What Are Sliding Windows in Real Time Systems?

Sliding Window: A technique for computing aggregates over the most recent subset of streaming data, maintaining only a bounded time period (like last 5 minutes) or count (like last 1000 events) rather than full history. Enables real-time feature computation with predictable memory and latency.

The Core Problem

ML models need features computed over recent activity—average purchase amount in last 7 days, click rate in last hour, session duration trends. Computing these from full history is impractical: scanning millions of events for each prediction adds seconds of latency and consumes unbounded memory. Sliding windows solve this by maintaining only the recent subset needed for computation.

Time Windows vs Count Windows

Time-based windows: Keep events from last N minutes/hours. A 5-minute window might contain 10 events during low traffic but 10,000 during peak. Memory usage varies with traffic volume, but the semantic meaning stays consistent (recent 5 minutes). Count-based windows: Keep exactly the last N events regardless of time span. Memory is fixed (N events maximum), but temporal meaning varies—1000 events might span 30 seconds during peak load or 30 minutes during quiet periods. Choose time windows when recency matters semantically; choose count windows when memory bounds are critical.

Tumbling vs Sliding Windows

Tumbling windows are non-overlapping: events from 10:00-10:05 go into one bucket, 10:05-10:10 into the next. Simple to implement but creates boundary artifacts—an event at 10:04 and 10:06 are never in the same window even though only 2 minutes apart. Sliding windows overlap continuously: every query gets its own window ending at current time. A query at 10:07 sees events from 10:02-10:07; a query at 10:08 sees 10:03-10:08. More computationally expensive but eliminates boundary effects. For ML features requiring smooth temporal behavior, sliding windows are typically preferred despite higher cost.

Decision Criteria: Use tumbling windows for batch aggregations where boundary effects are acceptable (hourly rollups, daily summaries). Use sliding windows for real-time features where continuity matters (fraud scoring, recommendation ranking).