Find Top Errors in Time Window
NotionSoftware Engineer · OnsiteLast updated
This problem tests your ability to process streaming log data within a sliding time window, aggregate frequencies using hash maps, and implement custom sorting logic.
Problem Statement
You are given a list of log entries and a time window defined by [start_time, end_time]. Each log entry is represented as a dictionary with keys timestamp (integer), error_code (string), and severity (integer).
Your task is to return the top k most frequent error codes that occurred strictly within the time range start_time <= timestamp < end_time.
If two error codes have the same frequency, the one that is lexicographically smaller should come first. If the number of unique error codes in the window is less than k, return all of them.
Function Signature
def get_top_errors(logs, start_time, end_time, k):
# logs: list of dicts {'timestamp': int, 'error_code': str, 'severity': int}
# start_time: int
# end_time: int
# k: int
# returns: list of str (error codes)
Examples
Example 1:
Input:
logs = [{'timestamp': 10, 'error_code': '404', 'severity': 1}, {'timestamp': 15, 'error_code': '500', 'severity': 2}, {'timestamp': 20, 'error_code': '404', 'severity': 1}]
start_time = 10, end_time = 20, k = 1
Output: ['404']
Explanation: Only the logs at timestamp 10 and 15 are in the window [10, 20). '404' appears once, '500' appears once. Since '404' < '500', it wins.
Constraints
- Number of logs:
1 <= N <= 10^5 timestampvalues are within[0, 10^9]error_codestrings are length 1-10- Time complexity should ideally be
O(N log N)orO(N + U log U)whereUis the number of unique error codes.
Hints
Hint 1
First, filter the logs to keep only those that fall within the specified time range.
Hint 2
Use a hash map (dictionary) to count the frequency of each error code encountered in the filtered list.
Hint 3
Sort the results using a custom comparator that prioritizes high frequency first, then lexicographical order for strings.
Follow-up questions
- How would you modify your solution if the input `logs` were too large to fit in memory and had to be processed from a stream?
- If the log data is already sorted by timestamp, how can you optimize the filtering process?
- How would you handle a requirement where you must ignore any `error_code` where the `severity` is below a certain threshold?
Solution walkthrough is for members
Get the full walkthrough with reference code and complexity analysis, plus Kitty Coach at 300 messages a day. Hints, the code runner and community answers stay free.