log_fixture
2026-07-20 10:01 ERROR svc=payments msg=timeout 2026-07-20 10:02 INFO svc=payments msg=ok 2026-07-20 10:03 ERROR svc=auth msg=bad_token
query_languagePython + regex
parsing_or_query_code
from collections import Counter import re errors = Counter(re.search(r'svc=(\w+)', l).group(1) for l in lines if 'ERROR' in l) result = dict(errors)
expected_extracted_metrics
{
"payments": 1,
"auth": 1
}