Description
The Throttle processor applies rate limiting to a stream of events to limit load on downstream destinations.Use
This processor is used for cases where a high-throughput of low-value events may be produced from a source, as a means of protecting destinations and services. The Throttle processor allows for granular rate limiting of events, either across the entire event stream or bucketed by the configured Key Field. Events that exceed the configured Limit within the time Window are discarded.Configuration
Examples
Limit Events by Field
This example shows a configuration that allows only 1 event every 1 second, for each unique value of the.app field. Events produced by host-4 are excluded from throttling.
Before
Options
After
Three events are produced - the first event in the stream for each unique value of.app , along with any events excluded from throttling (when .host == "host-4" ).

