Why VictoriaLogs Beats Loki: Fast, Low‑Resource Log Management in Kubernetes

VictoriaLogs Overview

VictoriaLogs is a newer log collection and analysis system similar to Grafana Loki but with lower CPU and memory requirements, comparable to how VictoriaMetrics improves on Prometheus.

Why Try VictoriaLogs?

After years of using Loki, concerns about documentation, complexity, and performance (e.g., occasional 504 errors) motivated a comparison, especially since VictoriaLogs now supports a Grafana datasource.

Current Limitations (Beta)

No AWS S3 backend yet (planned for Nov 2024).

Loki RecordingRules not supported (expected Oct‑Nov 2024).

Grafana datasource still in beta, making dashboard creation harder.

Deploying VictoriaLogs with Helm

We install the

victoria-logs-single

chart from the

vm

repository.

$ helm repo add vm https://victoriametrics.github.io/helm-charts/
$ helm repo update
$ helm -n ops-test-vmlogs-ns upgrade --install vlsingle vm/victoria-logs-single

After installation, the pod uses only ~2 mCPU and 14 Mi memory, far less than a comparable Loki stack.

Configuring Promtail

Promtail writes logs in Elasticsearch, ndjson, or Loki format. We add a second client URL pointing to VictoriaLogs, enabling per‑namespace streams via

?_stream_fields=namespace

:

promtail:
  config:
    clients:
      - url: http://atlas-victoriametrics-loki-gateway/loki/api/v1/push
      - url: http://vlsingle-victoria-logs-single-server.ops-test-vmlogs-ns.svc:9428/insert/loki/api/v1/push?_stream_fields=namespace

Logs Flow and Streams

If no stream is specified, logs go to the default

{}

stream. By adding

?_stream_fields=namespace

, each Kubernetes namespace gets its own stream, allowing independent queries.

Resource Comparison

Loki pods collectively consume hundreds of millicores and hundreds of megabytes, while a single VictoriaLogs pod stays under 2 mCPU and 14 Mi memory for the same log volume.

LogsSQL Basics

VictoriaLogs offers a powerful HTTP API. Simple

curl

queries can retrieve logs, streams, and field values. Example to fetch logs containing "error":

$ curl -s localhost:9428/select/logsql/query -d 'query=error' | jq

Results include all extracted fields and stream metadata.

Query Language Features

Filters:

AND

,

OR

,

NOT

.

Time filters:

_time:5m

, date ranges, day/week ranges.

Prefix, case‑insensitive, regex, and IPv4 range filters.

Pipelines:

| rename

,

| delete

,

| extract

,

| stats

,

| top

,

| sort

, etc.

Example: Converting a Loki RecordingRule to LogsSQL

We recreate a Loki rule that calculates average request duration per endpoint. The LogsSQL pipeline extracts JSON fields, parses URLs to obtain the domain, computes averages, filters empty paths, and limits results:

_time:5m | app:="backend-api" AND namespace:="prod-backend-api-ns" |
  unpack_json |
  keep path, duration, _msg, _time |
  extract_regexp "https?://(?P<domain>[^/]+)" |
  stats by(path, domain) avg(duration) avg_duration |
  path:!"" |
  top 10 by (path, avg_duration)

Adding VictoriaLogs as a Sub‑Chart

We extend an existing monitoring chart by adding

victoria-logs-single

as a dependency in

Chart.yaml

and enabling persistent storage:

victoria-logs-single:
  server:
    persistentVolume:
      enabled: true
      storageClassName: gp2-retain
      size: 3Gi

After rebuilding dependencies and reinstalling, the service is reachable at port 9428.

Grafana Datasource Integration

We enable the

victorialogs-datasource

plugin, add it alongside Loki, and configure URLs:

- name: VictoriaLogs
  type: victorialogs-datasource
  access: proxy
  url: http://atlas-victoriametrics-victoria-logs-single-server:9428

Exploring logs in Grafana works, though some panel transformations are still required (field extraction, type conversion, sorting, and time‑series preparation).

Pros and Cons

Runs very fast with minimal resources.

Rich LogsSQL feature set.

Excellent documentation and responsive community.

Own web UI is a plus over Loki.

Beta status means occasional missing features (e.g., S3 backend, RecordingRules).

AI assistants struggle with LogsSQL syntax, but community support is strong.

Original article: https://rtfm.co.ua/en/victorialogs-an-overview-run-in-kubernetes-logsql-and-grafana/