Cardinality in Metrics
TL;DR
Cardinality is the number of unique label value combinations — high cardinality (user_id, URL, session_id as labels) creates millions of time series and crashes Prometheus.
Explanation
Each unique label combination = one time series. 100 routes × 5 methods × 10 status codes = 5000 series (fine). 100 routes × 1M user_ids = 100M series (crash). High-cardinality labels: user_id, request_id, URL with query params, IP address, session_id. Solutions: don't use high-cardinality fields as labels (they belong in logs/traces). Aggregate high-cardinality dimensions in application code before recording. Prometheus native histograms (v0.16+): improve cardinality for latency. Grafana Tempo/Honeycomb: handle high cardinality natively. Use Prometheus for low-cardinality aggregate metrics; logs/traces for high-cardinality detail.
Common Misconception
✗ More labels = more useful metrics — each additional label multiplies the series count. High-cardinality labels destroy Prometheus performance.
Why It Matters
A single high-cardinality label can take a Prometheus instance from healthy to OOM crash — understanding cardinality is critical for sustainable metrics infrastructure.
Common Mistakes
- User ID or session ID as a Prometheus label.
- Full URL (including query params) as label — unbounded.
- Not auditing cardinality before adding new labels.
Code Examples
✗ Vulnerable
// HIGH cardinality — one series per user:
$histogram->labels([
'user_id' => $userId, // Unbounded
'url' => $request->fullUrl(), // Includes query params
])->observe($duration);
✓ Fixed
// LOW cardinality — bounded dimensions only:
$histogram->labels([
'route' => $request->route()->getName(), // e.g. 'api.orders.show'
'method' => $request->method(),
])->observe($duration);
// user_id → goes in logs and traces, not metrics
Tags
🤝 Adopt this term
£79/year · your link shown here
Added
23 Mar 2026
Views
24
🤖 AI Guestbook educational data only
|
|
Last 30 days
Agents 0
No pings yet today
No pings yesterday
Amazonbot 6
Perplexity 4
Unknown AI 3
Google 3
Ahrefs 2
ChatGPT 1
Meta AI 1
Also referenced
How they use it
crawler 19
pre-tracking 1
Related categories
⚡
DEV INTEL
Tools & Severity
🔴 Critical
⚙ Fix effort: Medium
⚡ Quick Fix
Never use user_id, session_id, or unbounded URLs as Prometheus labels. Cap label values to bounded sets (routes, methods, status codes). Audit cardinality with Prometheus /api/v1/label/__name__/values.
📦 Applies To
web
cli
queue-worker
🔗 Prerequisites
🔍 Detection Hints
labels.*user_id|labels.*session
Auto-detectable:
✗ No
prometheus
⚠ Related Problems
🤖 AI Agent
Confidence: Medium
False Positives: Medium
✗ Manual fix
Fix: Medium
Context: File
CWE-400