High cardinality prometheus metrics

[paketb0te]

Hey,

I just noticed that in prometheus.py, the page visits counter has the labels "path", "session", and "origin".

I would strongly suggest to remove the latter two, as they are unbounded. This might not be a problem in small-scale deployments, but basically this means that the scraping prometheus creates a new timeseries for each session or origin.

See the DOCS for a more in-depth explanation.

Cheers!

[paketb0te]

Oh I just realized that the path is also completely unbounded, at first I thought it was limited to the actually available endpoints, but since the middleware parses it before handing the request to FastAPI, the path can be anything a client calls:

# TYPE nicegui_page_visits_total counter
nicegui_page_visits_total{origin="unknown",path="/",session="4c8d6a98-7e56-40a8-af3a-4c447776aaf3"} 1.0
nicegui_page_visits_total{origin="unknown",path="/",session="d39e15a6-0003-43b3-b5a2-16706b37b363"} 7.0
nicegui_page_visits_total{origin="unknown",path="/",session="940b322d-5406-4cb2-8d42-57e538941cda"} 3.0
nicegui_page_visits_total{origin="unknown",path="/metrics",session="d39e15a6-0003-43b3-b5a2-16706b37b363"} 1.0
nicegui_page_visits_total{origin="http://localhost:8080/",path="/documentation",session="d39e15a6-0003-43b3-b5a2-16706b37b363"} 1.0
nicegui_page_visits_total{origin="http://localhost:8080/documentation",path="/",session="d39e15a6-0003-43b3-b5a2-16706b37b363"} 1.0
nicegui_page_visits_total{origin="unknown",path="/adsfasdf",session="d39e15a6-0003-43b3-b5a2-16706b37b363"} 1.0
nicegui_page_visits_total{origin="unknown",path="/adsfasadsf",session="d39e15a6-0003-43b3-b5a2-16706b37b363"} 1.0
nicegui_page_visits_total{origin="unknown",path="/;kljasd",session="d39e15a6-0003-43b3-b5a2-16706b37b363"} 1.0
nicegui_page_visits_total{origin="unknown",path="/hello-niceguis",session="d39e15a6-0003-43b3-b5a2-16706b37b363"} 1.0

[rodja]

Wow. Thanks for pointing the finger at that @paketb0te. It really was a poor attempt to get some kind of web analytics going. I think it's best to remove it entirely (see #4766). Maybe we should switch to https://plausible.io/ like FastAPI to get some user metrics?

[paketb0te]

I mean I really like prometheus and am in no way suggesting you should not use it 😃 (probably just in a different way)

[rodja]

Yes, we still use it via fly.io.