# Parse Log Line

> One line. A dozen fields hidden inside.

Canonical URL: <https://datadriven.io/problems/parse_log_line>

Domain: Python · Difficulty: medium · Seniority: L4

## Problem

Given a log line 'LEVEL timestamp message' (spaces are single-space separators; message may contain spaces), return a dict with keys 'level', 'timestamp', 'message' (everything after the second space).

## Worked solution and explanation

### Why this problem exists in real interviews

Parsing structured log lines tests **string splitting with a limit** and whether you know that `str.split(sep, maxsplit)` exists. It is a practical data engineering skill for log processing.

---

### Break down the requirements

#### Step 1: Split into exactly three parts

Use `str.split(' ', 2)` to split on the first two spaces, keeping the rest as the message.

#### Step 2: Map parts to named keys

Assign the three segments to 'level', 'timestamp', and 'message'.

---

### The solution

**Limited split for structured field extraction**

```python
def parse_log(line):
    parts = line.split(' ', 2)
    result = {
        'level': parts[0],
        'timestamp': parts[1],
        'message': parts[2]
    }
    return result
```

> **Time and Space Complexity**
>
> **Time:** O(n) where n is the line length. The split scans the string once.
> 
> **Space:** O(n) for the split parts and the result dict.

> **Interviewers Watch For**
>
> Using the `maxsplit` parameter on `split()`. Candidates who split without a limit then rejoin the message segments demonstrate less Python fluency.

> **Common Pitfall**
>
> Using `split()` without maxsplit. This breaks the message into individual words, losing the original spacing and requiring a rejoin.

---

## Common follow-up questions

- What if the log format has variable delimiters? _(Tests using regex with named groups for more flexible parsing.)_
- How would you parse millions of log lines efficiently? _(Tests streaming line-by-line processing and avoiding storing all parsed results in memory.)_
- What if some log lines are malformed? _(Tests try/except or len(parts) checks to handle lines with fewer than 3 segments.)_

## Related

- [All practice problems](https://datadriven.io/problems)
- [Mock interview mode](https://datadriven.io/interview/parse_log_line)
- [Python Interview Questions](https://datadriven.io/python-interview-questions)
- [Data Engineering Interview Prep Guide](https://datadriven.io/data-engineer-interview-prep)
- [Daily Challenge](https://datadriven.io/daily)

---

Source: DataDriven (https://datadriven.io). 100% free data engineering interview prep. Live code execution against Postgres 16, Python 3.11, and Spark sandboxes. No paywall, no premium tier, no signup gate.