Self-Hosted Loki vs Hosted Logging: 4 Tests

Choosing between self-hosted Loki and a hosted logging service comes down to four practical tests: total cost at your actual log volume, the operational time you can dedicate, your retention and compliance needs, and how deeply you already use Grafana. Run those four tests honestly and the right answer usually becomes clear. This article walks through each test, plus the background, costs, and common pitfalls that most comparisons skip.

Formula

The calculator above estimates the storage footprint and raw storage cost of a logging setup. The formulas are:

Storage needed (GB) = Logs per day (GB) × Retention (days)

Monthly storage cost (USD) = Logs per day (GB) × Retention (days) × Cost per GB stored (USD)

Where:

• Logs per day – the volume of raw log data ingested daily, in gigabytes.
• Retention – how long you keep logs, in days.
• Cost per GB stored – the price you pay per gigabyte of stored logs per month (often $0.10–$3.00 for hosted, or the amortized cost of disk for self-hosted).

The calculator gives a rough storage sizing and a direct cost comparison. It does not include transfer costs, request costs, or the labor of running your own cluster.

Worked Example

Using the defaults: 10 GB of logs per day, 30 days retention, and $2.00 per GB per month.

1. Storage needed = 10 GB × 30 days = 300 GB
2. Monthly storage cost = 300 GB × $2.00 = $600.00

So with those inputs, you need 300 GB of storage and would pay $600 per month for storage alone. If you self-host on your own hardware, the $2.00/GB is your amortized disk cost; if you use a hosted service, that is their per-GB price. The real difference is everything else around it.

Background: What Loki Actually Is

Grafana Loki is a log aggregation system designed to be cheap and scalable. Unlike Elasticsearch or Splunk, Loki does not index the full text of every log line. It indexes only labels (like pod name, host, or severity) and stores the raw log content compressed in object storage. Queries then scan the compressed blocks and filter on labels first. That design makes ingestion very cheap per gigabyte, but it shifts the cost to query time: a poorly labeled log stream can make a query scan terabytes.

Hosted logging services (Grafana Cloud, Datadog, Logz.io, etc.) run a similar backend for you, but they wrap it with authentication, dashboards, alerting, and a support team. The trade-off is predictable: you pay a premium per gigabyte, but you avoid running and upgrading the cluster yourself.

Before choosing, understand that “self-hosted Loki� is not one thing. A single-node Loki on a small VM is trivial to run. A highly available multi-zone Loki cluster with replication and long-term storage is a real operations project. The same software can be either a 30-minute setup or a full-time job, depending on scale.

Test 1: Total Cost at Your Real Volume

The first test is pure math. Self-hosted Loki is often described as “free,� but that only means no license fee. You pay for:

• Compute (CPU and RAM for ingesters, queriers, and compactor).
• Storage (object storage like S3, GCS, or MinIO, or local disk).
• Network egress if you use cloud object storage.
• Backups and replication.
• Your time to install, upgrade, patch, and troubleshoot.

Hosted logging bills per ingested gigabyte, plus often a separate charge for retained logs and for queries (in some services). At small volumes (under 5 GB/day), hosted is usually cheaper than the hourly cost of a dedicated VM. At high volumes (100+ GB/day), self-hosted can be dramatically cheaper on raw storage, but only if you already have the infrastructure and the expertise.

Run the calculator above with your real numbers, then add a realistic hourly rate for the time you will spend on maintenance. If that total is higher than the hosted bill, the hosted option wins on cost alone.

Test 2: Operational Time and Team Skills

Loki is not a “set and forget� system. You need to monitor the cluster, watch for slow queries, manage retention policies, and upgrade versions. A single-node setup is fine for a small app, but once you exceed a few hundred GB per day, you will need a multi-node deployment with separate ingesters, queriers, and a compactor. That means:

• Understanding how Loki stores data in object storage.
• Configuring consistent hash rings for ingesters.
• Handling rolling restarts without data loss.
• Tuning chunk sizes and compression.

If you have a dedicated SRE or DevOps engineer who knows distributed systems, self-hosting is feasible. If your team is two developers who also manage the app, hosted logging removes the operational burden entirely. The question is not whether you can run Loki; it is whether you can run it well for the next three years.

Test 3: Retention, Compliance, and Data Residency

Retention is where hosted services get expensive. Most hosted plans include a short default retention (7–30 days) and charge extra for longer periods. If you need to keep logs for 12 months for compliance, the cost multiplies quickly. Self-hosted Loki stores logs in cheap object storage, so long retention is usually just a matter of buying more disk.

Data residency is another hard constraint. If your company must keep logs inside a specific country or on-premises, a hosted service may not offer a region that satisfies the requirement. Self-hosting gives you full control over where data lands. Conversely, if you already run in a public cloud, a hosted service in the same region may be simpler for compliance than running your own cluster.

Also consider access control. Loki supports multi-tenancy, but setting it up securely (with OIDC or LDAP) is your responsibility when self-hosted. Hosted services usually provide SSO and per-user permissions out of the box. If auditors will ask who can read logs, hosted often makes that answer easier.

