Access-Log Request Metrics

Given a list of HTTP access-log lines, each meant to hold an IP address, a timestamp, a URL path and a status code: parse each line, decide whether it is a valid log, and report the number of 4xx and 5xx responses, the failure percentage, and the total request count.

A line is four fields separated by single spaces:

10.0.0.7 2026-03-01T12:00:00Z /api/users 200

It is valid only when every field checks out:

• the IP is four dotted decimal octets, each 0–255 with no leading zeros (01.1.1.1 is invalid);
• the timestamp is YYYY-MM-DDTHH:MM:SSZ and names a real calendar date and time (2023-02-29 and hour 24 are invalid);
• the path starts with /;
• the status is exactly three digits in 100–599.

Anything else is malformed: counted in the total, excluded from every other number.

Return a report:

{
  totalLines, valid, malformed,
  count4xx, count5xx,
  failurePct,   // (count4xx + count5xx) / valid * 100, rounded to 2 decimals; 0 when nothing is valid
  endpoints     // [[path, hits, failures], ...] over valid lines,
                // sorted by failures desc, then hits desc, then path asc
}

A 3xx is not a failure. failurePct is computed over valid lines, not all lines.

The real file is 200 GB, so the code must stream: one pass, nothing retained per line, state proportional to the number of distinct endpoints.