Port 3100 is the default HTTP API port for Grafana Loki, a log aggregation system that changed how we think about storing logs. When your applications send logs to Loki, they arrive here. When Grafana queries those logs, the request comes through here. This is where the conversation between your infrastructure and your observability stack happens.
What Loki Does
Loki is a horizontally scalable, multi-tenant log aggregation system.1 It collects logs from your applications, compresses them, and stores them cheaply in object storage like Amazon S3 or Google Cloud Storage.
The key insight: Loki does not index the contents of your logs.2 It indexes only a small set of labels attached to each log stream. When you query, Loki uses those labels to narrow down which chunks to search, then greps through the compressed data.
This sounds like a limitation. It is actually the entire point.
The Problem Loki Solved
Before Loki, if you wanted centralized logging at scale, you ran Elasticsearch. ELK (Elasticsearch, Logstash, Kibana) was powerful. It was also expensive.
Elasticsearch indexes every word in every log line. This creates a comprehensive inverted index that enables fast full-text search across terabytes of data. It also requires substantial resources: a typical ELK cluster handling 50GB of logs per day needs 3 master nodes and 3 data nodes, consuming 18 CPUs, 30GB of RAM, and 1.5TB of storage.3 Monthly costs on cloud providers run $1,500 to $2,000.
For many teams, this created an uncomfortable choice: pay for expensive observability infrastructure, or debug blind when things break at 3am.
Tom Wilkie and the team at Grafana Labs saw this and asked a different question: what if we indexed less?
The Prometheus Philosophy
Loki was introduced at KubeCon Seattle in December 2018.4 The tagline was direct: "Like Prometheus, but for logs."
Prometheus, the de facto standard for cloud-native metrics, had already proven that label-based metadata worked. You could query millions of time series efficiently by filtering on labels like app=nginx or cluster=production. The data model was simple. The operations were predictable.
Wilkie and the Grafana Labs team applied the same philosophy to logs.5 Instead of indexing log content, Loki indexes only the labels attached to each log stream. The raw log lines get compressed (achieving 10:1 to 20:1 compression ratios) and written to object storage.
The result: storing 1TB of logs in S3 with Loki costs under $10/month.6 The same volume in a traditional indexed system exceeds $100/month. Often much more.
How It Works
A Loki deployment has three main components:7
The Agent (Promtail or Grafana Alloy) runs alongside your applications. It tails log files, attaches labels (which pod, which namespace, which application), and pushes log streams to Loki's HTTP API on port 3100.
The Loki Server receives those streams through its /loki/api/v1/push endpoint.8 The Distributor component fans incoming logs out to multiple Ingesters for replication. Ingesters buffer logs in memory, compress them into chunks, and periodically flush those chunks to object storage. A small index maps label combinations to chunk locations.
Grafana queries Loki through the same port 3100. When you search for logs in Grafana, the Query Frontend receives your request, the Querier fetches relevant chunks from storage based on label filters, and the results stream back.
The query language is LogQL, designed to feel familiar to anyone who knows PromQL.9 You start with a label selector: {app="nginx", cluster="production"}. Then you add filters: |= "error" for lines containing "error", or !~ "debug" to exclude lines matching a pattern. LogQL can also aggregate logs into metrics, counting errors per minute or extracting latencies from structured logs.
Port Configuration
Loki uses port 3100 for its HTTP API by default.10 This value was chosen deliberately: it's above 1024, so Loki doesn't require root privileges to bind. Earlier versions defaulted to port 80, which required elevated permissions.
The full port configuration for a production Loki deployment typically includes:11
- 3100 (HTTP) — The main API for log ingestion and queries
- 9096 (gRPC) — Internal communication between Loki components
- 7946 (memberlist) — Gossip protocol for cluster coordination
The IANA registry officially assigns port 3100 to "opcon-xps," an enterprise workload automation service.12 Loki's use is unofficial but ubiquitous. In the real world, if you see port 3100 open, it's almost certainly Loki.
Security Considerations
Loki does not enable authentication by default.13 In a development environment, this is convenient. In production, it means anyone who can reach port 3100 can read your logs.
Production deployments should:
- Place Loki behind a reverse proxy or ingress controller with authentication
- Use TLS for all connections
- Implement network policies to restrict access to trusted sources
- Enable multi-tenancy with the
X-Scope-OrgIDheader for isolation between teams
A notable vulnerability (CVE-2021-36156) allowed directory traversal through the X-Scope-OrgID header in versions up to 2.2.1.14 Crafted header values could access files outside intended paths. This was patched, but it illustrates why Loki should never be exposed directly to untrusted networks.
The Ecosystem
Loki fits into Grafana Labs' observability stack:15
- Prometheus/Mimir for metrics
- Loki for logs
- Tempo for distributed traces
- Grafana for visualization
This combination (often called LGTM) provides correlated observability. A spike in error rates in Prometheus can link directly to the error logs in Loki, which can link to the distributed traces in Tempo showing exactly what failed.
Promtail, the original log collection agent, is now deprecated.16 Grafana Alloy (a vendor-neutral OpenTelemetry Collector distribution) replaces it as the recommended way to ship logs to Loki. Promtail enters long-term support in February 2025 and reaches end-of-life in March 2026.
Related Ports
- Port 3000 — Grafana's default port, the visualization layer that queries Loki
- Port 9090 — Prometheus, Loki's sibling for metrics
- Port 9411 — Jaeger, often used alongside Loki for tracing
- Port 9096 — Loki's gRPC port for internal cluster communication
- Port 9200 — Elasticsearch, the system Loki often replaces
Current Usage
As of 2023, there are over 100,000 active Loki clusters worldwide and more than 1 billion Docker Hub pulls of the Loki image.17 The project has attracted contributions from over 137 contributors and earned more than 20,000 GitHub stars.
Loki is released under the AGPLv3 license. Version 1.0 reached general availability in November 2019.18 The project continues active development, with version 3.x introducing further performance improvements and simplified deployment modes.
Frequently Asked Questions
Was this page helpful?