← CodeClarityLab Home
Browse by Category
+ added · updated 7d
← Back to glossary

Cardinality in Metrics

observability Intermediate

TL;DR

Cardinality is the number of unique label value combinations — high cardinality (user_id, URL, session_id as labels) creates millions of time series and crashes Prometheus.

Explanation

Each unique label combination = one time series. 100 routes × 5 methods × 10 status codes = 5000 series (fine). 100 routes × 1M user_ids = 100M series (crash). High-cardinality labels: user_id, request_id, URL with query params, IP address, session_id. Solutions: don't use high-cardinality fields as labels (they belong in logs/traces). Aggregate high-cardinality dimensions in application code before recording. Prometheus native histograms (v0.16+): improve cardinality for latency. Grafana Tempo/Honeycomb: handle high cardinality natively. Use Prometheus for low-cardinality aggregate metrics; logs/traces for high-cardinality detail.

Common Misconception

More labels = more useful metrics — each additional label multiplies the series count. High-cardinality labels destroy Prometheus performance.

Why It Matters

A single high-cardinality label can take a Prometheus instance from healthy to OOM crash — understanding cardinality is critical for sustainable metrics infrastructure.

Common Mistakes

  • User ID or session ID as a Prometheus label.
  • Full URL (including query params) as label — unbounded.
  • Not auditing cardinality before adding new labels.

Code Examples

✗ Vulnerable
// HIGH cardinality — one series per user:
$histogram->labels([
    'user_id' => $userId, // Unbounded
    'url' => $request->fullUrl(), // Includes query params
])->observe($duration);
✓ Fixed
// LOW cardinality — bounded dimensions only:
$histogram->labels([
    'route' => $request->route()->getName(), // e.g. 'api.orders.show'
    'method' => $request->method(),
])->observe($duration);

// user_id → goes in logs and traces, not metrics

Added 23 Mar 2026
Views 24
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
3 pings W 0 pings T 1 ping F 0 pings S 0 pings S 0 pings M 0 pings T 1 ping W 0 pings T 1 ping F 0 pings S 0 pings S 0 pings M 0 pings T 0 pings W 0 pings T 1 ping F 0 pings S 0 pings S 0 pings M 0 pings T 1 ping W 0 pings T 1 ping F 0 pings S 0 pings S 0 pings M 0 pings T 0 pings W 0 pings T
No pings yet today
No pings yesterday
Amazonbot 6 Perplexity 4 Unknown AI 3 Google 3 Ahrefs 2 ChatGPT 1 Meta AI 1
crawler 19 pre-tracking 1
DEV INTEL Tools & Severity
🔴 Critical ⚙ Fix effort: Medium
⚡ Quick Fix
Never use user_id, session_id, or unbounded URLs as Prometheus labels. Cap label values to bounded sets (routes, methods, status codes). Audit cardinality with Prometheus /api/v1/label/__name__/values.
📦 Applies To
web cli queue-worker
🔗 Prerequisites
🔍 Detection Hints
labels.*user_id|labels.*session
Auto-detectable: ✗ No prometheus
⚠ Related Problems
🤖 AI Agent
Confidence: Medium False Positives: Medium ✗ Manual fix Fix: Medium Context: File
CWE-400

✓ schema.org compliant