Windowing
Grouping an unbounded stream into finite chunks so aggregation can produce results, defined over event time rather than arrival time.
A stream has no end, so COUNT(*) never returns. Windows impose boundaries.
Tumbling — fixed, non-overlapping, contiguous. Every event in exactly one window. "Orders per minute."
Sliding (hopping) — fixed size, advancing by a smaller step, so windows overlap and an event appears in several. "Five-minute average, updated every minute."
Session — bounded by a gap of inactivity rather than by the clock, so window length varies per key. The right shape for user sessions, where the natural boundary is "stopped doing things".
Global — one window for everything, useful with a custom trigger.
The decision underneath all of them is which clock. Event time is when the thing happened; processing time is when your system saw it. Event time gives correct, reproducible, replayable results and requires handling data that arrives late. Processing time is simple and produces different answers on every re-run, which makes it unusable for anything that must reconcile.
Use event time for anything reported, billed or reconciled. Use processing time only for monitoring, where approximate and immediate beats correct and delayed.