📝 Lesson 5.3: Capstone Project

What We're Building

A log analyzer: given large log files, it counts entries by severity level (INFO/WARN/ERROR), finds the busiest minute, and reports the results — fast, with minimal allocation, across multiple cores, and cancellable if it takes too long.

Every feature draws on an Advanced module:

Architecture

We define capabilities as interfaces and wire concrete implementations with DI (Module 5). Each layer has one job, and the analyzer depends only on abstractions — so any piece can be swapped or tested in isolation.

We'll assume log lines look like: 2026-08-07 14:03:22 ERROR Something failed.

Step 1: Model & Span Parsing

The result of parsing one line is a small immutable value — a readonly record struct (a value type with value equality, Modules 4 & Intermediate) so parsing millions of lines allocates nothing per entry:

// Model/LogEntry.cs
public readonly record struct LogEntry(DateTime Timestamp, LogLevel Level);

public enum LogLevel { Info, Warn, Error, Unknown }

The parser works over a ReadOnlySpan<char> (Module 4) — no Split, no substrings:

// Parsing/SpanLogParser.cs
public interface ILogParser
{
    bool TryParse(ReadOnlySpan<char> line, out LogEntry entry);
}

public sealed class SpanLogParser : ILogParser
{
    public bool TryParse(ReadOnlySpan<char> line, out LogEntry entry)
    {
        entry = default;
        // "yyyy-MM-dd HH:mm:ss LEVEL message"
        if (line.Length < 20) return false;

        ReadOnlySpan<char> dateSpan = line.Slice(0, 19);
        if (!DateTime.TryParse(dateSpan, out DateTime ts)) return false;

        ReadOnlySpan<char> rest = line.Slice(20);          // after the timestamp + space
        int spaceIdx = rest.IndexOf(' ');
        ReadOnlySpan<char> levelSpan = spaceIdx < 0 ? rest : rest.Slice(0, spaceIdx);

        LogLevel level = levelSpan switch                  // pattern matching on a span
        {
            "INFO"  => LogLevel.Info,
            "WARN"  => LogLevel.Warn,
            "ERROR" => LogLevel.Error,
            _       => LogLevel.Unknown
        };

        entry = new LogEntry(ts, level);
        return true;
    }
}

Step 2: Async Stream Reader

The source streams lines as an IAsyncEnumerable<string> (Module 3) with cancellation support — so huge files are never fully loaded into memory, and a read can be stopped:

// Reading/FileLogSource.cs
using System.Runtime.CompilerServices;

public interface ILogSource
{
    IAsyncEnumerable<string> ReadLinesAsync(CancellationToken token = default);
}

public sealed class FileLogSource : ILogSource
{
    private readonly string _path;
    public FileLogSource(string path) => _path = path;

    public async IAsyncEnumerable<string> ReadLinesAsync(
        [EnumeratorCancellation] CancellationToken token = default)
    {
        using var reader = new StreamReader(_path);       // using = disposed (Intermediate)
        string? line;
        while ((line = await reader.ReadLineAsync(token)) is not null)
        {
            yield return line;                            // stream each line lazily
        }
    }
}

Step 3: Parallel Aggregation

Counting is CPU-light per line but there are millions of lines, so we batch and aggregate with thread-safe counters (Module 2). We use Interlocked on an array indexed by level — lock-free and fast:

// Aggregation/CountAggregator.cs
public sealed record AnalysisResult(long Info, long Warn, long Error, long Total);

public interface IAggregator
{
    void Add(LogEntry entry);
    AnalysisResult GetResult();
}

public sealed class CountAggregator : IAggregator
{
    // one counter per LogLevel; Interlocked makes increments thread-safe (Module 2)
    private readonly long[] _counts = new long[4];

    public void Add(LogEntry entry) => Interlocked.Increment(ref _counts[(int)entry.Level]);

    public AnalysisResult GetResult() => new(
        Info:  _counts[(int)LogLevel.Info],
        Warn:  _counts[(int)LogLevel.Warn],
        Error: _counts[(int)LogLevel.Error],
        Total: _counts.Sum());
}

