Missing timeout detection when message flow stops

[milica-fluence]

I'm implementing a heartbeat monitoring system with the following requirements:

• Stale heartbeat (value unchanged for 2min) → Critical alarm
• Timeout (no messages for 2min) → Critical alarm
• Increasing heartbeat → Normal alarm

Must output an alarm (of different severity) in all scenarios.

Current Setup
Window: Hopping window (120 seconds, 5-second hop)
Message frequency: 500 msgs/sec
Test duration: 5 minutes

Condition used to detect stale values in a window:
CASE WHEN MIN(value) = MAX(value) THEN "critical" WHEN MIN(value) != MAX(value) THEN "normal" END

The hopping window solved the buffer overflow but introduced a timeout detection issue. In hopping windows, when message flow stops, the last active window still contains historical data from when messages were flowing, preventing timeout detection. In sliding windows (SLIDINGWINDOW(ss, 0, 120)), which I've previously used, the last opened sliding window will contain only one value, therefore the condition will be true and a critical alarm will be raised -- but it causes buffer overflow due to high data frequency.

What's the recommended pattern for detecting both stale values and message timeouts in eKuiper without causing buffer overflow (in high data frequency environments)? Any guidance or help will be appreciated!

[ngjaying]

@milica-fluence Regarding the buffer overflow issue, try to use incremental option for window. Check this out https://ekuiper.org/docs/en/latest/guide/rules/incremental.html