We are fully embracing LGTM ourselves but this is really interesting. Loki for us has been great, though, so what is better about CH other than maybe sql being more expressive than LogQL?
- substantially better performance on the same hardware, even moreso for larger range queries (multiple days)
- no new query language to learn
- significantly more expressive as you said
- agents for scraping logs use way less CPU (I used to use grafana-agent which used about 80%, vector uses sub 5%)
- very intuitive to manage TTLs - I can keep some logs for 10 years, and some for 1 week based on the event in the JSON
- more compact storage, I didn't check scientifically but CH storage is better compressed at least 4-5x for us
- no running into maximum stream limits - struggled with these even on Grafana Cloud and didn't realise we silently lost a lot of logs
Honestly: why wouldn't you. Loki always felt like a mistake to me. A brand new query language, really counter-intuitive configuration, large ramp-up time for complex queries, lots of arguing about labels/cardinality etc. It all goes away when you drop it. I think logging should not be exotic or behave in unexpected ways.
- substantially better performance on the same hardware, even moreso for larger range queries (multiple days)
- no new query language to learn
- significantly more expressive as you said
- agents for scraping logs use way less CPU (I used to use grafana-agent which used about 80%, vector uses sub 5%)
- very intuitive to manage TTLs - I can keep some logs for 10 years, and some for 1 week based on the event in the JSON
- more compact storage, I didn't check scientifically but CH storage is better compressed at least 4-5x for us
- no running into maximum stream limits - struggled with these even on Grafana Cloud and didn't realise we silently lost a lot of logs
Honestly: why wouldn't you. Loki always felt like a mistake to me. A brand new query language, really counter-intuitive configuration, large ramp-up time for complex queries, lots of arguing about labels/cardinality etc. It all goes away when you drop it. I think logging should not be exotic or behave in unexpected ways.