A stakeholder asks for an alert on errors in the last five minutes. What must be pinned down before it can be computed?

## Why the phrase is not yet a computation Every aggregate over an endless input needs a boundary, and a phrase like *the last five minutes* names a duration without naming a boundary. Three different shapes all honour those words: | reading | shape | behaviour | |---|---|---| | a fresh five-minute count, on the grid | back-to-back equal spans | one result every five minutes; the count restarts from zero at each boundary | | a rolling five minutes | five-minute span restarted every step | one result per step; consecutive results share most of their records | | always the trailing five minutes | no interval; a running value with a five-minute expiry | one continuously restated value per key | They are not interchangeable. On the same input the first will report a quiet interval where the second reports a breach, because a burst split across a grid boundary is divided between two groups and neither total crosses the threshold, while a rolling span always has a group that contains the whole burst. ## The five things to settle 1. **The shape.** Which of the three readings above. This is the question to ask first, because the others depend on it. 2. **The refresh step**, if the shape is the rolling one. Five minutes refreshed every minute is five groups covering each record and five times the output rows; refreshed every ten seconds it is thirty of each. The step is bought, not free. 3. **The grouping key.** One global count, one per service, one per host, one per customer. This decides how many results exist at once and, just as importantly, what the alert means: a global figure hides one host failing completely, and a per-host figure alerts on every deployment. 4. **The moment the boundary reads.** The one the pipeline assigned from the record, describing when the thing happened, or the one the worker observed. Which to choose, and what it does to correctness, is a separate subject — but the requirement is not complete until it says which, and a pipeline that never assigned a moment is silently grouping by arrival. 5. **The predicate.** What an error is: a status class, a level in a log line, a named exception category. Interviewers rarely dwell here, but a grouping over an unspecified filter is not a specification. ## The things that are adjacent and should be named, not solved A good answer names these and hands them back rather than silently picking: - **When the result is handed downstream**, and whether a group may be handed down more than once as a corrected value, is a separate decision that can be attached to any of the three shapes. - **Whether a record that turns up after its group was declared finished is accepted**, and what happens to a number already published, is likewise separate. - **What holding the groups open costs** is a real constraint but a different subject: what belongs in the shape conversation is only that a shorter refresh step means proportionally more open groups. - **The threshold and the alert policy** are not part of the grouping. A rolling shape re-evaluates the same underlying burst against many overlapping groups, so whoever owns alerting has to expect repeats. ## Worked translation The answer an interviewer wants sounds like a proposal with the choices exposed: - *I would read it as a five-minute span restarted every minute, per service, measured on the moment carried on the record, over log lines at error level or worse.* - *That is five overlapping groups covering every record, so five rows per service per five minutes, and a burst is caught wherever it falls rather than only when it aligns with a grid.* - *If the cost of those rows is not wanted, the alternative is back-to-back five-minute spans, and the cost of that is a burst split across a boundary going unreported.* - *If they want a figure that is never stale, the third reading — a running value with a five-minute expiry on what it counts — is closest to what people mean by the last five minutes, and it produces no interval-shaped rows at all.* ## Why this is asked The question tests whether a candidate can turn business language into a definite grouping without inventing the missing parts silently. Choosing the grid shape because it is the cheapest to compute, and not saying so, is the failure mode: the number is then wrong in a specific, predictable way that nobody downstream knows about. Naming the shape, the step, the key, the clock and the predicate — and saying which of them you guessed — is the whole of the skill here.