One diagram per scenario; each tab is one scenario from the source.
Logs · ingest
Logs · query
Alloy tails container files/journald, parses, and pushes to Loki. Streams are sharded by label set; ingesters build compressed chunks and a tiny TSDB index.
LogQL narrows streams via the label index (index-gateway), then queriers grep matching chunks in parallel — recent from ingesters, older from the bucket.