System designMediumsd-g176

Subject Log aggregationLevel Mid–Senior~35 minCommon in Databases & SQL · Distributed systems interviewsIndustries Technology, Software development

Question

Design the real-time 'live tail' feature of a log platform: an engineer opens a filtered stream (e.g. service=checkout AND level=error) and sees matching log lines appear within ~1s of being emitted, while terabytes/day are still being ingested for storage. During an incident, hundreds of engineers open live tails with different filters simultaneously. Design how live matching works without scanning storage, how you fan results out to many concurrent subscribers, and how you protect ingest.

What a strong answer looks like

Clarify scale and constraints first. Propose a clean component breakdown, then go deep on the hard parts — data model, bottlenecks, consistency, failure modes — and name the trade-offs you are making.

Learn the concepts

Narrate your design

Loading whiteboard…

Run or narrate your approach, then ask the coach.