> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Burst protection

> Circuit breakers for logs that surge during failures

Burst protection applies to infrastructure symptoms that can repeat for every affected request when a dependency fails. Examples include database timeouts, connection failures, and TLS failures.

These policies guard the log pipeline during failures. Tero excludes business events because user activity bounds their volume.

## Signals

| Signal                   | Description                                                                                   |
| ------------------------ | --------------------------------------------------------------------------------------------- |
| Failure amplification    | One dependency failure can cause many requests to emit the same error.                        |
| Infrastructure symptom   | The event describes timeout, refused connection, DNS, TLS, or similar infrastructure failure. |
| Unbounded repeatability  | The event can repeat as fast as traffic reaches the failing path.                             |
| Low per-event uniqueness | Repeated events contain the same failure shape with limited distinguishing context.           |

## Example

<Tabs>
  <Tab title="Needs protection">
    ```json theme={null}
    {
      "severity_text": "ERROR",
      "body": "Connection to postgres failed: timeout",
      "service.name": "order-service",
      "database": "products"
    }
    ```

    ```yaml theme={null}
    id: burst-protection-postgres-timeout-order-service
    name: Burst protection for postgres timeout in order-service
    description: Rate limit infrastructure errors that flood during outages.
    log:
      match:
        - resource_attribute: service.name
          exact: order-service
        - log_field: body
          regex: "^Connection to postgres failed"
      rate_limit: 100/s
    ```
  </Tab>

  <Tab title="Doesn't need protection">
    ```json theme={null}
    {
      "severity_text": "ERROR",
      "body": "Payment declined",
      "service.name": "checkout-service",
      "user_id": "usr_123",
      "error": "card_expired"
    }
    ```
  </Tab>
</Tabs>

## Recommended enforcement

<Card title="Enforce at edge" icon="server" href="/policies/enforcement/edge" horizontal>
  Rate limit matching infrastructure failures before they leave your infrastructure.
</Card>

Use edge enforcement: the point is protecting the pipeline during failures.

## Detection notes

Tero analyzes each log event for burst risk: whether a failure could cause the event to repeat at high volume. For events at risk of bursting, Tero can generate a scoped rate-limit policy.

Tero scopes burst protection to each event shape. It applies circuit breakers to infrastructure symptoms and routes unrelated business events through their normal policy path.