Query Log Match
Reported by candidates from Datadog's online assessment. Pattern, common pitfall, and the honest play if you blank under the timer.
The Datadog OA reported in June 2026 hands you a log-tail matcher, and the input size is the whole point. Up to 2 * 10^4 events and 2 * 10^5 total characters means checking every log against every query by rescanning tokens will crawl. This is a hash-table problem with an inverted index hiding inside it. You tokenize, lowercase, dedupe, then match logs to earlier queries without touching all of them. If you blank on the indexing idea mid-assessment, StealthCoder is the quiet safety net that reads the screen and hands you the structure.
The problem
You are given a finite array stream containing query-registration events and log events. Process the events from left to right. Every event starts with exactly one of these prefixes: Q: introduces a query payload. L: introduces a log payload. Tokenize a payload into its maximal contiguous ASCII letter-or-digit sequences, and convert every token to lowercase. Punctuation and whitespace separate tokens. Repeated tokens within one payload count once. A registered query matches a log when every distinct token in the query occurs as an exact token in the log. Token order does not matter. A token such as fail does not match failed. Build the returned messages using these rules: For every query event, assign the next 1-based ID, even when its payload duplicates an earlier query. Append ACK: <payload>; ID=<id>. For every log event, find all previously registered matching query IDs and order them increasingly. If at least one query matches, append M: <payload>; Q=<id1>,<id2>,.... If no query matches, append nothing. The payload in an output message must preserve its original spelling, capitalization, spacing, and punctuation. Return all appended messages in event order. Function processLiveTail(stream: String[]) → String[] Examples Example 1 stream = ["Q: database","Q: Stacktrace","Q: loading failed","L: Database service started","Q: snapshot loading","Q: fail","L: Started processing events","L: Loading main DB snapshot","L: Loading snapshot failed no stacktrace available"] return = ["ACK: database; ID=1","ACK: Stacktrace; ID=2","ACK: loading failed; ID=3","M: Database service started; Q=1","ACK: snapshot loading; ID=4","ACK: fail; ID=5","M: Loading main DB snapshot; Q=4","M: Loading snapshot failed no stacktrace available; Q=2,3,4"] The query snapshot loading matches Loading main DB snapshot because both exact tokens occur, even though their order is reversed. The token fail does not match failed. The unmatched log Started processing events produces no message. Example 2 stream = ["Q: Error, timeout!","Q: timeout error","Q: error error","L: timeout... ERROR?","Q: timeout error","L: error only","L: Timeout/error"] return = ["ACK: Error, timeout!; ID=1","ACK: timeout error; ID=2","ACK: error error; ID=3","M: timeout... ERROR?; Q=1,2,3","ACK: timeout error; ID=4","M: error only; Q=3","M: Timeout/error; Q=1,2,3,4"] Punctuation separates tokens, matching is case-insensitive, and repeated query tokens count once. Identical query token sets still receive distinct IDs, so the last log reports both IDs 2 and 4. Example 3 stream = ["L: alpha beta","Q: alpha","L: beta alpha","Q: beta","L: alpha beta"] return = ["ACK: alpha; ID=1","M: beta alpha; Q=1","ACK: beta; ID=2","M: alpha beta; Q=1,2"] The first log has no previously registered queries, so it produces no message. Later query registrations do not change earlier results. Constraints 1 <= stream.length <= 2 * 10^4 The total length of all strings in stream is at most 2 * 10^5. Every event starts with exactly Q: or L:. Every payload contains at least one ASCII letter or digit. Every event contains only printable ASCII characters.
Reported by candidates. Source: FastPrep
Pattern and pitfall
The trick is an inverted index plus counting. For each query, store its distinct token count and add its ID to a map from token to a list of query IDs. For each log, build the set of distinct tokens, walk each token's list, and bump a counter per query ID. A query matches when its counter equals its distinct token count. Because each query is registered once and each token's list is only scanned for tokens in the log, total work stays near the input size. Sort the matched IDs before output. Pitfalls: counting duplicate tokens in a log twice, which inflates counters, and forgetting that logs only see queries registered earlier. Also keep the original payload text for output, but tokenize a separate lowercase copy. Strip the prefix carefully, since the payload keeps its spacing after Q: or L:. StealthCoder is your hedge in the live OA if the index design slips.
Drill it cold or hedge it with StealthCoder. Either way, don't walk into the OA hoping you remember the trick.
You can drill Query Log Match cold, or you can hedge it. StealthCoder runs invisibly during screen share and surfaces a working solution in under 2 seconds. The proctor sees the IDE. They don't see what's behind it. Made for the candidate who got the OA invite this morning and has 72 hours, not six months.
Get StealthCoderRelated leaked OAs
You've seen the question.
Make sure you actually pass Datadog's OA.
Datadog reuses patterns across OAs. Made for the candidate who got the OA invite this morning and has 72 hours, not six months. Works on HackerRank, CodeSignal, CoderPad, and Karat.
Query Log Match FAQ
How hard is the Datadog Query Log Match problem really?+
Medium. The rules are long but the logic is simple once you see it. The hard part is avoiding the brute-force scan of every query per log. If you know inverted indexes or counter-based matching, it's a clean implementation exercise.
What's the trick to beat the input limits?+
Map each token to the query IDs that contain it. For a log, count hits per query over its distinct tokens. A query matches when hits equal its distinct token count. That avoids comparing every query to every log.
What mistakes break the output most often?+
Counting repeated log tokens more than once, splitting on whitespace only instead of every non-alphanumeric character, and dropping the original payload formatting. Also, IDs must be sorted ascending, and duplicate queries still get their own IDs.
Do later queries affect earlier logs?+
No. A log only matches queries registered before it. Example 3 shows this: the first log produces nothing, and later registrations never rewrite earlier results. Process events strictly left to right and emit as you go.
How do I prepare for this in 48 hours?+
Write a tokenizer that lowercases and splits on non-alphanumeric characters, then build the token-to-IDs index with a per-log counter. Run the three examples by hand, especially the fail versus failed case and the duplicate query case. That covers nearly everything this problem tests.