{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 26,
   "id": "ed083f23-2556-4577-b770-36a087bf4566",
   "metadata": {},
   "outputs": [],
   "source": [
    "from pyspark.sql import SparkSession\n",
    "import pyspark.sql.functions as F\n",
    "\n",
    "spark = SparkSession.builder.appName(\"some_name\").getOrCreate()\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "id": "a9ae7a2b-7a96-4816-8b2d-8bf6b72aaffd",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "+---------+----------+--------+----------------------------------+\n",
      "|log_level|date      |time    |message                           |\n",
      "+---------+----------+--------+----------------------------------+\n",
      "|INFO     |2025-07-30|12:00:00|User logged in                    |\n",
      "|DEBUG    |2025-07-30|12:01:00|Session started                   |\n",
      "|ERROR    |2025-07-30|12:02:00|Database connection failed        |\n",
      "|INFO     |2025-07-30|12:03:00|User clicked button               |\n",
      "|ERROR    |2025-07-30|12:04:00|Timeout while waiting for response|\n",
      "|DEBUG    |2025-07-30|12:05:00|Memory usage: 75%                 |\n",
      "|ERROR    |2025-07-30|12:06:00|NullPointerException              |\n",
      "+---------+----------+--------+----------------------------------+\n",
      "\n"
     ]
    }
   ],
   "source": [
    "parts = F.split(F.col(\"value\"), \" \", 4)\n",
    "df_logs = spark.read.text(\"logs.txt\").select(\n",
    "    parts[0].alias(\"log_level\"),\n",
    "    parts[1].alias(\"date\"),\n",
    "    parts[2].alias(\"time\"),\n",
    "    parts[3].alias(\"message\")\n",
    ")\n",
    "\n",
    "df_logs.show(truncate=False)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "id": "31c2f26f-9a47-4a60-9d46-de6c5742b524",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "+---------+----------+--------+----------------------------------+\n",
      "|log_level|date      |time    |message                           |\n",
      "+---------+----------+--------+----------------------------------+\n",
      "|ERROR    |2025-07-30|12:02:00|Database connection failed        |\n",
      "|ERROR    |2025-07-30|12:04:00|Timeout while waiting for response|\n",
      "|ERROR    |2025-07-30|12:06:00|NullPointerException              |\n",
      "+---------+----------+--------+----------------------------------+\n",
      "\n"
     ]
    }
   ],
   "source": [
    "df_logs_error = df_logs.filter(F.col(\"log_level\") == \"ERROR\")\n",
    "df_logs_error.show(truncate=False)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "id": "e3d10e1d-3c62-4c98-9404-81c9aa54d5f0",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "+---------+----------+--------+----------------------------------+----+\n",
      "|log_level|date      |time    |message                           |hour|\n",
      "+---------+----------+--------+----------------------------------+----+\n",
      "|ERROR    |2025-07-30|12:02:00|Database connection failed        |12  |\n",
      "|ERROR    |2025-07-30|12:04:00|Timeout while waiting for response|12  |\n",
      "|ERROR    |2025-07-30|12:06:00|NullPointerException              |12  |\n",
      "+---------+----------+--------+----------------------------------+----+\n",
      "\n"
     ]
    }
   ],
   "source": [
    "df_logs_error = df_logs_error.withColumn(\"hour\", F.substring(\"time\", 1, 2).cast(\"int\"))\n",
    "df_logs_error.show(truncate=False)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "id": "fd6d5a08-e464-4d62-bd93-7f118db53f6e",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "+----+-----+\n",
      "|hour|count|\n",
      "+----+-----+\n",
      "|  12|    3|\n",
      "+----+-----+\n",
      "\n"
     ]
    }
   ],
   "source": [
    "df_count_errors_by_hour = df_logs_error.groupBy(\"hour\").count()\n",
    "df_count_errors_by_hour.show()"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.12.3"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}