Comparison
Session windowvsTumbling window
Session window
the window has no fixed length; it just stays open until the user does nothing for thirty minutes, and then it closes.
A window defined by inactivity rather than by the clock: events for a key are grouped until a gap longer than the timeout appears. It is the natural shape for anything that is about a visit, a conversation or a driving trip, and it is the most expensive of the three because window boundaries are data-dependent and two sessions merge when a late event lands between them. Restarts and late data are correspondingly harder, because a session's identity can change after the fact.
Full entry →Tumbling window
every event lands in exactly one five-minute bucket and the buckets sit end to end with no gaps.
Fixed-length, non-overlapping windows: each record belongs to exactly one. It is the shape almost every reporting requirement actually wants — hourly totals, daily counts — because each result is independent and sums cleanly. Its edges are arbitrary, which is the only real complaint against it: a burst straddling 14:59 and 15:01 shows as two unremarkable windows rather than one spike.
Full entry →