I have two streams of events
- L = (l1, l3, l8, ...) - is sparser and represents user logins to a IP
- E = (e2, e4, e5, e9, ...) - is a stream of logs the particular IP
the lower index represents a timestamp... If we joined the two streams together and sorted them by time we would get:
- l1, e2, l3, e4, e5, l8, e9, ...
Would it be possible to implement custom Window
/ Trigger
functions to group the event to sessions (time between logins of different users):
- l1 - l3 : e2
- l3 - l8 : e4, e5
- l8 - l14 : e9, e10, e11, e12, e13
- ...
The problem which I see is that the two streams are not necessarily sorted. I thought about sorting the input stream by time-stamps. Then it would be easy to implement the windowing using GlobalWindow
and custom Trigger
- yet it seems that it is not possible.
Am I missing something or is it definitely not possible to do so in current Flink (v1.3.2)?
Thanks