Log Stream Anomaly Rate Monitor

Log Stream Anomaly Rate Monitor

Network controllers monitor error log frequencies to flag critical alerts.

Implement a class LogStreamMonitor(window_size) that processes a stream of log items {"timestamp": int, "level": str} and keeps track of a sliding history.

Implement the method process_log(log_item) that:

1. Appends the log item.
2. Removes any older logs from the history whose timestamp is outside the rolling sliding window of window_size seconds relative to the timestamp of the newest log item in the history.
3. Computes the anomaly rate: the number of logs with level equal to "ERROR" or "CRITICAL" divided by the total number of logs in the current sliding window.
4. Returns a float representing this ratio (returns 0.0 if the window is empty).

Example

monitor = LogStreamMonitor(10)
monitor.process_log({"timestamp": 100, "level": "INFO"})      # Returns: 0.0
monitor.process_log({"timestamp": 105, "level": "ERROR"})     # Returns: 0.5
monitor.process_log({"timestamp": 112, "level": "CRITICAL"})  # Returns: 1.0 (100 is evicted, window has 105 and 112)