question 480 Observability & Operations · hard

Which minutes should have alerted?

After an incident, the team wants to tune the alert rule: *alert when, in any one minute, at least min_requests requests finished and at least threshold of them were server errors.* Replay the rule over the request log and list the minutes that would have alerted.

Functionalert_minutes(lines, threshold, min_requests)

Requesta JSON object line with message == "request finished", an ISO time like 2025-03-03T09:00:12Z and an integer status; other lines are skipped

Minutethe first 16 characters of time (2025-03-03T09:00)

Alertrequests in the minute ≥ min_requests and (statuses 500–599) ÷ requests ≥ threshold

Returnsthe alerting minutes, sorted

Examples

callalert_minutes(['{"time": "2025-03-03T09:00:05Z", "message": "request finished", "status": 200}', '{"time": "2025-03-03T09:00:41Z", "message": "request finished", "status": 503}', '{"time": "2025-03-03T09:01:02Z", "message": "request finished", "status": 503}', '{"time": "2025-03-03T09:01:15Z", "message": "request finished", "status": 500}', '{"time": "2025-03-03T09:01:30Z", "message": "request finished", "status": 200}', '{"time": "2025-03-03T09:01:59Z", "message": "request started"}'], 0.5, 3)returns['2025-03-03T09:01']

callalert_minutes([], 0.1, 1)returns[]

callalert_minutes(['{"time": "2025-03-03T10:00:00Z", "message": "request finished", "status": 502}'], 0.5, 1)returns['2025-03-03T10:00']