> ## Documentation Index
> Fetch the complete documentation index at: https://tero-0926be64-renovate-lock-file-maintenance.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Burst protection

> Circuit breakers for logs that surge during failures

Burst protection applies to infrastructure symptoms that can repeat for every affected request when a dependency fails. Examples include database timeouts, connection failures, and TLS failures.

These policies guard the log pipeline during failures. Tero excludes business events because user activity bounds their volume.

## Signals

| Signal | Description |
| - | - |
| Failure amplification | One dependency failure can cause many requests to emit the same error. |
| Infrastructure symptom | The event describes timeout, refused connection, DNS, TLS, or similar infrastructure failure. |
| Unbounded repeatability | The event can repeat as fast as traffic reaches the failing path. |
| Low per-event uniqueness | Repeated events contain the same failure shape with limited distinguishing context. |

## Example

<Tabs>
  <Tab title="Needs protection">
    ```json theme={null}
    {
      "severity_text": "ERROR",
      "body": "Connection to postgres failed: timeout",
      "service.name": "order-service",
      "database": "products"
    }
    ```

    ```yaml theme={null}
    id: burst-protection-postgres-timeout-order-service
    name: Burst protection for postgres timeout in order-service
    description: Rate limit infrastructure errors that flood during outages.
    log:
      match:
        - resource_attribute: service.name
          exact: order-service
        - log_field: body
          regex: "^Connection to postgres failed"
      rate_limit: 100/s
    ```
  </Tab>

  <Tab title="Doesn't need protection">
    ```json theme={null}
    {
      "severity_text": "ERROR",
      "body": "Payment declined",
      "service.name": "checkout-service",
      "user_id": "usr_123",
      "error": "card_expired"
    }
    ```
  </Tab>
</Tabs>

## Recommended enforcement

<Card title="Enforce at edge" icon="server" href="/policies/enforcement/edge" horizontal>
  Rate limit matching infrastructure failures before they leave your infrastructure.
</Card>

Use edge enforcement: the point is protecting the pipeline during failures.

## Detection notes

Tero analyzes each log event for burst risk: whether a failure could cause the event to repeat at high volume. For events at risk of bursting, Tero can generate a scoped rate-limit policy.

Tero scopes burst protection to each event shape. It applies circuit breakers to infrastructure symptoms and routes unrelated business events through their normal policy path.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.