Specifications

156 CHAPTER 8 Complex Event Processing with StreamInsight

Event Windows

A window represents a subset of data from an event stream for a period of time. After you

create a stream of windows, you can perform aggregation, TopK (a LINQ operation described

later in this chapter), or user-dened operations on the events that the windows contain. For

example, you can count the number of events in each window.

You might be inclined to think of a window as a way to partition the event stream by time.

However, the analogy between a window and a partition is useful only up to a point. When

you partition records in a table, a record belongs to one and only one partition, but an event

can appear in multiple windows based on its start time and end time. That is, the window

that covers the time period that includes an event’s start time might not include the event’s

end time. In that case, the event appears in each subsequent window, with the nal window

covering the period that includes the event’s end time. Therefore, you should instead think of

a window as a way to partition time that is useful for performing operations on events occur-

ring between the two points of time that dene a window.

In Figure 8-2, each unlabeled box below the input stream represents a window and con-

tains multiple events for the period of time that the window covers. In this example, the input

stream contains three events, but the rst three windows contain two events and the last

window contains only one event. Thus, a count aggregation on each window yields results

different from a count aggregation on an input stream.

60 90 120

Input

events

Time (minutes)

FIGURE 8-2 Event windows in an input stream