Event Time Versus Processing Time
The distinction between when something happened and when the system saw it, which determines whether results are reproducible.
Two clocks are available. Processing time is the wall clock when a record arrives at the operator; it is always available, requires no coordination and never waits. Event time is the timestamp carried in the record, describing when the thing actually occurred.
Windowing by processing time is simple and gives answers that depend on the weather. A network delay, a consumer restart or a backfill puts records into different windows than they belong in, and replaying the same input produces different output — which makes the pipeline untestable and its results unauditable.
Windowing by event time gives reproducible results: the same input always produces the same windows, whenever it is processed. The price is that the system must decide when a window is complete despite records still potentially arriving, which is the entire watermark problem.
The rule that follows: aggregate by event time whenever the result is a business figure someone will compare across runs. Processing time is defensible for operational monitoring, where "how many errors in the last minute of wall clock" is exactly the question being asked.