Task 5 — Event Stream Window Analysis

Objective

Create a function that analyzes timestamped events from multiple sources.

The function must group events into fixed-duration time windows and produce activity information for every window.

The analysis must identify:

• number of events per source
• total number of events
• burst conditions
• windows with no events
• globally missing source activity

Event Model

Each event contains:

Timestamp
Source
Type
Value

A possible model is:

type Event struct {
    Timestamp time.Time
    Source    string
    Type      string
    Value     int
}

Input

Use the following events:

10:00:05  api-1     request   1
10:00:20  api-1     request   1
10:00:45  worker-1  job       1

10:01:10  api-2     request   1
10:01:12  api-2     request   1
10:01:14  api-2     request   1
10:01:16  api-2     request   1
10:01:18  worker-1  job       1

10:03:05  api-1     request   1
10:03:40  worker-2  job       1

Assume all events belong to the same UTC date.

Window Duration

Use:

1 minute

windows.

The analysis starts at:

10:00:00

and ends after the window containing the final event.

Therefore the windows are:

10:00:00 - 10:00:59
10:01:00 - 10:01:59
10:02:00 - 10:02:59
10:03:00 - 10:03:59

Window Membership

A window uses:

[start, end)

semantics.

For example:

10:00:00 <= timestamp < 10:01:00

belongs to the first window.

An event exactly at:

10:01:00

belongs to the second window.

Window 1

Events:

10:00:05 api-1
10:00:20 api-1
10:00:45 worker-1

Source counts:

api-1    = 2
worker-1 = 1

Total:

3

Window 2

Events:

10:01:10 api-2
10:01:12 api-2
10:01:14 api-2
10:01:16 api-2
10:01:18 worker-1

Source counts:

api-2    = 4
worker-1 = 1

Total:

5

Window 3

No events exist between:

10:02:00

and:

10:03:00

Therefore this is an empty window.

Window 4

Events:

10:03:05 api-1
10:03:40 worker-2

Source counts:

api-1    = 1
worker-2 = 1

Total:

2

Burst Rule

The function receives a configurable burst threshold.

For this example:

burstThreshold = 4

A source is considered burst-active inside a window when:

sourceEventCount >= burstThreshold

Therefore:

api-2

is burst-active in Window 2 because it has:

4 events

Suggested Models

type SourceActivity struct {
    Source string
    Count  int
    Burst  bool
}

type EventWindow struct {
    Start          time.Time
    End            time.Time
    TotalEvents    int
    SourceActivity []SourceActivity
    Empty          bool
}

type EventAnalysis struct {
    Windows []EventWindow
}

Expected Window Summary

Conceptually:

Window 10:00
Total = 3
api-1 = 2
worker-1 = 1
Burst = none

Window 10:01
Total = 5
api-2 = 4
worker-1 = 1
Burst = api-2

Window 10:02
Total = 0
Empty = true

Window 10:03
Total = 2
api-1 = 1
worker-2 = 1
Burst = none

Missing Windows

The implementation must create windows even when no events exist inside them.

This is important because otherwise the missing interval:

10:02

would disappear from the report.

Input Ordering

Events may be provided out of chronological order.

The implementation must either:

• sort them before analysis
• or otherwise process them correctly

The final report must always use chronological window order.

Sources

The function should derive source IDs from the event stream unless a predefined source registry is provided.

Missing Source Activity

An optional extension is to provide a known source list.

For example:

knownSources := []string{
    "api-1",
    "api-2",
    "worker-1",
    "worker-2",
}

The report can then identify sources that produced no events inside a given window.

For Window 1:

missing:
api-2
worker-2

For Window 3:

missing:
api-1
api-2
worker-1
worker-2

Timestamp Validation

All timestamps must be valid.

If the analysis is configured for UTC, timestamps using another zone should either:

• be converted to UTC
• or rejected according to the chosen API contract

The behavior must be documented.

Burst Threshold Validation

The burst threshold must satisfy:

burstThreshold > 0

Window Duration Validation

Window duration must satisfy:

windowDuration > 0

Empty Input

For an empty event collection, return an empty analysis unless an explicit analysis time range is provided.

If the caller supplies:

start time
end time

then empty windows may still be generated for that requested period.

Requirements

The function must:

1. validate event timestamps
2. process events in chronological order
3. divide time into fixed windows
4. preserve empty windows
5. count events per source
6. calculate total window activity
7. detect source bursts
8. return windows in chronological order

Additional Analysis

An advanced implementation may also calculate:

• event count per type
• sum of event values
• average value per window
• most active source
• longest empty interval
• consecutive burst windows

These are optional extensions.

Implementation Notes

This task represents a simplified time-window aggregation problem.

The general processing flow is:

Normalize timestamps
       ↓
Sort events
       ↓
Determine analysis range
       ↓
Create windows
       ↓
Assign events to windows
       ↓
Aggregate source activity
       ↓
Detect bursts
       ↓
Return report

The same algorithm should work for different:

window durations
event counts
source counts
burst thresholds