Comparison
Sliding windowvsTumbling window
Sliding window
you want 'five errors in any sixty seconds', so every event is counted in twelve overlapping windows at once.
Fixed-length windows that advance by less than their length, so they overlap and a record falls into several. It is what you use for rolling alerts and moving averages, where the question is about any period of length N rather than about clock-aligned buckets. The cost is multiplication: state and output volume scale with length divided by slide, so a one-hour window sliding every minute is sixty times the work of the tumbling version.
Full entry →Tumbling window
every event lands in exactly one five-minute bucket and the buckets sit end to end with no gaps.
Fixed-length, non-overlapping windows: each record belongs to exactly one. It is the shape almost every reporting requirement actually wants — hourly totals, daily counts — because each result is independent and sums cleanly. Its edges are arbitrary, which is the only real complaint against it: a burst straddling 14:59 and 15:01 shows as two unremarkable windows rather than one spike.
Full entry →