Windows

from <stream-name> {<conditions>}#window.<window-name>(<parameters>)
select ( {<attribute-name>} | ‘*’ |)
insert [<output-type>] into <stream-name> 

Window is a limited subset of events from an event stream. Users can define a window and then use the events on the window for calculations. A window has two types of output: current events and expired events. A window emits current events when a new event arrives. Expired events are emitted whenever an existing event has expired from a window.

There are several types of windows.

1. Length window - a sliding window that keeps last N events.
2. Time window - a sliding window that keeps events arrived within the last T time period.
3. Time batch window - a time window that processes events in batches. A loop collects the incoming events arrived within last T time period, and outputs them as a batch.
4. Length batch window - a length window that outputs events as a batch only at the nth event arrival.
5. Time length window (not supported in the current version) - a sliding window that keeps the last N events that arrived within the last T time period.
6. Unique window - keeps only the latest events that are unique according to the given unique attribute.
7. First unique window  - keeps the first events that are unique according to the given unique attribute.
8. External Time Window - a sliding window that processes according to timestamps defined externally (Defined as an attribute in the incoming stream) 

Siddhi queries can have three different output types: ‘current-events’, ‘expired-events’ and ‘all-events’. Users can define these output types by adding the following keywords in between ‘insert’ and ‘into’ in the syntax.

• ‘current-events’ keyword : The output is only triggered when new events arrive at the window. Notifications will not be given when the expired events trigger the query from the window.
• ‘expired-events’ keyword : The query emits output only when the expired events trigger it from the window and not from new events.
• ‘all-events’ keyword : The query emits output when it is triggered by both newly-arrived and expired events from the window.
• No keyword is given : By default, the query assigns ‘current-events’ to its output stream.

In output event streams, users can define aggregate functions to calculate aggregations within the defined window. CEP supports the following types of aggregate functions.

1. sum
2. avg
3. max
4. min
5. count
6. median (not supported in current version)
7. stddev (not supported in current version) 
8. avedev (not supported in current version) 

Aggregate function must be named using ‘as’ keyword. Thus name can be used for referring that attribute, and will be used as the attribute name in the output stream. Following examples shows some queries.

Stream  defined by "define stream StockExchangeStream (symbol string, price int, volume float );" is used in below queries.

Length window

A sliding window that keeps last N events.

From the events having price >= 20 of the StockExchangeStream stream, output the expiring events of the length window to the StockQuote stream. Here the output events will have symbol and the per symbol average price as their attributes, only if the  per symbol average price > 50.

from StockExchangeStream[price >= 20]#window.length(50) 
select symbol, avg(price) as avgPrice
group by symbol having avgPrice>50 
insert into StockQuote for expired-events 

In the above query, avg(prize) is an aggregate function.

Time window

A sliding window that keeps events arrived within the last T time period.

From the events having symbol == 20 of the StockExchangeStream stream, output the both the newly arriving and expiring events of the time window to the IBMStockQuote stream. Here the output events will have maximum, average and minimum prices that has arrived within last minute as their attributes.

from StockExchangeStream[symbol == 'IBM']#window.time( 1 min ) 
select max(price) as maxPrice, avg(price) as avgPrice, min(price) as minPrice
insert into IBMStockQuote for all-events  

Time batch window

A time window that processes events in batches. This in a loop collects the incoming events arrived within last T time period and outputs them as a batch.

From the events of the StockExchangeStream stream, output the events per every 2 minutes from the timeBatch window to the StockQuote stream. Here the output events will have symbol and the per symbol sum of volume for last 2 minutes as their attributes.

from StockExchangeStream#window.timeBatch( 2 min ) 
select symbol, sum(volume) as totalVolume
group by symbol 
insert into StockQuote 

Length batch window

A length window that outputs events as a batch only at the nth event arrival.

From the events having price >= 20 of the StockExchangeStream stream, output the expiring events of the lengthBatch window to the StockQuote stream. Here the output events will have symbol and the per symbol average price> 50 as their attributes.

from StockExchangeStream[price >= 20]#window.lengthBatch(50) 
select symbol, avg(price) as avgPrice
group by symbol having avgPrice>50
insert into StockQuote  for expired-events

Unique window

A  window that keeps only the latest events that are unique according to the given attribute.

From the events of the StockExchangeStream stream, output the expiring events of the unique window to the StockQuote stream. The output events have symbol, price and volume as their attributes.

from StockExchangeStream#window.unique(symbol) 
select symbol, price, volume
insert into StockQuote for expired-events

First unique window

A window that keeps the first events that are unique according to the given unique attribute

From the events of the StockExchangeStream stream, output the events of the firstUnique window to the StockQuote stream. The output events have symbol, price and volume as their attributes.

from StockExchangeStream#window.firstUnique(symbol) 
select symbol, price, volume
insert into StockQuote 

External Time Window

A window that would process time not according to the host system time, but according to timestamps provided externally by the input stream.

From the events of the LoginEvents stream, output the events of the login events of last 5 seconds based on the attribute 'timeStamp' of the stream. The output events have timeStamp, ip and count of login events during last 5 seconds as their attributes.

from LoginEvents#window.externalTime(timeStamp,5 sec)
select timeStamp, ip, count(timeStamp) as lastFiveSecLoginCount
insert into slidingFiveSecLoginInfo for all-events ;

Supported Units for Time windows

The following units are supported when specifying the time for a time window.

Note that each unit supports both the singular and plural format (e.g. second, seconds) and some units have a shortened form (i.e. sec, min).

Following examples are given to show the usage of time units.

from StockExchangeStream[symbol == 'WSO2']#window.time( 1 minute ) 
select max(price) as maxPrice, avg(price) as avgPrice, min(price) as minPrice
insert into WSO2StockQuote for all-events  

from StockExchangeStream[symbol == 'FBX']#window.timeBatch( 5 minutes ) 
select max(price) as maxPrice, avg(price) as avgPrice, volume
insert into FBStockQuote