---
warning: DO NOT CHANGE THIS MANUALLY, THIS IS GENERATED BY https://github.com/duckdb/community-extensions repository, check README there
title: loki
excerpt: |
  DuckDB Community Extensions
  Query Grafana Loki from DuckDB in plain SQL, with label/time/line-filter pushdown into LogQL

extension:
  name: loki
  description: Query Grafana Loki from DuckDB in plain SQL, with label/time/line-filter pushdown into LogQL
  version: 2.0.0
  language: C++
  build: cmake
  license: MIT
  # cpp-httplib + OpenSSL do live HTTP(S) at scan time, which the WebAssembly
  # targets cannot do — exclude them rather than ship a binary that can't connect.
  excluded_platforms: "wasm_mvp;wasm_eh;wasm_threads"
  maintainers:
    - prochac

repo:
  github: prochac/duckdb-loki
  ref: c936b0faaf7819745a6de9dcd5385ca383641a23 # v2.0.0
  # DuckDB 1.5 uses the C++ API from before 2.0, so its builds come from the v1 line.
  variegata: eacf6cbcc15412e42b6f22f4f6e7051a03c626a7 # v1.2.0

docs:
  hello_world: |
    -- Store the Loki endpoint and credentials once with the Secret Manager.
    CREATE SECRET my_loki (
        TYPE loki,
        ENDPOINT 'https://logs-prod.example.net',
        TOKEN 'glc_...'            -- or USERNAME + PASSWORD for basic auth
    );

    -- Query logs in plain SQL. WHERE predicates on promoted label columns, the
    -- timestamp and the log line are translated into a LogQL stream selector,
    -- start/end bounds and line filters; anything else DuckDB applies as a residual.
    SELECT timestamp, level, line
    FROM loki(selector := '{job="api"}', labels := ['level'], secret := 'my_loki')
    WHERE level = 'error'
      AND timestamp >= now() - INTERVAL 2 HOUR
      AND line LIKE '%timeout%';

    -- Or send raw LogQL through untouched with loki_scan():
    SELECT * FROM loki_scan('{job="api"} |= `timeout`', secret := 'my_loki');

    -- Or ATTACH the whole instance and reach logs by name. Loki requires a stream
    -- selector, so always filter on at least one label column.
    ATTACH 'my_loki' AS lk (TYPE loki);
    SELECT timestamp, line FROM lk.public.logs WHERE job = 'api';
  extended_description: |
    `loki` turns a Grafana Loki instance into a first-class, queryable DuckDB data
    source, so you can join your logs against Parquet, CSV, Postgres, or anything
    else DuckDB reads — without ever hand-writing an HTTP request.

    - **`loki(selector := ...)`** — pushdown-driven. SQL `WHERE` filters on promoted
      label columns, `timestamp`, and `line` are translated into the LogQL stream
      selector, `start`/`end` time bounds, and line filters. Untranslatable predicates
      are left as residuals for DuckDB to apply, so results are always correct.
    - **`loki_scan(query := ...)`** — a raw-LogQL escape hatch for full control.
    - **`loki_labels()` / `loki_label_values()` / `loki_series()`** — label discovery
      helpers so the source is explorable and autocompletes well.
    - **`ATTACH '...' AS lk (TYPE loki)`** — Loki as a read-only attached database:
      `lk.<tenant>.logs` (plus `labels` and `series`) with the same pushdown, label
      columns auto-discovered at attach time and refreshable via
      `PRAGMA loki_refresh_labels`. Because Loki refuses a query without a stream
      selector, a scan of `logs` must carry a `WHERE` on at least one label column.

    Connection and auth (bearer token, basic auth, `X-Scope-OrgID` tenant, or arbitrary
    headers) come from DuckDB's Secret Manager with per-call overrides. A
    `CREATE SECRET (TYPE loki, PROVIDER env)` seeds the connection from the standard
    logcli environment variables (`LOKI_ADDR`, `LOKI_BEARER_TOKEN`,
    `LOKI_USERNAME`/`LOKI_PASSWORD`, `LOKI_ORG_ID`), with inline options overriding the
    environment. Results page
    automatically over Loki's per-request entry cap, and projection pushdown skips
    materialising the columns a query doesn't select. Timestamps keep Loki's nanosecond
    resolution (`TIMESTAMP_NS`). See the
    [repository](https://github.com/prochac/duckdb-loki) for full documentation.

extension_star_count: 0
extension_star_count_pretty: 0
extension_download_count: 579
extension_download_count_pretty: 579
image: '/images/community_extensions/social_preview/preview_community_extension_loki.png'
layout: community_extension_doc
---
### Compatibility Matrix

This table covers all DuckDB releases that have not reached [end-of-life](https://duckdb.org/release_calendar), including LTS releases, and shows the 2 most recent patch releases of each. Older patch releases are not listed, but the extension may be available for them as well.

<div class="extension_compatibility_table"></div>

| Platform | 1.4.4 | 1.4.5 | 1.5.5 | 1.5.6 | 2.0.0 |
| :--- | :---: | :---: | :---: | :---: | :---: |
| Linux AMD64 | ❌ | ❌ | ❌ | ✅ | ✅ |
| Linux ARM64 | ❌ | ❌ | ❌ | ✅ | ✅ |
| macOS AMD64 | ❌ | ❌ | ❌ | ❌ | ❌ |
| macOS ARM64 | ❌ | ❌ | ❌ | ✅ | ✅ |
| Windows AMD64 | ❌ | ❌ | ❌ | ✅ | ✅ |
| Windows ARM64 | ❌ | ❌ | ❌ | ❌ | ❌ |
| WebAssembly | ❌ | ❌ | ❌ | ❌ | ❌ |

### Installing and Loading
```sql
INSTALL {{ page.extension.name }} FROM community;
LOAD {{ page.extension.name }};
```

{% if page.docs.hello_world %}
### Example
```sql
{{ page.docs.hello_world }}```
{% endif %}

{% if page.docs.extended_description %}
### About {{ page.extension.name }}
{{ page.docs.extended_description }}
{% endif %}
### Added Functions

<div class="extension_functions_table"></div>

|    function_name    | function_type | description | comment | examples |
|---------------------|---------------|-------------|---------|----------|
| loki                | table         | NULL        | NULL    |          |
| loki_label_values   | table         | NULL        | NULL    |          |
| loki_labels         | table         | NULL        | NULL    |          |
| loki_refresh_labels | pragma        | NULL        | NULL    |          |
| loki_scan           | table         | NULL        | NULL    |          |
| loki_series         | table         | NULL        | NULL    |          |

### Overloaded Functions

<div class="extension_functions_table"></div>

This extension does not add any function overloads.

### Added Types

<div class="extension_types_table"></div>

This extension does not add any types.

### Added Settings

<div class="extension_settings_table"></div>

|      name      |                       description                       | input_type | scope  | aliases | typed_value |
|----------------|---------------------------------------------------------|------------|--------|---------|-------------|
| temp_directory | Set the directory to which temporary files are written. | VARCHAR    | GLOBAL | []      | post.db.tmp |