liveBook · Manning

Hopping window

As explained in Logs and Telemetry

A hopping window is a stream-processing time window whose successive intervals advance by a hop duration that can be shorter than the window duration, allowing overlap.

A hopping window repeatedly evaluates a recent slice of a time-ordered event stream. The slice refreshes at a configured hop frequency, so consecutive evaluations can retain some preceding data points. This produces smoother changes in aggregates than fully separate intervals, but requires more computation because the events entering and leaving can vary between hops. section 8.4.1 section 8.10

Use hopping windows in Fluent Bit stream processing when an aggregation needs near-real-time sensitivity without reacting to every isolated fluctuation. They are suited to smoothing network-traffic spikes or drops and application-workload fluctuations so that true anomalies are easier to distinguish from false positives. section 8.4.4 section 8.10

Configure a hopping-window stream task by choosing two durations:

  • Set the window size: the interval of recent events included in each calculation. section 8.4.1
  • Set ADVANCE BY: the hop duration that determines how often the window moves and the query is evaluated. section 8.4.1
  • Balance responsiveness against processing cost: a 10-second window advancing every 5 seconds over one minute performs 11 hopping calculations, versus 6 tumbling calculations. section 8.4.4
  • Validate the configuration rather than maximizing smoothing: excessive smoothing can hide true outliers, while overly long trends can lose measurement value. section 8.4.4
Listing 8.4 Stream processor with hopping window: query3.conf
 [STREAM_TASK]
  name selectTaskWithTag     #1
  exec SELECT record_tag(), rand_value FROM TAG:'random-num';

[STREAM_TASK]
  name selectSumTask
  exec SELECT now(), sum(rand_value) FROM TAG:'random-num' 
 WINDOW HOPPING (4 SECOND, ADVANCE BY 2 SECOND);    #2

This stream-task configuration sums rand_value over a 4-second window and advances the calculation every 2 seconds. section 8.4.1

Predictable overlapping sums

Feed a tagged dummy event with rand_value set to 2 once per second, then run Fluent Bit with the stream configuration. The initial four-event window produces a sum of 8; later output shows a sum of 12 as the hopping calculation continues over refreshed event sets. section 8.4.1

How Logs and Telemetry covers it

How deep it goes
Explains refresh behavior, smoothing effects, configuration syntax, runnable input, output, and computational trade-offs against tumbling windows.
Examples
Demonstrates a 4-second window advancing every 2 seconds over dummy rand_value events emitted once per second.
What it assumes
Introduces window intuition from zero through a moving-train analogy before using stream-query configuration.
What you can do after
Apply it via Fluent Bit stream-task configuration to calculate smoothed near-real-time aggregates.
How it connects
Connects stream processors, aggregation functions, tumbling windows, streams, tags, and time-series calculations.

Also explained in

Compare how 3 books explain hopping window →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Logs and Telemetry. The section links point to the parts of the book it draws on.