Log-Stream Parsing

If the filesystem walk is the coding shape Datadog asks most, this is the one that's most theirs. A stream of log lines arrives, you hold a set of search queries, and your job is to report which logs match which queries as they come through. Candidates describe it as "parse query L, Q and show matching q in a list of logs," and several name a Premium question framing outright. A substring check gets you the warm-up. The interview is the four follow-ups stacked on top. That's the real test.

You're reimplementing a feature Datadog ships. A Premium question streams logs through the browser in real time and lets you filter them with a query as they fly past. To the interviewer, the prompt is a scaled-down version of a system they run at enormous volume. The follow-ups push on exactly the parts that get hard there: case handling, queries that come and go over time, and keeping the matcher fast when both the query set and the stream are large.