Skip to main content

Monitoring Nginx Logs with Grafana Alloy and Loki

This guide explains how to collect and forward Nginx access and error logs to Grafana Cloud Loki using Grafana Alloy. Once configured, you’ll be able to view, search, and analyze your Nginx logs directly in Grafana.

1. Prerequisites​

Before proceeding, ensure the following:

  • Grafana Alloy is installed and configured on your server.
  • Your Grafana Cloud Loki endpoint and credentials are already set in the Alloy configuration.
  • Nginx logs are stored in /var/log/nginx/ (default location).
    access_log /var/log/nginx/<app-name>.access.log;
    error_log /var/log/nginx/<app-name>.error.log warn;

for example:

    access_log /var/log/nginx/gobotify.access.log;
    error_log /var/log/nginx/gobotify.error.log warn;

Reload Nginx:

sudo systemctl reload nginx

2. Configure Alloy to Monitor Nginx Logs​

Add alloy user to the adm group, so it can read logs.

sudo usermod -aG adm alloy

Set proper permission so alloy can read logs

sudo chown www-data:adm /var/log/nginx/*.log
sudo chmod 640 /var/log/nginx/*.log

Open your Alloy configuration file:

/etc/alloy/config.alloy

Add the following configuration block to enable Nginx log collection:

local.file_match "nginx_paths" {
  path_targets = [
    { __path__ = "/var/log/nginx/*.log" },
    { __path__ = "/var/log/nginx/*.log.*" },
  ]
  sync_period = "5s"
}

loki.source.file "nginx" {
  targets       = local.file_match.nginx_paths.targets
  tail_from_end = true
  forward_to    = [loki.relabel.add_nginx_labels.receiver]
}

loki.relabel "add_nginx_labels" {
  forward_to = [loki.write.grafana_cloud_loki.receiver]

  rule {
    action       = "replace"
    target_label = "job"
    replacement  = "nginx"
  }
  rule {
    action       = "replace"
    target_label = "service"
    replacement  = "nginx"
  }
  rule {
    action       = "replace"
    target_label = "env"
    replacement  = "dev"
  }
  rule {
    action       = "replace"
    target_label = "instance"
    replacement  = constants.hostname
  }
}

3. Configuration Explanation​

SectionPurpose
local.file_match "nginx_paths"Watches the Nginx log directory and captures both current and rotated log files.
loki.source.file "nginx"Tails the matched log files in real time and streams them to Loki.
loki.relabel "add_nginx_labels"Adds labels such as job, service, and env to help filter and organize logs in Grafana Cloud.

4. Apply the Configuration​

Restart Alloy to apply the changes:

systemctl restart alloy

Confirm that the service is running:

systemctl status alloy

5. Verify Logs in Grafana Cloud​

After restarting, Alloy will begin tailing logs from /var/log/nginx/ and sending them to Grafana Cloud Loki. To verify the setup:

  1. Log in to Grafana Cloud.

  2. Go to Explore → Loki.

  3. Run a basic query to test log ingestion:

    {job="nginx"}

You should start seeing live Nginx access and error logs.

6. Optional: Dashboard and Log Filtering​

Once logs are visible, you can build panels and dashboards using filters such as:

  • {job="nginx", level="error"} – Show only error logs
  • {service="nginx"} |~ "GET" – Filter only GET requests
  • count_over_time({job="nginx"}[5m]) – Count requests over time

You can also correlate Nginx logs with metrics and traces if you’re using Grafana Cloud’s full observability stack (Loki + Prometheus + Tempo).

7. Troubleshooting​

IssuePossible CauseFix
No logs visible in GrafanaWrong file paths or Alloy not restartedDouble-check /var/log/nginx/ and restart Alloy
Old logs not appearingtail_from_end skips already written logsTemporarily set tail_from_end = false to backfill
Logs missing labelsMisconfigured relabel blockVerify label rules and restart Alloy