Amazon·Software Engineer·Onsite - System Design / Architecture·Senior

SeniorPrefer not to say

Jun 2026

Summary

Amazon system design round for a software engineer role. One big open-ended question about building a streaming log pipeline, and they really wanted to see how deep you'd go on the operational side, not just the happy path.

Questions Asked (1)

Design a core component for a streaming system that ingests log events from multiple upstream services. The system must filter for error logs only, track per-service error counts in real time, compute a moving average of error rates over a sliding time window, and trigger alerts when a service crosses a defined threshold. Walk through your architecture, state management, windowing strategy, and how you handle late-arriving events, horizontal scale, and fault tolerance.

System DesignTechnical Trade-offsData Modeling

Author's notes

I started with the filter layer and Kafka partitioned by service_id, which felt solid.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and constraints, then propose a high-level architecture using a distributed stream processing framework like Apache Flink or Kafka Streams. Walk through each component (ingestion, filtering, windowing, state management, alerting) and explicitly address late events, scaling, and fault tolerance with trade-offs.

Pro tip: Emphasize how you would handle late-arriving events with watermarks and allowed lateness, and discuss the trade-off between accuracy and latency in alerting. Also, mention using a distributed state store with checkpointing for fault tolerance.

1. Clarify Requirements and Constraints

Ask about expected throughput, latency requirements, data sources, and alerting mechanisms. Confirm the definition of 'error logs' and the sliding window size.

2. High-Level Architecture

Propose an ingestion layer (e.g., Kafka) to collect logs, a stream processing layer (e.g., Flink) for filtering, windowing, and stateful computations, and a sink for alerts and metrics.

3. Detailed Component Design

Explain filtering (e.g., using a filter operator), per-service error counts (keyed state), sliding window moving average (window assigner with allowed lateness), and threshold-based alerting (process function with timers).

4. Handle Late Events, Scaling, and Fault Tolerance

Describe watermarks and allowed lateness for late data, horizontal scaling via partitioning by service ID, and fault tolerance through checkpointing and exactly-once semantics.

5. Trade-offs and Alternatives

Discuss trade-offs between different windowing strategies (e.g., sliding vs. tumbling), state backends, and processing guarantees. Mention alternatives like using a time-series database for metrics.

Key Points to Mention

Use of a distributed message queue (e.g., Kafka) for ingestion to handle high throughput and decouple producers.
Stream processing framework (e.g., Apache Flink) with keyed state for per-service error counts and windowing for moving averages.
Watermarks and allowed lateness to handle out-of-order events, with a trade-off between latency and completeness.
Horizontal scaling via partitioning by service ID and parallel processing, ensuring state is partitioned accordingly.
Fault tolerance through checkpointing, state backups, and exactly-once processing semantics.
Alerting mechanism: use side outputs or a separate sink to trigger alerts when thresholds are crossed, possibly with deduplication.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.