, backed up, and monitored by ManageStacks — standard Loki, no lock-in.
Loki on ManageStacks is Grafana Labs' log aggregation system deployed to your own AWS, Azure, or GCP region — priced flat at $29 per instance per month regardless of log volume, with S3-backed object storage, LogQL for querying, and native Grafana integration. Materially cheaper than Splunk, Datadog Logs, or Elastic Cloud for typical log volumes, and your logs stay in your cloud region.
What does Loki do, and why do teams deploy it?
Loki is a horizontally-scalable log aggregation system built by Grafana Labs. Unlike Elasticsearch and Splunk, Loki does not index the full text of your logs — it indexes only the labels (like Prometheus does with metrics), which makes it 10-100x cheaper to run at scale.
The tradeoff is that querying is stream-based, not full-text search — you filter by labels (job, app, level, region) to narrow down which log streams to look at, then grep-style match on the content. For 95% of operational log queries this is exactly the right shape.
Running Loki in production means running the Loki binary + Promtail (or Vector, Fluent Bit) agents on every log-producing host + an object-storage backend for chunks. Sizing the chunk store, tuning the ingester, running compactor jobs for old chunks, and handling multi-tenant setups all take real ops discipline. ManageStacks does it.
- Label-based indexing for 10-100x lower storage cost vs full-text
- LogQL query language — same shape as PromQL for consistency
- Native Grafana integration for exploration and dashboards
- S3-compatible object storage backend for chunks
- Multi-tenant support with per-tenant retention and query limits
- Compatible collectors: Promtail, Vector, Fluent Bit, Fluentd, Logstash
Log aggregation system by Grafana Labs
What does managed Loki hosting cost?
Flat per-app pricing, in your chosen AWS, Azure, or GCP region. No per-user pricing — a busy deployment costs the same as a quiet one.
Starter
Staging and internal tools. Dedicated instance, TLS, daily backups, managed upgrades.
Standard
Production workloads. Adds monitoring, staging environment, region choice, priority support.
Business
High-traffic and compliance workloads. Adds a high-availability replica and same-day support.
24×7 SRE retainer
Round-the-clock on-call across every hosted application, for teams that need a pager answered at 3am.
Self-hosting Loki vs managed — what does it really cost?
The software is free. The engineer-hours are not.
Running it yourself
- Install Loki + Promtail on VMs; configure S3 bucket + chunk store schema by hand
- Size ingester memory, tune chunk targets, run compactor cron jobs
- Integrate Grafana with Loki data source manually
- Build alerting rules via the Ruler; deploy separately
- Handle version upgrades yourself — schema migrations occasionally required
On ManageStacks
- Subscribe through your AWS, Azure, or GCP marketplace
- Loki comes up with S3 chunk store, compactor, Ruler, and Grafana wired in
- Alloy/Promtail collectors ship with pre-built configs for K8s and standard services
- Multi-tenant mode + per-tenant retention available on Business+
- Grafana dashboards + alert rules ship pre-built for common log patterns
Loki on ManageStacks vs the alternatives
How Loki on ManageStacks compares to the two dominant enterprise-log SaaS platforms and Elasticsearch.
| Loki on ManageStacksUs | Datadog Logs | Splunk | Elasticsearch / ELK | |
|---|---|---|---|---|
| Deployment | Managed on your AWS, Azure, or GCP | Vendor-hosted | Vendor-hosted or on-prem | Self-hosted or Elastic Cloud |
| Data residency | Your cloud region | Vendor infrastructure | Vendor infrastructure or yours | Your choice |
| Pricing basis | Flat per instance + S3 storage | Per GB ingested + retained + indexed | Per GB/day | Per node-hour + storage (Elastic Cloud) |
| Indexing model | Label-based (cheap) | Full-text (expensive) | Full-text (expensive) | Full-text (expensive) |
| Open source | Yes (Apache 2.0) | No (proprietary) | No (proprietary) | Yes (SSPL/Elastic License 2.0) |
| Grafana native | Yes | No | No | Yes |
Provisioning, upgrades, backups and monitoring on your team’s plate.
What does running Loki yourself involve?
ManageStacks deploys Loki with S3-backed object storage, Promtail/Alloy collectors for log shipping, native Grafana integration, and pre-built log dashboards. On Business+ we add multi-tenant mode, per-tenant retention, and long-window queries. We handle storage scaling, compactor tuning, and version upgrades.
Loki key numbers
How long from subscribing to a live instance?
