Log search with tiering
Design a log-search system ingesting 2M log lines/sec (5TB/day) where engineers run ad-hoc full-text + structured-field queries over a time range. Recent data (last 24h) must be queryable within seconds of ingestion; older data (up to 30 days) can tolerate slower queries. Cost must stay bounded, so storage tiering is required.
What a strong answer looks like
Clarify scale and constraints first. Propose a clean component breakdown, then go deep on the hard parts (data model, bottlenecks, consistency, failure modes) and name the trade-offs you are making.
Clarify5:30 left
Estimate5:30 planned
Design16:30 planned
Deep dive13:30 planned
Failure9:00 planned
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.