Skip to main content
Stream Processing and Analytics

Stream Processing and Analytics — Course Overview and Core Concepts

Published: 2026-08-07
Level: postgraduate
Audience: Postgraduate students in stream processing and analytics

Stream Processing and Analytics

1.1 Course Overview and Learning Plan

1.1.1 The Two Platforms: Kafka and PySpark

This course is a deep exploration of stream processing (processing data continuously as it arrives, rather than in one big offline job) and streaming analytics (running analysis on that moving data) built around two platforms: Kafka and Apache Spark, the latter through its Python flavor, PySpark. Kafka is the streaming backbone — the system that ingests, stores, and moves continuous streams of events — while Spark is the processing engine that analyzes those streams at scale. Everything in the course connects back to one of these two tools.

Why two platforms? A stream pipeline is a relay race. The first leg is the transport problem: events arrive from many producers at unpredictable rates, and something must accept, hold, and hand them to the processing side. Kafka solves that leg — it is a distributed event-streaming platform that behaves like a durable, replayable message bus. The second leg is the computation problem: once events are available, something must run analysis on them across many machines without dropping them. Spark (via PySpark) solves that leg — it is a cluster-computing engine that distributes work over many worker nodes and scales from a laptop to a data center. Kafka moves the data; Spark computes on the data.

The instructor brings 25 years of industry experience, with 8 of those years spent specifically on stream processing and analytics, so the course constantly ties concepts back to how these platforms behave in real production environments — not just how they are documented. Expect war stories, architecture trade-offs, and operational detail that textbooks leave out.

All hands-on activities are covered as part of the class sessions themselves. There are no separate webinars planned for this course — the practical work is not an add-on you complete on your own; it happens live, in class, with guidance. Each session runs about one and a half hours, and the course spans 16 lectures.

1.1.2 How the Course Is Delivered

Every session mixes three elements: minimal slide presentations, detailed class notes, and extensive whiteboard work. The presentations exist mostly as scaffolding; the real explanations happen on the whiteboard, where the instructor draws architectures and walks through designs step by step. The emphasis is on live, interactive explanation — if anything is unclear, you can interrupt and ask on the spot.

The course runs in flip mode: recorded sessions are available, and students are expected to go through them first, then come to class to clarify doubts. Recordings are uploaded ahead of class so you can preview material before the live session. Starting from the second lecture onward, materials are uploaded one class in advance.

Why flip mode works here. The recorded lecture does the first pass — definitions, the broad map of the architecture. The live class is where the second pass happens: you bring the doubts the recording raised, and the whiteboard answers them interactively. A presentation deck cannot be interrupted; a live session can. That is the design: recordings for exposure, class time for understanding.

A small but telling detail about how the course evolves: one new element was added this run compared to previous offerings — an extra class on structured streaming, which covers how you write SQL-like queries directly on streaming data. The instructor explicitly framed this as continuous improvement: keep the important parts, add hands-on value, and never let the workload become hectic.

1.1.3 What to Expect

The course deliberately does not try to cover every streaming framework in depth. A few platforms — such as Flink, Samza, and AWS Kinesis — are explored through assignments rather than lectures, so you gain a working understanding of the ecosystem. But the deep dive, the part taught in class with full attention, is Kafka and Spark. If you take away real working skill on those two platforms, you have taken away the core of the course.

Scope note. "Streaming" is an umbrella term covering many systems — Kafka, Spark Streaming, Flink, Storm, Samza, Kinesis, and more. This course makes a deliberate scope cut: two platforms taught to working depth, the rest surveyed through assignments. The concepts (windows, sampling, probabilistic algorithms) transfer across all of them; only the platform mechanics differ. Do not mistake the survey list for the syllabus — the examinable depth is Kafka and Spark.

Real-world: the instructor also plans to demonstrate Kafka streaming with some Java code this run — a first-time addition — because hands-on demos of producers and consumers make the abstraction concrete. If the session count allows it, that Java demonstration stays; if not, it is trimmed without losing anything important.

Exam note: the framing of this first lecture is itself examinable context: the course is organized around two platforms (Kafka = transport/backbone, Spark/PySpark = analytics engine), the ecosystem is covered via assignments (Flink, Samza, AWS Kinesis), and the deep dive is Kafka plus Spark. When a question says "streaming platform," first identify which of the two roles — moving data or analyzing data — it plays.

1.2 Course Structure, Modules, and Resources

1.2.1 Module Roadmap

The course is organized into a clear sequence of modules:

  1. Data systems — the first couple of modules establish what data systems are and how they behave.
  2. Streaming architectures — next, the course covers the principles of designing architectures for streaming applications: how do you design architectures for streaming applications, and what design principles govern them.
  3. Streaming frameworks — this is where Kafka arrives. The course starts with Kafka streaming and covers the Kafka architecture in detail.
  4. Post mid-semester content — after the mid-semester exam, the focus shifts to streaming data frameworks, streaming analytics, and streaming SQL, predominantly covered in this second half.

