Loki

Ingest serves Loki's push API. Use it as the Loki URL, and pass your ingest key as a bearer token, or as the basic-auth password with any username, the way Grafana Cloud takes a token.

Grafana Alloy

loki.write "simpledatalogs" {
  endpoint {
    url          = "https://edge.simpledatalogs.com/loki/api/v1/push"
    bearer_token = "sdl_sec_…"
  }
}

Promtail

clients:
  - url: https://edge.simpledatalogs.com/loki/api/v1/push
    bearer_token: sdl_sec_…

Vector

sinks:
  simpledatalogs:
    type: loki
    inputs: [app_logs]
    endpoint: https://edge.simpledatalogs.com
    encoding:
      codec: text
    labels:
      app: checkout
    auth:
      strategy: bearer
      token: sdl_sec_…

Fluent Bit

[OUTPUT]
    Name         loki
    Match        *
    Host         edge.simpledatalogs.com
    Port         443
    tls          On
    http_user    any
    http_passwd  sdl_sec_…

Tested with Grafana Alloy 1.5.1, Vector 0.43.1 and Fluent Bit 3.2.2. Promtail sends the same protobuf as Alloy.

• Snappy protobuf (Promtail, Alloy and Vector's default) and JSON both work.
• /api/prom/push and Loki's OTLP path, /otlp/v1/logs, work too.

How entries map

Field	From the entry
message	The line, masked like a text line
level	The first of the level, detected_level, severity or lvl labels or metadata
ts	The entry's time
user_id, device_id	Labels or metadata of those names
event_id	Derived from the time, labels, metadata and line, so a client retry never counts twice
props	Stream labels and structured metadata, masked, up to 90

An empty line without a level is skipped. Success is 204.

Next steps

• Datadog logs and Splunk HEC: other drop-ins.
• Vector and Fluent Bit: ship NDJSON with your own event ids instead.