Practice area 01
Log parsing: extract fields before counting
A strong solution starts from the log format and the required report. It extracts the client, request, and status fields deliberately, then keeps filtering, aggregation, and presentation as separate steps. That makes it easier to explain why a match is valid and why repeated runs produce the same order.
- Compare the status-code field instead of searching the entire line for 500.
- Use numeric sorting for counts and define a stable tie-break for equal values.
- Decide what empty input and malformed rows should produce before writing the pipeline.
# sample.log
10.0.0.8 GET /health 200
10.0.0.4 GET /api 503
10.0.0.8 POST /jobs 202
$ awk '$4 ~ /^5[0-9][0-9]$/ { errors++ }
> END { print "5xx", errors + 0 }' sample.log
5xx 1This checks one field-level rule. It intentionally does not implement the client ranking required by the linked challenge.