OpenShift Container Platform

Configure Loki storage and retention policies

Configure Loki storage and retention policies to control where network flow data is stored and how long it is kept.

Create a secret for Loki storage

Create a secret with cloud storage credentials, such as for Amazon Web Services (AWS), to allow the Loki Operator to access the necessary object store for log persistence.

The Loki Operator supports a few log storage options, such as AWS S3, Google Cloud Storage, Azure, Swift, Minio, OpenShift Data Foundation. The following example shows how to create a secret for AWS S3 storage. The secret created in this example, loki-s3, is referenced in "Creating a LokiStack custom resource". You can create this secret in the web console or CLI.

Procedure

Using the web console, navigate to the Project → All Projects dropdown and select Create Project.
Name the project netobserv-loki and click Create.
Navigate to the Import icon, +, in the top right corner. Paste your YAML file into the editor.

The following shows an example secret YAML file for S3 storage:
```
apiVersion: v1
kind: Secret
metadata:
  name: loki-s3
  namespace: netobserv-loki
stringData:
  access_key_id: QUtJQUlPU0ZPRE5ON0VYQU1QTEUK
  access_key_secret: d0phbHJYVXRuRkVNSS9LN01ERU5HL2JQeFJmaUNZRVhBTVBMRUtFWQo=
  bucketnames: s3-bucket-name
  endpoint: https://s3.eu-central-1.amazonaws.com
  region: eu-central-1
```
where:

metadata.namespace

Specifies the namespace for the Loki S3 secret. While this example uses netobserv-loki, you can use a different namespace for different components.

stringData.access_key_id

Specifies the access key ID for the S3 bucket.

stringData.access_key_secret

Specifies the secret access key for the S3 bucket.

stringData.bucketnames

Specifies the name of the S3 bucket.

stringData.endpoint

Specifies the endpoint URL for the S3 service.

stringData.region

Specifies the AWS region where the bucket is located.

Verification

After you create the secret, you view the secret listed under Workloads → Secrets in the web console.

LokiStack ingestion limits and health alerts

The LokiStack instance includes default ingestion and query limits that can be overridden by administrators to manage performance and prevent system alerts or errors.

You might want to update the ingestion and query limits if you get Loki errors showing up in the Console plugin, or in flowlogs-pipeline logs.

Here is an example of configured limits:

spec:
  limits:
    global:
      ingestion:
        ingestionBurstSize: 40
        ingestionRate: 20
        maxGlobalStreamsPerTenant: 25000
      queries:
        maxChunksPerQuery: 2000000
        maxEntriesLimitPerQuery: 10000
        maxQuerySeries: 3000

For more information about these settings, see "LokiStack API reference".