Differentially private search log sanitization with optimal output utility