Log Parsing for Top IPs | Dataford Interview Questions

Autodesk services need a compact way to identify clients generating unusually many failed requests. Given log lines from an Autodesk service, count requests with HTTP status codes from 400 through 599 and return the top 10 source IP addresses.

Each log line has this whitespace-separated format:

timestamp ip method path status

For example: 2026-08-29T10:15:00Z 192.0.2.10 GET /api/models 500

Return a list of [ip, failed_count] pairs ordered by descending failed-request count. If two IP addresses have the same count, order them lexicographically by IP address. Return at most 10 entries.

Formal Specification

Input: logs, a list of valid non-empty strings following the specified format.
Output: A list of two-element lists, where each pair contains an IP address string and its integer failed-request count.
Process each log line once. Do not count successful status codes from 200 through 399.

Constraints

1 <= len(logs) <= 10^6
Each line contains exactly five whitespace-separated fields
The status code is an integer from 100 through 599
There may be up to len(logs) distinct IP addresses
IP addresses are valid IPv4 or IPv6 strings

Function Signature

def top_failed_ips(logs):

Your question is Log Parsing for Top IPs. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.

Problem