A log clusterer
Why it matters Five hundred error lines are unreadable. Ten patterns with counts are a to-do list. Turning one into the other is a tool you will use every incident.
Log lines are made by a few hundred log.info(...) calls with values filled in. Lines from the same call differ only in those values. If you replace each value with a placeholder, lines from the same call become identical, and grouping is a dictionary.
INFO request handled in 12ms status=200 -> INFO request handled in <NUM>ms status=<NUM>
INFO request handled in 340ms status=204 -> (the same)The hard part is knowing what a value looks like. In this team's services, values are: numbers (whole or with a decimal point, sometimes followed by a unit such as ms or s), hex ids of 8 or more characters, UUIDs, IPv4 addresses (sometimes with :port), and anything in double quotes (quoted values may contain spaces and digits). The words around them are fixed by the code.
Write cluster(lines). Return a dict that maps a pattern string to the list of indices of the lines with that pattern. Two lines must share a pattern exactly when they are the same after every value (the five kinds listed above) is replaced by a placeholder. The pattern string itself is yours to choose. Trap to beat: the tests use 500 lines from two services, with every kind of value, and two patterns that differ by a single fixed word.
Spotted a problem in this lesson? Report it · Ask about this lesson
This exercise opens soon
Finish the lesson before it and this one unlocks. The whole course is free, no account needed, and you can read this lesson right now.
This browser is blocking cookies for learn.floati.life, so lessons you finished here cannot open in order. Allow cookies for this site and reload.