Katkat

Find Top Errors in Time Window

NotionSoftware Engineer · Onsite

Last updated

This problem tests your ability to process streaming log data within a sliding time window, aggregate frequencies using hash maps, and implement custom sorting logic.

Problem Statement

You are given a list of log entries and a time window defined by [start_time, end_time]. Each log entry is represented as a dictionary with keys timestamp (integer), error_code (string), and severity (integer).

Your task is to return the top k most frequent error codes that occurred strictly within the time range start_time <= timestamp < end_time.

If two error codes have the same frequency, the one that is lexicographically smaller should come first. If the number of unique error codes in the window is less than k, return all of them.

Function Signature

def get_top_errors(logs, start_time, end_time, k):
    # logs: list of dicts {'timestamp': int, 'error_code': str, 'severity': int}
    # start_time: int
    # end_time: int
    # k: int
    # returns: list of str (error codes)

Examples

Example 1: Input: logs = [{'timestamp': 10, 'error_code': '404', 'severity': 1}, {'timestamp': 15, 'error_code': '500', 'severity': 2}, {'timestamp': 20, 'error_code': '404', 'severity': 1}] start_time = 10, end_time = 20, k = 1 Output: ['404'] Explanation: Only the logs at timestamp 10 and 15 are in the window [10, 20). '404' appears once, '500' appears once. Since '404' < '500', it wins.

Constraints

  • Number of logs: 1 <= N <= 10^5
  • timestamp values are within [0, 10^9]
  • error_code strings are length 1-10
  • Time complexity should ideally be O(N log N) or O(N + U log U) where U is the number of unique error codes.

Hints

Hint 1

First, filter the logs to keep only those that fall within the specified time range.

Hint 2

Use a hash map (dictionary) to count the frequency of each error code encountered in the filtered list.

Hint 3

Sort the results using a custom comparator that prioritizes high frequency first, then lexicographical order for strings.

Follow-up questions

  • How would you modify your solution if the input `logs` were too large to fit in memory and had to be processed from a stream?
  • If the log data is already sorted by timestamp, how can you optimize the filtering process?
  • How would you handle a requirement where you must ignore any `error_code` where the `severity` is below a certain threshold?