Why VictoriaLogs Is the Efficient Open‑Source Log Database You Need

What is VictoriaLogs

VictoriaLogs is an open‑source log‑management database that belongs to the VictoriaMetrics ecosystem. It is designed to ingest and store massive volumes of log data while using a fraction of the CPU, RAM and disk resources required by traditional solutions such as Elasticsearch or Grafana Loki.

Key Features

Low resource consumption – RAM usage is roughly 30 % of Elasticsearch and disk usage about 6 %; column‑oriented storage together with a dedicated log‑compression algorithm yields >10× compression.

Multi‑protocol ingestion

Loki API – drop‑in replacement for existing Loki clients

Elasticsearch API – seamless migration from Elasticsearch

OpenTelemetry – native support for modern observability pipelines

Syslog – classic system‑log integration

JSON Lines – structured log ingestion

LogsQL query language

Full‑text search with sub‑second latency

Aggregations and statistical functions for advanced analytics

Real‑time data transformation and field extraction during queries

Stream‑context queries to examine surrounding log entries

Installation and Deployment

Single‑node deployment

Binary releases are provided for Linux, macOS and Windows on amd64, arm64 and other architectures.

curl -L -O https://github.com/VictoriaMetrics/VictoriaLogs/releases/download/v1.41.1/victoria-logs-linux-amd64-v1.41.1.tar.gz
 tar xzf victoria-logs-linux-amd64-v1.41.1.tar.gz
 ./victoria-logs-prod -storageDataPath=victoria-logs-data

After the binary starts it listens on TCP port 9428 for both ingestion and query traffic. The process automatically scales to the available CPU cores and RAM and builds indexes on‑the‑fly.

Docker image

docker run --rm -it -p 9428:9428 -v $(pwd)/victoria-logs-data:/victoria-logs-data \
    docker.io/victoriametrics/victoria-logs:v1.41.1 -storageDataPath=victoria-logs-data

Cluster deployment

For high‑availability and horizontal scalability a cluster can be started with the provided Makefile target. make docker-vl-cluster-up The cluster consists of four dedicated components:

vlinsert – receives logs from any supported protocol and forwards them to storage nodes.

vlstorage – distributed storage nodes (typically two or more for redundancy).

vlselect – query‑processing nodes that serve read requests.

vmauth – optional load‑balancer and authentication gateway.

Environment management

# Stop a single‑node environment
make docker-vl-single-down

# Stop the cluster environment
make docker-vl-cluster-down

Basic Configuration

VictoriaLogs works well with its sensible defaults, but the most common parameters can be overridden on the command line: -storageDataPath – directory where log files are stored. -retentionPeriod – how long logs are kept (default 7d). -httpListenAddr – address for the HTTP API (default :9428). -defaultMsgValue – field name used when a log line has no explicit message (default _msg).

Viewing all command‑line options

./victoria-logs-prod -help

Data retention settings

The default retention is 7 days. It can be changed to any duration using the -retentionPeriod flag. Examples:

# Keep logs for 30 days
./victoria-logs-prod -retentionPeriod=30d

# Keep logs for 8 weeks
./victoria-logs-prod -retentionPeriod=8w

# Keep logs for 1 year
./victoria-logs-prod -retentionPeriod=1y

Repository

https://github.com/VictoriaMetrics/VictoriaLogs