Step 5: Traffic over time

Problems have a when. Cut the timestamp to the minute (e["time"][:5] turns 09:01:20 into 09:01) and count per bucket. A tiny text bar chart ("#" * count) shows the shape of the traffic in a terminal, and the minute with the most errors points to the incident.

Examplepython

import re
from collections import Counter, defaultdict

LOG = """2026-11-05 09:00:01 10.0.0.5 GET /home 200 120
2026-11-05 09:00:03 10.0.0.9 GET /login 200 80
2026-11-05 09:00:07 10.0.0.9 POST /login 401 95
2026-11-05 09:00:09 10.0.0.9 POST /login 401 91
2026-11-05 09:00:12 10.0.0.9 POST /login 401 99
2026-11-05 09:00:15 10.0.0.9 POST /login 401 97
2026-11-05 09:01:02 10.0.0.5 GET /courses 200 340
2026-11-05 09:01:20 10.0.0.7 GET /courses/python 200 410
2026-11-05 09:01:44 10.0.0.7 GET /missing 404 30
2026-11-05 09:02:05 10.0.0.5 GET /api/progress 500 1200
2026-11-05 09:02:09 10.0.0.5 GET /api/progress 500 1180
2026-11-05 09:02:30 10.0.0.8 GET /home 200 110
2026-11-05 09:03:10 10.0.0.8 GET /courses 200 360
2026-11-05 09:03:12 10.0.0.7 GET /home 200 105
2026-11-05 09:03:50 10.0.0.6 GET /api/progress 200 220
this line is not a valid log entry
2026-11-05 09:04:01 10.0.0.6 GET /home 200 98
2026-11-05 09:04:33 10.0.0.7 GET /courses/sql 200 395
2026-11-05 09:05:02 10.0.0.8 GET /missing 404 28"""

PATTERN = re.compile(
    r"^(?P<date>\d{4}-\d{2}-\d{2}) (?P<time>\d{2}:\d{2}:\d{2}) "
    r"(?P<ip>\S+) (?P<method>[A-Z]+) (?P<path>\S+) (?P<status>\d{3}) (?P<ms>\d+)$"
)

def parse(text):
    entries = []
    for line in text.splitlines():
        m = PATTERN.match(line)
        if m:
            e = m.groupdict()
            e["status"], e["ms"] = int(e["status"]), int(e["ms"])
            entries.append(e)
    return entries

entries = parse(LOG)

per_minute = Counter(e["time"][:5] for e in entries)            # "09:01"
for minute, count in sorted(per_minute.items()):
    bar = "#" * count
    print(minute, f"{count:>2}", bar)

errors_per_minute = Counter(e["time"][:5] for e in entries if e["status"] >= 400)
worst = max(errors_per_minute, key=errors_per_minute.get)
print("worst minute:", worst, "with", errors_per_minute[worst], "errors")

Open in editor »

Cutting a string is the simplest bucketing. For real timestamps you would parse them with datetime so you can bucket by 5 minutes, hours or days.

Quick check

What does grouping requests by minute help you see?

When traffic or errors spikeWhich IP is fastestWhich path is longest

Finish the quick check (and any code exercise) to complete this lesson, or mark it done yourself.

Tip: use the left and right arrow keys to move between lessons.