Weekly Loki Audit Trail Export for Compliance

Compliance reviews ask a simple question, show us the audit events for that week, and Loki's retention window does not wait for the auditor. This blueprint captures the trail on a schedule: every Monday, io.kestra.plugin.grafana.loki.QueryRange fetches all lines matching {app="api", env="production"} |= "AUDIT" from the last 168 hours through an authenticated connection, keeps them as task outputs on the execution, and confirms the capture in Discord with the line count.

How it works

1. export_audit_logs (io.kestra.plugin.grafana.loki.QueryRange) runs the LogQL query with since: 168h, exactly one week back from execution time.
2. The task authenticates with authToken from {{ secret('LOKI_AUTH_TOKEN') }}; for multi-tenant Loki, add tenantId to scope the query to one tenant via the X-Scope-OrgID header.
3. The matched lines land in {{ outputs.export_audit_logs.logs }} and remain attached to the execution, a timestamped, immutable record of what the query returned that week.
4. confirm_export posts the scalar line count to Discord; the errors block posts a distinct alert on failure, because a silently missing week defeats the purpose of the trail.
5. A disabled-by-default Schedule trigger runs the export every Monday at 06:00.

What you get

• A weekly, timestamped capture of audit events that outlives Loki's retention window.
• Authenticated access shown end to end, with the bearer token kept in a Kestra secret rather than the flow definition.
• A confirmation message per run and a loud alert per failure, so gaps in the trail are impossible to miss.
• Execution history as the audit index: every capture is a run you can open, inspect, and reference by id.

Who it's for

• Compliance and security teams who need audit evidence retained beyond log retention.
• Platform engineers running multi-tenant Loki who must scope exports per tenant.
• Anyone asked "can you prove what the system logged that week" after the logs expired.

Why orchestrate this with Kestra

An export that matters is an export that provably ran. Kestra gives the query a schedule, retries against transient Loki failures, a permanent execution record holding the captured lines, and an alert the moment a week fails to capture. The whole control loop is a few lines of YAML with the credentials in secrets.

Prerequisites

• Audit events written to Loki with a recognizable marker (the AUDIT match string here, adjust to your convention).
• A Loki bearer token with read access to the relevant tenant.
• A Discord incoming webhook for confirmations and alerts.
• Note the limit: 5000 cap: for high-volume audit streams, raise limit so the capture covers the full week rather than truncating.

Secrets

• LOKI_URL: Loki base URL, e.g. https://loki.example.com.
• LOKI_AUTH_TOKEN: bearer token for the Loki API.
• DISCORD_WEBHOOK_URL: Discord incoming webhook URL.

Quick start

1. Add the LOKI_URL, LOKI_AUTH_TOKEN, and DISCORD_WEBHOOK_URL secrets to your Kestra namespace.
2. Adjust the LogQL selector and match string to your audit logging convention.
3. Execute the flow once and verify the Discord confirmation count matches expectations.
4. Set disabled: false on the weekly trigger.

How to extend

• Add tenantId next to authToken to export one tenant at a time in a multi-tenant setup.
• Ship the captured lines to object storage or a warehouse with a downstream task for retention measured in years.
• Split noisy audit streams into daily runs with since: 24h and a daily cron to stay well under the fetch limit.
• Add a validation task that fails the flow when the count is suspiciously low, silence in an audit stream is itself a finding.

Links

• Grafana Loki plugin documentation
• LogQL documentation