Flink Windows Explained
A Flink window divides an infinite stream into finite, bounded buckets so you can compute aggregations (count, sum, max) over time. Without windows, you cannot aggregate a streaming dataset — you need to bound it first. Flink provides three main window types: tumbling (fixed, non-overlapping), sliding (overlapping), and session (gap-based).
Window Types at a Glance
Events: ● ● ● | ● ● ● | ● ● ●
Tumbling: [--W1---] [--W2---] [--W3---] no overlap
Sliding: [--W1---]
[--W2---]
[--W3---] overlapping
Session: [---active---] gap [---new---] gap-based
The Three Window Types
Tumbling Window
Fixed-size, non-overlapping windows. Every event falls into exactly one window. When the window ends, it fires and a new one starts immediately. No event is counted twice.
# Count transactions per customer in each 1-min window
stream
.key_by(lambda t: t.customer_id)
.window(TumblingEventTimeWindows.of(Time.minutes(1)))
.aggregate(CountAggregateFunction())
Best for: hourly/daily reports, periodic fraud velocity counts, batched aggregations.
Sliding Window
Overlapping windows of fixed size that slide at a set interval. Each event can appear in multiple windows. A 5-minute window sliding every 1 minute produces 5 overlapping buckets at any moment.
# 5-min rolling average, updated every 1 min
stream
.key_by(lambda t: t.customer_id)
.window(SlidingEventTimeWindows.of(
Time.minutes(5), # window size
Time.minutes(1) # slide interval
))
.aggregate(AvgAggregateFunction())
Best for: rolling averages, moving sums, smoothed metrics dashboards.
Session Window
Dynamic windows that group events separated by less than a gap timeout. Sessions grow as long as events keep arriving within the gap. When the gap expires, the session closes and a new one can start.
# Group user events into sessions (30 min inactivity gap)
stream
.key_by(lambda e: e.user_id)
.window(EventTimeSessionWindows.with_gap(
Time.minutes(30)
))
.process(SessionSummaryProcessFunction())
Best for: user session analysis, click-stream aggregation, IoT activity bursts.
Window Type Comparison
| Property | Tumbling | Sliding | Session |
|---|---|---|---|
| Size | Fixed | Fixed | Variable |
| Overlap | None | Yes | None |
| Event appears in N windows | 1 | size ÷ slide | 1 |
| Closed by | Time elapsed | Slide interval | Gap timeout |
| Memory usage | Low | Higher (ratio) | Depends on activity |
| Best for | Periodic reports | Rolling metrics | User sessions |
Event Time vs Processing Time
All three window types can operate in event time (timestamp embedded in the event) or processing time (wall clock when Flink processes it). Always prefer event time in production — it produces deterministic, reproducible results even when events arrive late or out of order.
Processing Time ✗
- • Non-deterministic — results change on replay
- • Breaks when events arrive out of order
- • Wrong results after job restart
- • Only use for prototype/dev
Event Time ✓
- • Deterministic — same input = same output
- • Handles late / out-of-order data via watermarks
- • Correct on replay and after restart
- • Required for production pipelines
Common Mistakes
Using processing time in production
Processing time is non-deterministic — if you replay the same events, you get different window assignments. Always assign event-time timestamps and configure watermarks for production pipelines.
Sliding window slide interval too small
A 1-hour window sliding every 1 second creates 3600 overlapping windows per key. Each event is held in memory for all active windows it belongs to. This can cause memory pressure. Keep the size-to-slide ratio reasonable (typically ≤ 10×).
Forgetting allowedLateness for late data
By default, Flink drops events that arrive after the watermark passes the window end. Use .allowed_lateness(Time.minutes(1)) to re-fire the window when late events arrive within that grace period.
FAQ
- What are windows in Apache Flink?
- Windows divide an infinite stream into finite buckets for aggregation. Flink supports tumbling (fixed, non-overlapping), sliding (overlapping), and session (gap-based) windows, all in event time or processing time.
- What is the difference between tumbling and sliding windows in Flink?
- Tumbling windows are non-overlapping — each event falls into exactly one window. Sliding windows overlap — each event can appear in multiple windows. Use tumbling for periodic reports, sliding for rolling averages.
- What is a session window in Flink?
- A session window groups events within a time gap. When no event arrives for longer than the gap timeout, the session closes. Sessions have variable length and are useful for user activity analysis.
- Should I use event time or processing time for Flink windows?
- Always event time in production. Processing time is non-deterministic and breaks when events arrive out of order or when the job restarts. Set up watermarks on your source to enable event-time windowing.