Top 5xx IPs from Logs | Dataford Interview Questions

In a Databricks observability workflow, you need to process a massive web server log and identify which client IP addresses generated the most server-side failures. Write a function that scans log lines and returns the top k IP addresses by number of HTTP 5xx responses.

Formal Specification

Implement a function that takes:

log_lines: a list of strings, where each string is one log entry
k: an integer

Each valid log line follows this simplified format: "<ip> - - [timestamp] \"METHOD PATH HTTP/1.1\" status bytes"

A line should count toward an IP only if:

the line contains at least 9 whitespace-separated tokens, and
the HTTP status code is an integer in the range 500 to 599

Return a list of [ip, count] pairs sorted by:

descending error count
ascending IP string for ties

Ignore malformed lines and lines with non-integer status codes.

Constraints

1 <= len(log_lines) <= 10^5
1 <= len(log_lines[i]) <= 300
1 <= k <= 10^4
Each valid line uses the simplified whitespace-separated log format
Malformed lines and non-integer status codes must be ignored

Function Signature

def top_5xx_ips(log_lines, k):

Your question is Top 5xx IPs from Logs. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.

Problem