Request Sampling

Context

Request sampling can record the access IP addresses, the number of accessed nodes, request paths, request URLs, and request bodies, which can be used to obtain the IP addresses and paths of clients that have sent a large number of access requests.

The following table describes request sampling parameters.

• The IP address statistics and URL sampling statistics are cached based on their access time. If the cache space reaches the threshold (flowcontrol.statics.threshold), the records of the earliest access will be deleted.
• In URL sampling, an access path is uniquely identified by its URL hash.

Procedure

1. Log in to the CSS management console.
2. Choose Clusters in the navigation pane. On the Clusters page, locate the target cluster and click Access Kibana in the Operation column.
3. In the navigation pane on the left, choose Dev Tools and run commands to enable or disable sampling.
   • Enabling sampling

     PUT /_cluster/settings
     {
       "persistent": {
         "flowcontrol.statics.enabled": true,
         "flowcontrol.statics.threshold": 100,
         "flowcontrol.statics.sample_frequency": 50
       }
     }

   • Disabling sampling

     PUT /_cluster/settings
     {
       "persistent": {
         "flowcontrol.statics.enabled": false
       }
     }