Step 4: DI & Cancellation

The LogAnalyzer orchestrates the pieces — but depends only on the interfaces (Module 5), so each is swappable and testable. It reads the async stream in batches, parses+counts each batch in parallel, and honors a CancellationToken (Module 3):

// LogAnalyzer.cs
public sealed class LogAnalyzer
{
    private readonly ILogSource _source;
    private readonly ILogParser _parser;
    private readonly IAggregator _aggregator;

    public LogAnalyzer(ILogSource source, ILogParser parser, IAggregator aggregator)
    {
        _source = source;
        _parser = parser;
        _aggregator = aggregator;
    }

    public async Task<AnalysisResult> AnalyzeAsync(CancellationToken token = default)
    {
        var batch = new List<string>(capacity: 10_000);

        await foreach (string line in _source.ReadLinesAsync(token))   // async stream
        {
            batch.Add(line);
            if (batch.Count >= 10_000)
            {
                ProcessBatch(batch);
                batch.Clear();
            }
        }
        ProcessBatch(batch);                 // final partial batch
        return _aggregator.GetResult();
    }

    private void ProcessBatch(List<string> batch)
    {
        Parallel.ForEach(batch, line =>      // parse + count across cores (Module 2)
        {
            if (_parser.TryParse(line, out LogEntry entry))
            {
                _aggregator.Add(entry);
            }
        });
    }
}

The composition root wires everything with the DI container (Module 5):

// Program.cs
using Microsoft.Extensions.DependencyInjection;

var services = new ServiceCollection();
services.AddSingleton<ILogSource>(_ => new FileLogSource("app.log"));
services.AddSingleton<ILogParser, SpanLogParser>();
services.AddSingleton<IAggregator, CountAggregator>();
services.AddSingleton<LogAnalyzer>();

using var provider = services.BuildServiceProvider();
var analyzer = provider.GetRequiredService<LogAnalyzer>();

// Cancel if it takes longer than 30 seconds (Module 3)
using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(30));

try
{
    AnalysisResult result = await analyzer.AnalyzeAsync(cts.Token);
    Console.WriteLine($"Total: {result.Total:N0}  " +
                      $"INFO: {result.Info:N0}  WARN: {result.Warn:N0}  ERROR: {result.Error:N0}");
}
catch (OperationCanceledException)
{
    Console.WriteLine("Analysis timed out.");
}

Step 5: Benchmarking

Finally, prove the design choices with BenchmarkDotNet (Module 4). Compare the span parser against a naive Split-based one, and the parallel analyzer against a sequential version:

[MemoryDiagnoser]
public class ParserBenchmarks
{
    private readonly string _line = "2026-08-07 14:03:22 ERROR Disk full on node 7";
    private readonly SpanLogParser _span = new();

    [Benchmark(Baseline = true)]
    public LogLevel NaiveSplit()
    {
        string[] parts = _line.Split(' ');            // allocates an array + strings
        return parts[2] switch
        {
            "INFO" => LogLevel.Info, "WARN" => LogLevel.Warn,
            "ERROR" => LogLevel.Error, _ => LogLevel.Unknown
        };
    }

    [Benchmark]
    public LogLevel SpanParse()
    {
        _span.TryParse(_line, out LogEntry entry);    // zero allocation
        return entry.Level;
    }
}

Make It Your Own

Extend the analyzer — each challenge exercises advanced skills you've built.

Course Wrap-Up

🚀 Where to Go Next

• Build real systems: ASP.NET Core web APIs and services, where DI, async, and these performance skills are used daily
• Data at scale: Entity Framework Core, and high-throughput data pipelines
• Go lower still: source generators, System.IO.Pipelines, SIMD/System.Numerics, and native/AOT compilation
• Distributed & cloud: messaging, resilience (Polly), and observability for production services
• Deepen the craft: software architecture, domain-driven design, and advanced testing

📚 Recommended Resources

• Microsoft C# Documentation
• .NET fundamentals
• BenchmarkDotNet