Loki

Loki collects logs from your infrastructure without indexing the content, which makes it dramatically cheaper than Elasticsearch-based logging. It's like Elasticsearch for logs, except it doesn't index the full text of every log line. Instead, it indexes only metadata labels (like service name, environment, pod), which makes it dramatically cheaper to run and simpler to operate.

Self-hosting is free under AGPL-3.0. You get the full log aggregation engine, LogQL query language, alerting integration with Grafana, and multi-tenant support. It's designed to run alongside Prometheus (metrics) and Tempo (traces) for the full Grafana observability stack.

Grafana Cloud offers a free tier with 50GB of logs per month, which is generous for small projects. Paid cloud starts at usage-based pricing.

The catch: because Loki doesn't full-text index, searching for a specific string across millions of logs is slower than Elasticsearch. You need to know which labels to filter by first. If your debugging workflow is 'grep for this error message across everything,' Loki will frustrate you. Also, the AGPL license means if you modify Loki and offer it as a service, you must open-source your changes.