# Throttle key?

**URL:** <https://discuss.elastic.co/t/throttle-key/169864>\
**Category:** Logstash\
**Created:** [February 25, 2019, 3:33pm UTC](https://discuss.elastic.co/t/throttle-key/169864 "2019-02-25T15:33:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![oscario](https://avatars.discourse-cdn.com/v4/letter/o/f19dbf/32.png) [@oscario](https://discuss.elastic.co/u/oscario)\
**Post date:** [February 25, 2019, 3:33pm UTC](https://discuss.elastic.co/t/throttle-key/169864/1 "2019-02-25T15:33:52Z")

</div>

Dear all,

I want the throttle plugin to group every line (not only lines matching a specific key value).  
Since a key is required and the only thing all lines have in common is at least one space I use a space for the key 🙂

Si it works to add:  
`key => " "`

But if I use a key which will never exist in the input, i.e.:  
`key => "THIS_PATTERN_NEVER_MATCHES"`

The throttle result seems the same...

Does any know if there is a difference between using a key which always mathes and a key which never matches? And what's best to use?  
In the ruby source I cannot figure out the answer (sorry...)

More info:  
I use:  
throttle {  
after\_count =\> 300  
period =\> 1  
max\_age =\> 2  
key =\> " "  
add\_tag =\> "throttled"  
}  
if "throttled" in [tags] {  
sleep {  
time =\> "0.1"  
}  
}

We peak at around 2000 events per second and I want to throttle this to around 600/sec. The above config does this. But, as said, also with a key which never matches.

Kind regards,  
Oscar.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 25, 2019, 5:01pm UTC](https://discuss.elastic.co/t/throttle-key/169864/2 "2019-02-25T17:01:45Z")

</div>

I think you have slightly misunderstood the usage of key.

The normal way to use key is to have a %{} reference to some field on the event. If you had an 'method' field and you wanted to throttle events for each method separately you would use

```
key => "%{method}"

```

When the filter sees an event it does the substitution of %{method} with the value of the method field, GET, for example. It then puts this event into the GET bucket and applies the throttle. If another event has method POST, then the filter puts it into the POST bucket and decides whether the throttle parameters are applied for that bucket.

If you set the key to any constant value, such as " ", then every single event goes into the " " bucket.

---

<div class="post-metadata">

**Author:** ![oscario](https://avatars.discourse-cdn.com/v4/letter/o/f19dbf/32.png) [@oscario](https://discuss.elastic.co/u/oscario)\
**Post date:** [February 26, 2019, 7:28am UTC](https://discuss.elastic.co/t/throttle-key/169864/3 "2019-02-26T07:28:40Z")

</div>

Hi Badger,

Thank you for your response.  
But that is precise what I want: every single event needs to go into the bucket so throttling is always done on all events. We don't know the events we get but do know we dont't want to go over about 600 events per second. It works but my question is: using a key which does never match seems to do the same (as opposed to using a space which always matches) and I'm wondering what best to use.

FYI: we do not use Elasticsearch as a backend (which thottles automagically).

Kind regards,  
Oscar.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 26, 2019, 12:11pm UTC](https://discuss.elastic.co/t/throttle-key/169864/4 "2019-02-26T12:11:20Z")

</div>

> [@oscario](#):
>
> using a key which does never match seems to do the same (as opposed to using a space which always matches) and I'm wondering what best to use.

There is no such thing as "matching". If you use a constant key, whatever it is, then every event goes into the same bucket.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 26, 2019, 12:11pm UTC](https://discuss.elastic.co/t/throttle-key/169864/5 "2019-03-26T12:11:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.