Why windows exist
You cannot sum an unbounded stream because it never ends. Windowing slices the stream into finite chunks so an aggregation has a defined start and end. The choice of window shapes the meaning of every result.
Common window types
- Tumbling windows are fixed size and non overlapping, like every five minutes. Each event belongs to exactly one window.
- Sliding windows are fixed size but overlap by a slide step, like a five minute window every minute. Events can fall into several windows.
- Session windows group bursts of activity separated by a gap of inactivity, so their length is data driven.
Time semantics matter
Windows are usually defined over event time, the time an event happened, not processing time, when it was seen. Event time gives correct results even when events arrive out of order or delayed.
Choosing a window
Tumbling fits clean periodic reports, sliding fits smooth moving metrics, and session fits user activity bursts.
Key idea
Windowing divides an endless stream into finite tumbling, sliding, or session intervals, usually over event time, so aggregations can complete and emit results.