# zicula-log-ops-kit — free sample

Three real files from the full kit (30+ files), each **trimmed to taste** — enough to
judge the quality, not enough to run your log stack without buying:

- `cookbook-logql-SAMPLE.md` — the introduction and first 4 of the 24 LogQL queries from
  `docs/cookbook-logql.md`, unchanged: the label scheme the kit ships, the curl one-liner
  that queries Loki with basic auth, the two syntax notes that prevent 90% of beginner
  errors, and queries 1–4 with their explanations. The remaining 20 queries (parse,
  count/metric, detect) and the cardinality/performance chapters are listed at the end
  so you know what the full cookbook adds.
- `capacity-planner-SAMPLE.md` — the disk math from `docs/capacity-planner.md`:
  the three inputs that matter, the `capacity.sh` formula (ingest × retention × 1.2 × 2)
  and the first 3 rows of the worked sizing table. The RAM/CPU table, the 80% rule,
  the cost frame and the outgrowth ladder are summarized by title only.
- `alert-rules-SAMPLE.yml` — 1 of the 3 shipped alert rules from `alerts/rules.yml`,
  complete and unchanged (`HighErrorRate`, the exact expression the LogQL cookbook
  references). The other two rules (`LogPipelineStalled`, `NoContainerLogs`) are
  described by behavior only — their expressions ship in the full file.

Every sample file is marked `SAMPLE` in its name and carries a header note saying which
full file it came from and what was cut. Nothing in the zip is a copy of a full kit file.

What the full kit adds (30+ files, one zip):

- The five-service compose stack — Vector + Loki + Grafana + Alertmanager + Caddy, official images pinned by tag, with `setup.sh` generating secrets, wiring the alert channel and verifying itself
- The security layer raw Loki lacks: Caddy TLS + bcrypt basic auth in front of the Loki API, Grafana signup disabled
- Retention that actually deletes: 7/30/90-day formulas with sizing notes, enforced by Loki's compactor, plus the host-level disk-watch that alerts your webhook at 80%
- Alerting that reaches a human: 3 ruler rules → Alertmanager → Telegram/Slack, with the delivery test most setups skip
- 4 provisioned Grafana dashboards (logs overview, NGINX access, services & apps, system journal) — zero clicking on first boot
- The full docs library: 24-query LogQL cookbook, 4 ingestion playbooks (NGINX, Node.js, Python, journald), the complete capacity planner, the upgrade runbook (one service at a time, 30-second rollback), and `tools/` — verify.sh, capacity.sh, disk-watch.sh

One-time purchase $59 · free updates for v1.x · 30-day full refund.