Read the roadmap as an exam map. The mid-semester exam lands right after the Kafka architecture is covered. Everything up to that point — data systems, streaming architecture principles, and Kafka fundamentals — is the examinable territory for the mid-semester. The second half (streaming analytics, streaming SQL, algorithms on streams) is the comprehensive-exam territory. When you review, ask "which side of the mid-semester boundary is this concept on?" — the course was designed so the answer tells you how it will be examined.

The mid-semester exam lands right after the Kafka architecture is covered. Everything up to that point — data systems, streaming architecture principles, and Kafka fundamentals — is the examinable territory for the mid-semester.

The architecture blueprint behind the modules. The module order mirrors a standard streaming architecture: a collection tier brings raw events in (the data-systems modules), a message queuing tier buffers and transports them (where Kafka sits), an analysis tier runs the computation (where Spark sits), and a data access tier serves results to consumers (where streaming SQL enters). Keep this pipeline shape in mind — every architecture you design in this course, and every architecture you evaluate in the exam, is some arrangement of these tiers.

1.2.2 Contact Sessions and Flip Mode

The course plan lists 11 visible contact sessions, but there are actually 16 contact sessions in total; the discrepancy is a quirk of how the plan is displayed, not a reduction in content. The course is in flip mode: students work through recorded lectures first, then attend live sessions to resolve doubts and go deeper.

The first few lectures cover the first modules — data frameworks — and the instructor uses the whiteboard for every session, with slide support where needed. The session flow is always the same shape: explain the concept, show the architecture, then demonstrate it hands-on so each idea becomes something you have seen working.

1.2.3 Textbook and Learning Resources

The course follows one primary textbook: Techniques to Analyze and Visualize Data. Although the handout lists T1 and T2 as secondary texts, this book is the one predominantly followed throughout the course. A soft copy of the book is available, so you are not required to purchase a physical copy — the soft copy suffices for the entire course.

Real-world: beyond the textbook, the practical resources are the setup files the instructor shares — industry installation files for Kafka and the script commands for running producers and consumers. These remove the biggest barrier to picking up streaming technologies: the apprehension around installation and orchestration. There is a structured way to set up this environment on a local laptop, and the course follows exactly that path so you can work in parallel with the instructor.

Assumption to record now: this course assumes you have a laptop where the Kafka community edition can be installed locally. Every demo in class is reproducible on that local setup — producers pushing events, consumers reading them. The barrier to following along is installation, not intelligence, and the shared setup files exist precisely to remove it. If your machine cannot run the local setup, tell the instructor early rather than discovering it mid-semester.

1.3 Evaluation Components

1.3.1 The Weightage Breakdown

The evaluation is built from six pieces. Two assignments worth 10 marks each, a quiz worth 10 marks, the mid-semester exam (EC2) worth 30 marks, and the comprehensive exam (EC3) worth 40 marks. The first three pieces — assignment 1, assignment 2, and the quiz — combine into EC1, which is worth 30 marks. This is a five-credit course, and the continuous evaluation alone (EC1) accounts for a substantial portion of the total marks.

The marks arithmetic, worked in full.

The total for the course is 100 marks, split as:

  • Assignment 1: 10 marks
  • Assignment 2: 10 marks
  • Quiz: 10 marks (two quizzes of 5 marks each)
  • EC1 total: 10 + 10 + 10 = 30 marks (continuous evaluation)
  • EC2 (mid-semester): 30 marks
  • EC3 (comprehensive): 40 marks

Check the total: 30 + 30 + 40 = 100 marks. Two useful derived facts fall out of this arithmetic. First, the quiz is not a single 10-mark event — it is two sittings of 5 marks each. Second, the mid-semester (30) and comprehensive (40) together are 70 marks, so the examinable half of the grade outweighs the assignment half — the two assignment pieces (20) plus quiz (10) make up the remaining 30. Every component is accounted for, and the numbers add cleanly to 100.

The quiz is made of objective-type questions — true/false and similar formats. There are two quizzes, each carrying five marks, so the 10-mark quiz component is split across two sittings rather than one high-stakes event.

1.3.2 Quiz Mechanics

The quizzes have a distinctive operational pattern. Each quiz is a timed quiz: for 10 questions you get roughly 15 to 20 minutes, depending on the complexity of the questions. All questions are objective type — true/false and similar formats — so the time pressure is about speed of recognition rather than long written answers.

