Loki’s max_lookback_window configuration setting doesn’t actually limit how far back your queries can go; it dictates the maximum amount of time Loki will consider for a single query’s results, regardless of your start and end timestamps.
Let’s see this in action. Imagine you have logs from months ago, and you want to query them.
Here’s a snippet from a loki-local-config.yaml that might be running:
auth_methods:
- anonymous
server:
http_listen_port: 3100
common:
path_prefix: /loki
storage:
filesystem:
chunks_directory: /loki/chunks
rules_directory: /loki/rules
# This is the crucial setting for our discussion.
# If this is set to '500h', Loki will only process log lines
# within the last 500 hours *relative to the query's latest timestamp*.
# Any logs older than that, even if requested by your query's start/end,
# will simply not be returned.
max_lookback_window: 500h
Now, let’s say you run a query using logcli (Loki’s command-line interface) targeting a specific time range:
logcli query '{job="my_app"}' --since="2023-01-01T00:00:00Z" --until="2023-01-10T23:59:59Z"
If max_lookback_window is set to 500h (approximately 20 days), and the query’s until timestamp is 2023-01-10T23:59:59Z, Loki will effectively look for logs between 2023-01-10T23:59:59Z minus 500h. This means it will only consider logs from roughly 2023-11-20T23:59:59Z onwards, even though your query explicitly asked for data from 2023-01-01. The logs from January 1st to November 19th will be ignored.
This behavior is a performance optimization. Without it, a query for a very long time range could potentially scan an enormous amount of data, overwhelming the system. max_lookback_window acts as a safeguard, ensuring that queries don’t inadvertently trigger massive data scans. It forces you to be more precise about the time windows you’re interested in, or to break down very large historical queries into smaller, more manageable chunks.
The mental model for max_lookback_window is that it’s not a hard limit on the start timestamp of your query, but rather a sliding window that Loki applies to the end timestamp of your query. Think of it as "within the last X hours before the query finishes, what logs are available?"
So, if you have max_lookback_window: 168h (one week) and you run a query for the last month, Loki will only return logs from the last week, even though you asked for the whole month. To get the full month’s data, you’d need to either increase max_lookback_window to at least 720h (30 days) or run multiple queries, each covering a week.
The key takeaway is that max_lookback_window is a per-query constraint, not a global data retention policy. Your actual log data might be stored for much longer, but Loki’s query engine will only process data within this configured window.
If you’re trying to query data that you know exists but isn’t showing up, and your query range is large, the max_lookback_window setting is the first place to look. You’ll need to adjust this value in your Loki configuration file, typically in the common section, and then restart your Loki instances for the change to take effect. For example, to query up to a year’s worth of data relative to the query’s end time, you might set it to 8760h (365 days).
The next hurdle you might encounter after adjusting max_lookback_window to retrieve older data is the query performance itself, as longer lookback windows can significantly increase query latency and resource consumption.