Sliding Windows

Sliding Window is a way to scope the events of interest as a the ones belonging to a window that is constantly moving. The two most common sliding window implementations are time based windows and length based windows.

The next sections will detail each of them.

Important

Sliding Windows are only available when running the engine in STREAM mode. Check the Event Processing Mode section for details on how the STREAM mode works.

Sliding Time Windows

Sliding Time Windows allow the user to write rules that will only match events occurring in the last X time units.

For instance, if the user wants to consider only the Stock Ticks that happened in the last 2 minutes, the pattern would look like this:

StockTick() over window:time( 2m )

Drools uses the "over" keyword to associate windows to patterns.

On a more elaborate example, if the user wants to sound an alarm in case the average temperature over the last 10 minutes read from a sensor is above the threshold value, the rule would look like:

Example 2.14. aggregating values over time windows

rule "Sound the alarm in case temperature rises above threshold"
when
    TemperatureThreshold( $max : max )
    Number( doubleValue > $max ) from accumulate(
        SensorReading( $temp : temperature ) over window:time( 10m ),
        average( $temp ) )
then
    // sound the alarm
end


The engine will automatically discard any SensorReading older than 10 minutes and keep the calculated average consistent.

Sliding Length Windows

Sliding Length Windows work the same way as Time Windows, but discard events based on the arrival of new events instead of flow of time.

For instance, if the user wants to consider only the last 10 IBM Stock Ticks, independent of how old they are, the pattern would look like this:

StockTick( company == "IBM" ) over window:length( 10 )

As you can see, the pattern is similar to the one presented in the previous section, but instead of using window:time to define the sliding window, it uses window:length.

Using a similar example to the one in the previous section, if the user wants to sound an alarm in case the average temperature over the last 100 readings from a sensor is above the threshold value, the rule would look like:

Example 2.15. aggregating values over length windows

rule "Sound the alarm in case temperature rises above threshold"
when
    TemperatureThreshold( $max : max )
    Number( doubleValue > $max ) from accumulate(
        SensorReading( $temp : temperature ) over window:length( 100 ),
        average( $temp ) )
then
    // sound the alarm
end


The engine will keep only the last 100 readings.