Test 4: Grafana Integration and Existing Stack

Loki is built by the Grafana team, so it integrates natively with Grafana dashboards. If you already use Grafana for metrics and traces, adding Loki is a natural extension. The query language (LogQL) is similar to PromQL, so your team can learn it quickly. Self-hosted Loki also works with Grafana’s alerting, so you can trigger alerts based on log content.

Hosted logging services often have their own query languages (e.g., Datadog Logs Query, Splunk SPL) and their own dashboards. If you are already locked into one vendor’s ecosystem, adding their logging is simpler than running a separate Loki stack. But if you want to avoid vendor lock-in and keep all observability in one place, self-hosted Loki plus Grafana is a strong combination.

There is also a middle path: Grafana Cloud offers hosted Loki, which gives you the same LogQL and Grafana UI without running the cluster. That is often the best of both worlds if you are willing to pay per gigabyte.

Common Problems and Misconceptions

One common misconception is that Loki is always faster than Elasticsearch. It is not. Loki is optimized for cheap ingestion, not for complex full-text search. If you need to search for a specific string across all logs without labels, Loki will be slow and expensive. Elasticsearch or a hosted service with full-text indexing might be better for that use case.

Another issue is label cardinality. Loki performs best when you have a small set of high-value labels (like namespace, pod, level). If you add a label with a unique value per log line (like a request ID), you create a huge index that slows down queries and increases memory usage. Many new users make this mistake and then blame Loki.

Retention policies in Loki are not immediate. The compactor runs periodically, so logs may remain on disk longer than your retention setting. You need to configure the compactor correctly and monitor its progress. Hosted services handle this for you.

Finally, do not forget about log shipping. Self-hosted Loki requires you to run Promtail (or another agent) on every server or pod. Hosted services usually provide a one-line install for their agent. If you have thousands of nodes, the agent management overhead can be significant.

Costs Beyond the Obvious

Beyond storage, consider these hidden costs:

• Query costs – Hosted services often charge per query or per GB scanned. Self-hosted Loki has no direct query cost, but slow queries consume CPU and memory.
• Transfer costs – If you self-host in a cloud, egress fees for moving logs to object storage can add up. Hosted services include ingestion in their price.
• High availability – A single-node Loki has no redundancy. If you need HA, you need at least three ingesters and three queriers, which triples your compute cost.
• Upgrades – Loki releases new versions regularly. Each upgrade can require configuration changes and downtime. Hosted services upgrade for you.
• Support – When something breaks at 2 AM, who do you call? Self-hosted means you are the support team.

Use the calculator at the top to get the raw storage cost, then add your estimated operational cost. That total is your true self-hosted cost.

Alternatives to Consider

Loki is not the only option. If you need full-text search, consider Elasticsearch (self-hosted or hosted via Elastic Cloud). If you want a simple, low-cost option for small apps, consider using a database table or a simple file-based log rotation. For very high throughput, systems like ClickHouse can store logs efficiently and support SQL queries.

Another alternative is to use a hosted service that is compatible with Loki’s API, such as Grafana Cloud. That gives you the same tooling without the ops work. Some teams also use a hybrid approach: self-host Loki for hot logs (last 7 days) and ship cold logs to a cheaper object storage for long-term archival.

Finally, do not overlook the value of simply reducing log volume. Many teams generate gigabytes of useless debug logs. Implementing structured logging and log levels can cut your volume by 90%, making either choice cheaper.

Frequently Asked Questions

Is Loki really free? Loki is open source and free to use, but you pay for the hardware, storage, and your own time to run it. At small scale, a $5 VM might be enough. At large scale, you need a cluster that costs hundreds of dollars per month in compute alone.

Can I use Loki with Kubernetes? Yes, Loki is designed for Kubernetes. The official Helm chart deploys it easily, and Promtail runs as a DaemonSet to collect logs from every pod. Many hosted services also offer a Kubernetes agent that sends logs to their cloud.

How long does it take to set up self-hosted Loki? A single-node setup with Docker can be done in under an hour. A production-grade HA setup with object storage, replication, and monitoring typically takes a few days of work, plus ongoing maintenance.

Which is better for a small startup? For a small startup with under 10 GB/day, a hosted service is usually the better choice. It costs a predictable monthly fee and frees your engineers to build features. You can always migrate to self-hosted later if your volume grows and you gain the ops expertise.

What happens if I exceed my hosted plan’s retention? Logs are typically deleted automatically after the retention period. If you need longer retention, you must upgrade your plan or export logs to your own storage. Self-hosted Loki gives you full control over retention, but you must configure the compactor correctly.

Can I migrate from self-hosted Loki to hosted, or vice versa? Yes, but it is not trivial. You need to re-configure your log shipping agents and possibly rewrite queries if the hosted service uses a different query language. If you use Grafana Cloud, the migration is easier because LogQL is the same.

Related

• AI Agents vs Traditional Automation: Which Is Safer?
• Valheim 1.0 Crossplay: What Works & What You Buy Twice
• Quordle vs Wordle: Which Word Game Fits You?

in t | Logs per day | GB | 10 | 0 | 100000
in r | Retention | days | 30 | 1 | 3650
in c | Monthly cost per GB stored | USD | 2 | 0 | 100
out storage | Storage needed | GB | t * r | 0
out cost | Monthly storage cost | USD | t * r * c | 2