Grafana Trigger

Grafana Trigger
Certified
Trigger flow on new Loki logs

Polls Loki with a LogQL range query and fires when new entries appear. State tracks seen records (default TTL 1 day) so each log triggers once. Uses forward sorting and limit 100 by default.

yaml
type: io.kestra.plugin.grafana.loki.Trigger

Examples

Trigger on security alerts

yaml
id: security_alert_handler
namespace: security

tasks:
  - id: handle_alert
    type: io.kestra.plugin.core.log.Log
    message: "Security alert: {{ trigger.count }} new entries detected"

  - id: process_logs
    type: io.kestra.plugin.core.log.Log
    message: "{{ trigger.logs }}"

triggers:
  - id: watch_security_logs
    type: io.kestra.plugin.grafana.loki.Trigger
    url: http://loki.example.com:3100
    authToken: "{{ secret('LOKI_TOKEN') }}"
    tenantId: production
    query: '{job="security", level="critical"} |= "unauthorized access"'
    interval: PT1M
    maxRecords: 100

Trigger on error patterns with authentication

yaml
id: error_monitor
namespace: monitoring

tasks:
  - id: send_alert
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "text": "🚨 {{ trigger.count }} errors detected",
        "blocks": [
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": "*Query:* {{ trigger.query }}"
            }
          }
        ]
      }

triggers:
  - id: monitor_errors
    type: io.kestra.plugin.grafana.loki.Trigger
    url: https://loki.example.com:3100
    authToken: "{{ secret('LOKI_TOKEN') }}"
    tenantId: team-platform
    query: '{job="api", level="error"} |~ "timeout|connection refused"'
    interval: PT5M
    since: 10m

Trigger on payment failures (SOAR use case)

yaml
id: payment_failure_handler
namespace: payments

triggers:
  - id: watch_payment_failures
    type: io.kestra.plugin.grafana.loki.Trigger
    url: http://loki:3100
    tenantId: payments-team
    query: '{application="payment-gateway"} |= "payment failed" | json | amount > 1000'
    interval: PT30S
    maxRecords: 50
    since: 5m

tasks:
  - id: investigate
    type: io.kestra.plugin.core.log.Log
    message: "Investigating {{ trigger.count }} high-value payment failures"

Properties

query *string

LogQL query to monitor

Rendered LogQL expression; trigger fires when new results match.

url *string

Loki base URL

HTTPS endpoint of the Loki API, including scheme (e.g., http://localhost: 3100 or https://logs.example.com)

allowConcurrent boolean

Defaultfalse

Specifies whether a trigger is allowed to start a new execution even if a previous run is still in progress.

authToken string

Bearer token

Authorization header value for secured Loki deployments; render from secrets when possible

connectTimeout integerstring

Default30

HTTP connect timeout

Connection timeout in seconds; defaults to 30

interval string

DefaultPT1M

Formatduration

Polling interval

How often to query Loki; ISO-8601 duration. Defaults to PT1M.

maxRecords integerstring

Default100

Maximum records per trigger

Upper bound on log entries returned per poll; defaults to 100 and enforces forward order.

readTimeout integerstring

Default60

HTTP read timeout

Read timeout in seconds; defaults to 60

since string

Default10m

Lookback window

Duration to backfill on the first run (e.g., '1h'); defaults to 10m.

stateKey string

Custom state key

Override the state storage key; defaults to namespace.flow_id.trigger_id

stateTtl string

DefaultPT24H

State TTL

Retention for deduplication state; after TTL the trigger reprocesses logs. Defaults to 1 day.

stopAfter array

SubTypestring

Possible Values

CREATEDSUBMITTEDRUNNINGPAUSEDRESTARTEDKILLINGSUCCESSWARNINGFAILEDKILLEDCANCELLEDQUEUEDRETRYINGRETRIEDSKIPPEDBREAKPOINTRESUBMITTED

List of execution states after which a trigger should be stopped (a.k.a. disabled).

tenantId string

Tenant ID

X-Scope-OrgID header used by multi-tenant Loki clusters

when string

Defaulttrue

A condition that determines whether the trigger should run.

A Pebble expression evaluated at trigger time. The trigger fires only when the expression evaluates to a truthy value (true, a non-empty string, a non-zero number). Use this to gate trigger execution on dynamic runtime values such as execution labels, flow variables, or environment conditions.

Outputs

count integer

Number of new log entries

Total count of logs that matched the query since last check

lastTimestamp string

Latest timestamp

Timestamp of the most recent log entry (in nanoseconds)

logs array

SubTypeobject

List of new log entries that triggered the flow

Each entry contains timestamp, labels, and log line or metric value

query string

Query executed

The LogQL query that was executed

resultType string

Result type

Type of result returned by Loki (streams, matrix, or vector)

Azure

Enterprise

Tasks that integrate Microsoft Azure services into Kestra enterprise workflows.

CloudDataInfrastructure

Prefect

Tasks that trigger Prefect deployments and monitor flow runs.

Data

Grafana TriggerCertifiedTrigger flow on new Loki logs

Grafana Trigger

More Plugins in this Category

Azure

Prefect

Grafana Trigger
Certified
Trigger flow on new Loki logs