The time window is the key scheduling detail: each quiz stays open for a 3 to 4 day window, typically spanning a full weekend — enabled on a Friday, open through Saturday, Sunday, and Monday. Within that window you pick any single day to take the quiz. It is not a rigid "opens Sunday, closes Monday morning" arrangement; you get the whole weekend.

Two rules that change your planning:

  • No makeup quizzes. If you miss the window, the quiz is missed. There is no second chance, so block the weekend in your calendar.
  • No pausing. Once you start the quiz, you must finish it in one sitting. You cannot close the quiz and resume later — starting it commits you to completing it immediately. The 15–20 minute budget exists precisely because the quiz is designed to be finished in one uninterrupted sitting.

You are notified through the course portal when a quiz is published, along with the deadline and schedule, so the operational details are always visible. The professor explicitly encouraged questions about this setup because the quiz mechanics are easy to get wrong if you do not know them in advance.

Q: If I start the quiz on Saturday and close it, can I come back and resume it? A: No. Once you start, you have to finish it off — it is all objective type, so a single sitting is enough. You choose a particular day among those four days, you see the notice of when it is scheduled and what the deadline is, and you complete it in that one attempt. The "no resume" rule is not a technical limitation of the platform; it is the design of the assessment — a 15–20 minute timed quiz is meant to measure recognition speed, and pausing would let you look things up mid-quiz.

Q: You said there is a 3–4 day window for the quiz. Is the quiz itself timed? A: Yes, it is a timed quiz. For 10 questions you get 15 to 20 minutes depending on the complexity of the questions. All are objective type — true/false kind of thing. Within the time window you can choose any one of those dates and finish. There is no makeup for the quiz, so pick your day carefully.

1.3.3 EC2 and EC3 Exam Shapes

The mid-semester exam (EC2) is worth 30 marks and consists of roughly three to four questions. It is a closed-book exam. The comprehensive exam (EC3) is worth 40 marks and is an open-book exam.

Exam note: the mid-semester is theory-based in a specific sense. Expect questions that hand you an architecture and ask you to evaluate it, or give you a business case and ask you to design an architecture for it. The post-mid-semester material, by contrast, brings coding questions focused on algorithm design and implementation — the traditional algorithms you know from data structure courses are directly usable on streaming data, and the course spends two to three lectures covering exactly which algorithms work for streaming applications.

Exam note: a student asked directly whether the exams lean theory or programming. The answer splits cleanly along the mid-semester boundary: theory-based (architecture evaluation and business-case-to-architecture design) before mid-sem, coding and algorithm design after.

1.3.4 Timeline and Calendar

The calendar places each component deliberately across the semester:

  • Assignment 1 is declared after the 6th lecture, with a 3-week submission window. The window is flexible — deadlines are mutually agreeable, because working professionals need room to plan around jobs.
  • Quiz 1 sits around early March.
  • The mid-semester exam lands in March, after the Kafka architecture is covered.
  • The comprehensive exam (EC3) closes the course.

All evaluation criteria for assignments are uploaded to the course portal so nothing about grading is hidden.

Q: The tagging you are doing on the calendar — the assignment and quiz — is that the start you are tagging or the end? A: Not the end. For assignment 1, the date is the publish date — that is when the assignment is declared and started. The end comes three weeks later. So contact session 7 is roughly when assignment 1 is published; session 8 is one week in, session 9 is two weeks in, and session 10 is the third week, with the submission falling around the 24th of March. Even that deadline is flexible — we plan it on mutually agreeable dates.

The correction to internalize: the date on the calendar is the declaration date, not the deadline. The calendar is a starting gun, not a finish line. When you read the semester timeline, an assignment entry means "starts here," and the three-week countdown starts from that point.

1.4 Assignment 1 — Deep Exploration of Streaming Architectures

1.4.1 Scope of the Deep Exploration

Assignment 1 is a deep exploration of a streaming architecture. The instructor maintains a list of streaming platforms — Flink, Samza, AWS Kinesis, and similar — and each group is assigned one architecture to study in depth. The assignment is deliberately research-shaped: you take a real streaming system, understand its architecture, and produce an artifact that documents your findings.

The pedagogical logic is worth understanding. The frameworks in this list are real and used in industry, but the course cannot teach every one of them in depth. By assigning them for exploration, you still gain a basic understanding of the broader ecosystem, while the class time concentrates on the deep dive into Kafka and Spark.

