Language

Windowing

ChronusQL has two tested windowing modes:

Guide

ChronusQL has two tested windowing modes:

  • `GROUP BY TumblingWindow(...)` for windowed aggregate result rows.
  • `WINDOW BY ... COMPUTE` for per-event output enriched by window statistics.

This section covers aggregate windows. `WINDOW BY ... COMPUTE` is covered later.

Tumbling Windows

sql
SELECT COUNT(*) AS EventCount INTO output
FROM input TIMESTAMP BY ts
GROUP BY TumblingWindow(Duration(second, 10))

Each event belongs to exactly one fixed-size window. `TIMESTAMP BY` determines the event-time position.

Window End Time

Windowed aggregation can project `Window.EndTime`:

sql
SELECT Window.EndTime AS WindowEnd, COUNT(*) AS EventCount INTO output
FROM input TIMESTAMP BY ts
GROUP BY TumblingWindow(Duration(second, 10))

`Window.EndTime` is only supported in windowed `GROUP BY` queries. The tests reject it outside a windowed aggregation and reject `TIMESTAMP BY Window.EndTime`.

Window Offset

Tumbling windows support an offset:

sql
SELECT COUNT(*) AS EventCount INTO output
FROM input TIMESTAMP BY ts
GROUP BY TumblingWindow(Duration(second, 10), Offset(millisecond, -5))

The grammar requires the explicit `Duration(...)` form. These are rejected:

sql
SELECT COUNT(*) AS EventCount INTO output FROM input GROUP BY TumblingWindow(second, 10)
SELECT COUNT(*) AS EventCount INTO output FROM input GROUP BY TumblingWindow(second, 10, Offset(millisecond, -5))

Group Keys with Windows

Fields can be grouped alongside the window:

sql
SELECT TollId, COUNT(*) AS EventCount INTO output
FROM input TIMESTAMP BY ts
GROUP BY TollId, TumblingWindow(Duration(minute, 2))

Nested group fields are supported:

sql
SELECT server.region AS Region, server.cluster AS Cluster, COUNT(*) AS EventCount INTO output
FROM input TIMESTAMP BY ts
GROUP BY server.region, server.cluster, TumblingWindow(Duration(minute, 10))

HAVING

`HAVING` filters aggregate result groups after aggregation:

sql
SELECT COUNT(*) AS EventCount INTO output
FROM input TIMESTAMP BY ts
GROUP BY TumblingWindow(Duration(second, 10))
HAVING COUNT(*) > 2 AND AVG(value) > 10

`HAVING` can refer to projected aggregate aliases:

sql
SELECT COUNT(*) AS EventCount INTO output
FROM input TIMESTAMP BY ts
GROUP BY TumblingWindow(Duration(second, 10))
HAVING EventCount > 2

`HAVING` can also refer to aggregate expressions that are not projected:

sql
SELECT COUNT(*) AS EventCount INTO output
FROM input TIMESTAMP BY ts
GROUP BY TumblingWindow(Duration(second, 10))
HAVING AVG(value) > 10

The tests reject `HAVING value > 10` in a grouped aggregate when `value` is neither grouped nor aggregated.

Alert-Style Window Example

The tests include this command-like alert query:

sql
SELECT 'reset' AS command
INTO alert
FROM temperature TIMESTAMP BY timeCreated
GROUP BY TumblingWindow(Duration(second, 15))
HAVING AVG(machine.temperature) > 25

With tested input temperatures across several windows, only one alert row is emitted:

json
{"command":"reset"}
PreviousAggregationNextWITH Scripts and Multiple Outputs