The Throttle Filter plugin sets the average Rate of messages per Interval, based on leaky bucket and sliding window algorithm. In case of overflood, it will leak within certain rate.
The plugin supports the following configuration parameters:
Amount of messages for the time.
Amount of intervals to calculate average over. Default 5.
Time interval, expressed in "sleep" format. e.g 3s, 1.5m, 0.5h etc
Whether to print status messages with current rate and the limits to information logs
Lets imagine we have configured:
Rate 5Window 5Interval 1s
we received 1 message first second, 3 messages 2nd, and 5 3rd. As you can see, disregard that Window is actually 5, we use "slow" start to prevent overflooding during the startup.
+-------+-+-+-+|1|3|5| | | | |+-------+-+-+-+| 3 | average = 3, and not 1.8 if you calculate 0 for last 2 panes.+-----+
But as soon as we reached Window size * Interval, we will have true sliding window with aggregation over complete window.
+-------------+|1|3|5|7|3|4| |+-------------+| 4.4 |----------+
When we have average over window is more than Rate, we will start dropping messages, so that
+-------------+|1|3|5|7|3|4|7|+-------------+| 5.2 |+---------+
+-------------+|1|3|5|7|3|4|6|+-------------+| 5 |+---------+
As you can see, last pane of the window was overwritten and 1 message was dropped.
You might noticed possibility to configure Interval of the Window shift. It is counter intuitive, but there is a difference between two examples above:
Rate 60Window 5Interval 1m
Rate 1Window 300Interval 1s
Even though both examples will allow maximum Rate of 60 messages per minute, first example may get all 60 messages within first second, and will drop all the rest for the entire minute:
XX XX XXXX XX XXXX XX XXXX XX XXXX XX XXXX XX XX+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
While the second example will not allow more than 1 message per second every second, making output rate more smooth:
X X X X X XXXXX XXXX XXXX XXXX XXXX XXXX+-+-+-+-+-+--+-+-+-+-+-+-+-+-+-+
It may drop some data if the rate is ragged. I would recommend to use bigger interval and rate for streams of rare but important events, while keep Window bigger and Interval small for constantly intensive inputs.
Note: It's suggested to use a configuration file.
The following command will load the tail plugin and read the content of lines.txt file. Then the throttle filter will apply a rate limit and only pass the records which are read below the certain rate:
$ bin/fluent-bit -i tail -p 'path=lines.txt' -F throttle -p 'rate=1' -m '*' -o stdout
[INPUT]Name tailPath lines.txt[FILTER]Name throttleMatch *Rate 1000Window 300Interval 1s[OUTPUT]Name stdoutMatch *
The example above will pass 1000 messages per second in average over 300 seconds.