A hopping window repeatedly evaluates a recent slice of a time-ordered event stream. The slice refreshes at a configured hop frequency, so consecutive evaluations can retain some preceding data points. This produces smoother changes in aggregates than fully separate intervals, but requires more computation because the events entering and leaving can vary between hops. section 8.4.1 section 8.10
Use hopping windows in Fluent Bit stream processing when an aggregation needs near-real-time sensitivity without reacting to every isolated fluctuation. They are suited to smoothing network-traffic spikes or drops and application-workload fluctuations so that true anomalies are easier to distinguish from false positives. section 8.4.4 section 8.10
Configure a hopping-window stream task by choosing two durations:
- Set the window size: the interval of recent events included in each calculation. section 8.4.1
- Set ADVANCE BY: the hop duration that determines how often the window moves and the query is evaluated. section 8.4.1
- Balance responsiveness against processing cost: a 10-second window advancing every 5 seconds over one minute performs 11 hopping calculations, versus 6 tumbling calculations. section 8.4.4
- Validate the configuration rather than maximizing smoothing: excessive smoothing can hide true outliers, while overly long trends can lose measurement value. section 8.4.4
Listing 8.4 Stream processor with hopping window: query3.conf
[STREAM_TASK] name selectTaskWithTag #1 exec SELECT record_tag(), rand_value FROM TAG:'random-num'; [STREAM_TASK] name selectSumTask exec SELECT now(), sum(rand_value) FROM TAG:'random-num' WINDOW HOPPING (4 SECOND, ADVANCE BY 2 SECOND); #2
This stream-task configuration sums rand_value over a 4-second window and advances the calculation every 2 seconds. section 8.4.1
Predictable overlapping sums
Feed a tagged dummy event with rand_value set to 2 once per second, then run Fluent Bit with the stream configuration. The initial four-event window produces a sum of 8; later output shows a sum of 12 as the hopping calculation continues over refreshed event sets. section 8.4.1