Subscribe
Subscribe to ManageStacks through your AWS, Azure, or GCP marketplace.
Provision
Loki spins up with S3 chunk store, compactor, Grafana integration, and pre-built log dashboards — typically 3-5 minutes.
Ship logs
Install Alloy/Promtail/Vector on your log-producing hosts (K8s DaemonSet, systemd unit, or Docker sidecar). Configure labels for job/app/env.
Query + alert
Explore logs in Grafana with LogQL. Set up alert rules via Ruler; route through Alertmanager to Slack/PagerDuty.
When is self-hosting Loki the right answer instead?
“Managed hosting is not always the correct call.”
Self-host when a platform team already runs the infrastructure and on-call rotation to operate Loki at genuinely low marginal cost. Self-host when compliance requires an air-gapped or on-premises deployment that no hosted option can satisfy. And self-host when the deployment depends on heavy customisation with a fast internal build-deploy loop, because an internal release process will beat any managed change process.
For everyone else — teams whose engineers have better things to do than shepherd upgrades — managed hosting is cheaper than the hours it replaces.
Which cloud should Loki run on — AWS, Azure or GCP?
For most workloads, the choice of cloud matters less than proximity: run Loki in the same cloud and region as the applications and data it talks to, because every request between them adds a round trip. The underlying compute performs equivalently across AWS, Azure, and GCP.
In practice, an existing cloud footprint decides it. All plans support all three clouds, and moving regions later is a scheduled migration, not a rebuild.
Deepest managed-service catalog, default when there's no existing footprint
Best fit for teams already on Microsoft 365 or Entra ID
Strongest for data/analytics-adjacent workloads
Every plan supports AWS, Azure, and GCP — region choice included.
Common questions about Loki on ManageStacks
How is this different from Elasticsearch / ELK for logs?
Elasticsearch full-indexes every word in every log line — great for arbitrary text search, expensive at scale. Loki indexes only labels (job, app, level) and grep-scans within the label-selected streams. For 95% of operational queries ("show me all errors from service X in the last hour"), Loki is much cheaper. For forensic search across billions of unindexed lines, Elasticsearch is still better.
How does this compare to Datadog Logs or Splunk?
Datadog Logs is priced per GB ingested + per GB retained + per index; Splunk is priced per GB/day. Both grow expensive fast. ManageStacks Loki is flat $29 per instance with S3-priced storage underneath (~$0.023/GB/month vs Datadog's ~$1-3/GB depending on retention tier). For typical operational logging, Loki on ManageStacks is 10-30x cheaper. Datadog/Splunk win on advanced correlation, ML anomaly detection, and pre-built vendor content.
Can I run Loki alongside Prometheus and Grafana?
Yes — this is the standard deployment. All three run on the same ManageStacks account (either as one bundle or three separate apps). Grafana serves as the single UI: metrics from Prometheus, logs from Loki, correlated on time and labels. Common labels (job, app) let you jump from a metric spike to the correlated logs in one click.
Does ManageStacks handle Loki storage scaling and retention?
Yes. Loki's object-storage backend scales elastically — S3 buckets don't need pre-sizing. Retention is configurable per-tenant (default 30 days, longer on Business+). Compactor jobs consolidate old chunks for efficient long-term storage.
What agents ship logs to Loki?
Promtail is the Grafana Labs default. Vector, Fluent Bit, Fluentd, and Logstash all have Loki output plugins. For Kubernetes, Grafana Agent (now called Alloy) is the recommended collector — runs as a DaemonSet, tails container logs, forwards to Loki.
Can I alert on log patterns?
Yes. Loki's Ruler evaluates LogQL queries as alerting rules (e.g., "rate of error logs > N per second"). Fires through Alertmanager to your notification channels. Same routing as Prometheus alerts.
How is multi-tenancy handled?
Loki supports X-Scope-OrgID header-based tenant isolation. On ManageStacks Business+ we enable multi-tenant mode with per-tenant retention, rate limits, and query limits — useful for shared observability platforms across engineering teams.
What happens if I want to migrate off?
Loki chunks are just S3 objects in a documented format. Copy the bucket to your destination Loki instance and it works. Or export via LogQL query for a specific window. Loki is Apache-2.0 and portable. Migration off is a supported operation.
Run Loki without carrying the pager
Subscribe through your AWS, Azure, or GCP marketplace. We handle provisioning, SSL, monitoring, backups, updates, and security. From $15/mo.