Comparison
Session windowvsSliding window
Session window
the window has no fixed length; it just stays open until the user does nothing for thirty minutes, and then it closes.
A window defined by inactivity rather than by the clock: events for a key are grouped until a gap longer than the timeout appears. It is the natural shape for anything that is about a visit, a conversation or a driving trip, and it is the most expensive of the three because window boundaries are data-dependent and two sessions merge when a late event lands between them. Restarts and late data are correspondingly harder, because a session's identity can change after the fact.
Full entry →Sliding window
you want 'five errors in any sixty seconds', so every event is counted in twelve overlapping windows at once.
Fixed-length windows that advance by less than their length, so they overlap and a record falls into several. It is what you use for rolling alerts and moving averages, where the question is about any period of length N rather than about clock-aligned buckets. The cost is multiplication: state and output volume scale with length divided by slide, so a one-hour window sliding every minute is sixty times the work of the tumbling version.
Full entry →