Windowing Strategy
The choice of how a continuous stream is divided into finite groups for aggregation, which determines both the meaning of the result and the state it requires.
An unbounded stream cannot be aggregated without deciding what a group is. Four shapes cover most cases and they have quite different costs.
Tumbling windows are fixed-size and non-overlapping — hourly totals — and are the cheapest, since each record belongs to exactly one window. Hopping windows are fixed-size and overlapping — a five-minute total computed every minute — which multiplies state and output by the overlap factor, a detail that surprises people when their state size is five times what they estimated. Sliding windows are defined relative to each record, giving the most responsive answer at the highest cost. Session windows group by activity with a gap timeout, have no fixed boundary, and are the natural fit for user behaviour analysis.
Two practical points. Session windows can merge retroactively: an event arriving between two sessions joins them into one, which means previously emitted results must be retracted and recomputed, and downstream consumers must be built to handle that.
And windowing interacts directly with watermarks — the window cannot close until the watermark passes its end, so the effective latency of any windowed result is the window length plus the lateness allowance, which is the number to quote when someone asks how real-time the pipeline is.