Audit your current label set by querying active streams: use the Loki label API or a LogQL query like count by (job) ({}) to enumerate all active stream combinations
Remove high-cardinality labels (trace IDs, user IDs, request IDs, HTTP paths) from the indexed label set in your log shipper (Promtail, Alloy, or Fluent Bit) configuration
For searchable high-cardinality values, use Loki structured metadata (via the push API or Alloy's loki.write with labels_from_metadata) which does not create index streams
Configure per-tenant limits in Loki's limits_config: set max_streams_per_user and max_label_names_per_series to guard against cardinality explosions; avoid increasing max_label_names_per_series beyond the default of 15
Alert on stream growth by monitoring the loki_ingester_memory_streams metric and setting an alert when it exceeds a safe threshold for your cluster size
Use LogQL label filter expressions (| label_format, | drop) in queries to handle log lines where label cleanup was missed at the shipper level
Known gotchas
Increasing max_label_names_per_series is strongly discouraged by the Loki maintainers because it enlarges the index exponentially — prefer structured metadata for extra fields
Limits apply per tenant; in single-tenant deployments all limits apply to the default tenant, but they can be overridden per-tenant with the overrides_config for multi-tenant setups
Label changes (adding or removing a label from log lines) create a new stream and do not merge with the old stream; historical data under the old label set remains queryable only with the original label
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp