Sliding window on Drools Fusion rules

I'm making an application where data from a Virtual Machine that relate to CPU usage, memory usage, disk utilization, etc. are collected via an interval HTTP request every 5 seconds. The data gathered look like this:

timeStamp (long): 1533554434
memUsagePerc (double): 5.384678498028317
cpuUsagePerc (double): 24.8756219
diskSizePerc (double): 31.880938915483163
diskUtilPerc (double): 1.0505864

I created some rules on Drools Fusion trying to see the following: When the CPU usage reaches for example over 10% for the last 10 seconds, then print something on the screen, but my problem is that even though I put in the rule the command over window:time(Xs) the rule is still fired even though the X seconds have not been passed yet. Here is a rule for the CPU usage:

declare Netdata
    @role( event )
end
rule "CPU usage over 10%"
    salience -1
    when
        $cpu : Netdata(cpuUsagePerc > 10)
        over window:time (10s)
        from entry-point Netdata
    then
        System.out.println("CPU usage over 10%");
end

Netdata is the class that collects all the data from the HTTP response and creates an object every time. That object is then used by Drools Fusion. Note that a more "dummy" rule without the over window:time(Xs) part is fired, too. Also, the following error turns up on the screen, next to the over window:time(Xs): JAVA_IDENTIFIER expected, got 'window'

I'm using Drools version 5.1.1.

This is a common missconception about sliding windows. They are not fixed, they slide. This means that they will be triggered even for t < x.

As far as I know, there is no out of the box support for what you are trying to do. What I've done in the past, is to manually create a "bucket" fact to collect events and then to write rules using these buckets instead of the individual events.

Edit after OP's comment.

Some clarifications about Sliding Windows in Drools:

• Time Sliding Windows in Drools will not wait whatever size they have been configured with before fire. For example a window like window:time (10s) should be interpreted as 0s <= t <= 10s. If you have events coming every 1s, the window will be executed at t=1, t=2, t=3, ..., t=n.
• Sliding Windows in Drools are not discrete. They are not fixed buckets of time/size. As an example, let's suppose we have this timed window: window:time (3s). And let's assume we have events (e) coming every 1s. The window will be executed as follows: t(1):[e1], t(2):[e1,e2], t(3):[e1,e2,e3], t(4):[e2,e3,e4], t(5):[e3,e4,e5]. As you can see, the window will start "sliding" after t(3).

If what you want is to analyze discrete "buckets" of events, then you will need to create that mechanism by yourself. It also sounds weird to me for Drools to not support this kind of windows, but apparently they are not so common as the sliding ones.

Hope it helps,