# Build a Robust Log Parser and Prefix-Operator Search Design a tool that parses a list of server-log strings into structured records with timestamp, level, service, message, and optional user identifier. Malformed records are discarded. Then design a search operation whose query begins with zero or more `type:value` operators for level, service, user identifier, inclusive start time, and exclusive end time; remaining text is a message substring. Return both matching records and their count. ### Constraints & Assumptions - Valid levels are INFO, WARN, ERROR, and DEBUG, matched case-insensitively in queries. - All operators appear before free-text search terms. - Start time is inclusive and end time is exclusive. - The parser must define an explicit accepted log grammar rather than guess silently from arbitrary text. ### Clarifying Questions to Ask - What delimiter and timestamp format define a valid source log? - How is a user identifier encoded inside a message, and may it appear more than once? - Should unknown or duplicate query operators be errors or ordinary message text? ```hint Define the grammar Choose how fields are escaped or delimited before implementing recovery behavior. ``` ```hint Separate parsing phases Parse operators into a filter object, then apply that object to already structured records. ``` ### What a Strong Answer Covers - A parsing pipeline with validation, normalization, and explicit malformed-record behavior. - A query tokenizer that stops operator parsing at the first free-text token. - Correct conjunction of filters and half-open time bounds. - Data structures, testing, observability, and an indexing path if repeated queries become large-scale. ### Follow-up Questions - How would quoted free text containing spaces change the query grammar? - Which indexes would help if logs were persisted and searched repeatedly?