Daily Loki Error Digest to Slack

Error volume is one of the cheapest health signals a service has, and most teams only look at it after something breaks. This blueprint turns it into a daily habit: io.kestra.plugin.grafana.loki.QueryRange fetches every line matching {app="checkout"} |= "ERROR" from the last 24 hours, and a Slack message reports the total each morning. A rising number across a week is often the earliest warning a team gets.

How it works

1. fetch_errors (io.kestra.plugin.grafana.loki.QueryRange) runs the LogQL query with since: 24h, a relative window that always covers the last day regardless of when the flow executes.
2. The task fetches up to limit: 5000 matching lines and exposes them as {{ outputs.fetch_errors.logs }}.
3. post_digest interpolates the scalar count ({{ outputs.fetch_errors.logs | length }}) into the Slack payload; the individual lines stay on the execution, never in the message.
4. The errors block posts a distinct Slack alert when the query or the notification fails.
5. A disabled-by-default Schedule trigger runs the digest daily at 07:00.

What you get

• A daily error count in Slack with zero dashboard building and zero manual Grafana visits.
• The matched lines preserved as task outputs on every execution, ready for spot checks when the number jumps.
• A relative since window, so backfills and late executions still report the correct day.
• A one-line query swap to track any other signal, warnings, timeouts, or a specific error code.

Who it's for

• Service owners who want a lightweight pulse on error volume without paging thresholds.
• Platform teams rolling out Loki who need quick wins that make the log data visibly useful.
• Engineering managers who want trend awareness in the channel the team already reads.

Why orchestrate this with Kestra

Loki can answer the count on demand, but a digest needs a schedule, a delivery channel, retries when Loki is briefly unreachable, and a failure alert when the report cannot run. Kestra provides all of that around one declarative task, and every day's digest is auditable in the execution history, including the exact lines behind each count.

Prerequisites

• A reachable Loki instance ingesting logs with an app label (adjust the selector to your labels).
• A Slack incoming webhook for the digest and failure alerts.
• For authenticated or multi-tenant Loki, the task also accepts authToken and tenantId (X-Scope-OrgID).

Secrets

• LOKI_URL: Loki base URL, e.g. http://loki.monitoring:3100.
• SLACK_WEBHOOK_URL: Slack incoming webhook URL.

Quick start

1. Add the LOKI_URL and SLACK_WEBHOOK_URL secrets to your Kestra namespace.
2. Adjust the LogQL query to your service's labels and error marker.
3. Execute the flow once and check the Slack message reports a plausible count.
4. Set disabled: false on the daily trigger.

How to extend

• Raise limit for noisy services; the digest counts what the query returns, so the limit caps the reported number.
• Swap the raw line fetch for a LogQL metric query such as sum(count_over_time(...)) when you need exact totals beyond the fetch limit.
• Add a second QueryRange for WARN lines and report both counts in one message.
• Compare today's count against yesterday's by storing it in a KV store and alerting on large jumps.

Links

• Grafana Loki plugin documentation
• LogQL documentation