Cloud logs on Grafana Labs

Types of cloud logs

Fri, 02 Oct 2026 08:47:49 -0500

Types of logs you can collect

Cloud environments produce several kinds of logs:

Application logs: what your code writes out, such as errors, debug statements, and transaction records.
Platform logs: what your managed services record, such as your Kubernetes cluster, App Service, or Cloud Run containers.
Audit logs: who logged in, who changed which configuration, and which API calls were made. Often required for compliance.
Network logs: traffic patterns, such as VPC flow logs that show what’s talking to what.
Service logs: request details, latency, and error responses from load balancers and CDNs.

You probably don’t need all of these at once. Start with application and platform logs to debug production issues, add audit logs if you have compliance requirements, and layer in network and service logs as your practice matures.

Where each type lives

Log type	AWS	Azure	GCP
Application	CloudWatch Logs	Log Analytics	Cloud Logging
Platform	ECS/EKS logs	AKS/App Service	GKE/Cloud Run
Audit	CloudTrail	Activity Logs	Audit Logs
Network	VPC Flow Logs	NSG Flow Logs	VPC Flow Logs
Service	ALB, CloudFront	Load Balancer	Cloud CDN

Questions you can answer

With cloud logs in Grafana, you can answer questions like:

What errors are occurring across my services?
Who accessed what resources and when?
What happened in the 5 minutes before the outage?
Which API calls are failing and why?

Logs collection methods

Fri, 02 Oct 2026 08:47:49 -0500

Collection methods by cloud provider

Your choice depends on log volume, cost, and which log types you need.

Cloud	Method	What it collects
AWS	Firehose	Growing or large CloudWatch log volumes
AWS	Logs with Lambda	ALB, CloudFront, and CloudTrail logs stored in S3; also CloudWatch Logs, VPC Flow Logs, and Kinesis
Azure	Functions	Event-driven from Event Hub
Azure	Alloy	Event Hub with filtering and relabeling
GCP	Alloy + Pub/Sub	The logs your Cloud Logging sink filter selects

AWS logs: Lambda

Fri, 02 Oct 2026 08:47:49 -0500

AWS logs: Lambda

Complexity: Simple | Infrastructure: Serverless | Latency: Event-driven

This is the Logs with Lambda method, which deploys the Lambda Promtail function. The docs recommend it for ALB, CloudFront, and CloudTrail logs stored in S3. You deploy a Lambda function that triggers on events. When the logs are available, Lambda adds labels and forwards them to Grafana Cloud Logs.

Log types collected with Lambda

Log type	Key insights
ALB access logs	Request latency, targets, status codes
CloudFront logs	Edge locations, cache hits
CloudTrail	API activity, audit
CloudWatch Logs	Application events
VPC Flow Logs	Network traffic
Kinesis Data Streams	Streamed log records

Considerations

Event-driven and automatic
Serverless, with no infrastructure to manage
Labels and relabeling configured through environment variables
Cost that scales with log volume

Documentation

View the AWS Lambda logs documentation.

AWS logs: Firehose

Fri, 02 Oct 2026 08:47:49 -0500

AWS logs: Firehose

Complexity: Moderate | Infrastructure: Managed | Latency: Buffered (60s default)

You configure a subscription filter on your CloudWatch log group that sends logs to an Amazon Data Firehose stream. The stream batches the logs and delivers them to Grafana Cloud, with built-in retry and error handling. AWS handles the scaling.

CloudWatch logs collected with Firehose

Log type	Source	Key insights
CloudWatch Logs	Applications, services	Application events, errors
RDS Instance Logs	Database instances	Query logs, slow queries
VPC Flow Logs	Network interfaces	Network traffic, security

Considerations

High-throughput streaming with automatic scaling
Automatic retry and error handling
Native CloudWatch integration
Cost-effective for high log volumes
Buffered delivery; the reference configuration uses a 60-second buffer
Both Firehose and Lambda filter with a CloudWatch subscription filter pattern; Lambda additionally supports relabeling
IAM role setup required, plus Amazon Data Firehose usage cost

Documentation

View the AWS Firehose logs documentation.

Azure logs: Functions

Fri, 02 Oct 2026 08:47:49 -0500

Azure logs: Functions

Complexity: Simple | Infrastructure: Serverless | Latency: Event-driven

Configure diagnostic settings on your Azure resources to stream logs to an Event Hub. An Azure Function triggers when logs arrive and forwards them to Grafana Cloud Logs.

Considerations

Serverless and event-driven
Native Azure integration
Near real-time delivery
Function execution and Event Hub costs

When to use

Event-driven log collection
Serverless architecture
Azure-native teams

Documentation

View the Azure Functions logs documentation.

Azure logs: Grafana Alloy

Fri, 02 Oct 2026 08:47:49 -0500

Azure logs: Grafana Alloy

Complexity: Flexible | Infrastructure: Linux, Windows, or MacOS VM | Latency: Configurable

Azure Monitor streams log data to an Event Hubs namespace with a Kafka endpoint. Alloy pulls the logs using the Kafka protocol and forwards them to Grafana Cloud Logs. Its pipeline can parse, filter, relabel, and enrich logs first. If you already deployed Alloy for metrics, the same deployment can collect logs.

Considerations

Event Hub ingestion over the Kafka protocol
Full processing pipeline for parsing, filtering, and enrichment
Managed identity authentication
One deployment for both metrics and logs
Alloy infrastructure to deploy, maintain, and update
Event Hubs namespace must be Standard or Premium so the Kafka endpoint is available

When to use

Complex processing needs
Event Hub log sources
Combined metrics + logs collection

Documentation

View the Azure Alloy logs documentation.

GCP logs: Alloy + Pub/Sub

Fri, 02 Oct 2026 08:47:49 -0500

GCP logs: Alloy + Pub/Sub

Complexity: Moderate | Infrastructure: Pub/Sub + Alloy | Latency: Streaming

You create a log sink in Cloud Logging with filters that select which logs to export. The sink routes them to a topic in Pub/Sub, Google Cloud’s managed messaging service. Alloy subscribes to the topic, processes the logs, and forwards them to Grafana Cloud Logs. Sink filters let you reduce volume at the source.

Considerations

Log sink filtering to reduce volume
Application Default Credentials for Alloy
Processing pipeline for filtering and relabeling
Alloy infrastructure to deploy, maintain, and update
Pub/Sub cost, plus setup steps

Cloud logs on Grafana Labs

Types of cloud logs

Types of logs you can collect

Where each type lives

Questions you can answer

Logs collection methods

Collection methods by cloud provider

AWS logs: Lambda

AWS logs: Lambda

Log types collected with Lambda

Considerations

Documentation

AWS logs: Firehose

AWS logs: Firehose

CloudWatch logs collected with Firehose

Considerations

Documentation

Azure logs: Functions

Azure logs: Functions

Considerations

When to use

Documentation

Azure logs: Grafana Alloy

Azure logs: Grafana Alloy

Considerations

When to use

Documentation

GCP logs: Alloy + Pub/Sub

GCP logs: Alloy + Pub/Sub

Considerations

Documentation

Logs resources

Resources

Documentation

Blog posts

Community