Why "explore one, not teach all." Every platform in the list (Flink, Samza, Kinesis, and the similar set) occupies the same conceptual neighborhood as Kafka and Spark — they ingest, buffer, and process event streams — but each makes different design choices: Flink emphasizes true event-time processing and exactly-once semantics, Samza builds on a durable log and close integration with Kafka, and AWS Kinesis is a managed cloud service where provisioning and scaling are handled for you. You are not expected to master these details now; the assignment exists so that when you meet these platforms in industry, you have already met them once. The exploration skill it trains — take a system, read its architecture, document how it works — is the same skill the mid-semester exam tests when it asks you to evaluate an architecture.

1.4.2 Group Work and Submission

The work is organized in groups of four people, with one assignment given to one group. The submission is an artifact — a document or deliverable you email to the instructor.

Group size is not fixed in stone; it is calibrated to the class strength. Historically this course has had around 45 to 50 students, which comfortably supports four-person groups. But if the current batch is smaller — say 10 to 15 students — the group size drops to 2 to 3 people per group rather than forcing tiny groups to split four-person workloads. The exact group configuration is announced once the class count is known, typically by the next session.

Q: How many students are there? You said four in a group — I saw around 10 students, though I heard it might be 30 or 40. What if the number is less? A: If the number is less, we reduce the number of people per group — the group size is proportionate to the class strength. With 10 to 15 students we could take 2 to 3 people per group max. Too many groups becomes difficult for me to manage, and with too few students we calibrate accordingly. I cannot say the exact numbers right now; by next class I will be able to tell you how many students there are and how the groups will be formed. It is not like 5 people or 4 people in a group — we calibrate it accordingly.

The deeper lesson here is how the professor runs a course for working professionals: every number that looks fixed (group size, deadlines, even session count) has an underlying constraint that governs it. For group size the constraint is manageability — the instructor must be able to supervise every group's work, so the number of groups has a practical ceiling. When a constraint appears in a scenario, look for what is actually being optimized.

1.4.3 Timeline

Assignment 1 is given after the 6th lecture and carries a 3-week window. The deadline is flexible by design — the instructor explicitly said not to worry about deadlines, because the plan is to discuss mutually acceptable timelines. If you need extra days, you ask, and the schedule adjusts. The only constraint is the natural rhythm of the semester: the submission falls roughly three weeks after publishing, around the 24th of March.

Exam note: assignment marks are part of EC1 (10 of the 30 marks), so the assignment is not just an exercise — it is exam weight. But because deadlines are flexible and criteria are published in the portal, the grading process is transparent. The architecture-exploration artifact you produce for this assignment doubles as mid-semester revision material: the platform you study in depth is exactly the kind of system a mid-semester question may ask you to evaluate.

1.5 Assignment 2 — Machine Learning with PySpark on Databricks

1.5.1 Scope: ML on Spark

Assignment 2 is hands-on machine learning: you implement machine learning techniques on Spark, using PySpark on the Databricks platform. The assignment asks you to explore a couple of PySpark libraries, develop machine learning models, and present those models as assignment artifacts.

This is where the course philosophy shows: you learn the machine learning algorithms on your own, for the assignment's purposes, while the instructor demonstrates the platform mechanics — how to create Spark DataFrames, how to do the analytics side of PySpark. So the assignment is not teaching you ML from scratch; it is teaching you how to run ML at scale on a streaming-capable engine.

The division of labor. Spark's machine learning library (MLlib) provides ready-made implementations of common algorithms — classification, regression, clustering, and the like — all of which operate on Spark DataFrames, Spark's tabular abstraction distributed across a cluster. The algorithmic theory (what a random forest does, how k-means converges) is assumed background you bring to the assignment. What the course adds is the platform layer: creating the DataFrame, loading data into it, fitting a model over distributed data, and reading the result. In production terms, this is exactly the data-engineer's job description — the engineer rarely invents algorithms, but must know how to run them on the infrastructure.

Real-world: the demonstration covers the analytics aspects of PySpark — creating Spark DataFrames and working with them — which is precisely the skill set used in production data engineering work.

1.5.2 Databricks Community Edition

The assignment runs on the Databricks community edition, which is free — you can use the Databricks cloud platform without paying anything. This matters because installing and orchestrating Spark clusters is exactly the kind of setup work that makes people apprehensive about these technologies; Databricks removes that entire class of problems.

Real-world: Databricks was built by the creators of Spark, and it handles everything for you — cluster installation, cluster management, all of it. When you register for the community edition, the platform asks whether you want the AWS flavor, the Azure flavor, or the GCP flavor, and then provides the overall ecosystem around your choice. There is extensive help documentation for usage. Some workloads carry a small cost, but it is not high — and compared to GCP, AWS, or Azure, Databricks has become increasingly prominent because of its features and its user-friendliness, especially for Spark analytics.

Why "no cluster setup" matters for this course. A Spark cluster is a collection of machines working as one computer: a driver that coordinates, workers that compute, and a distributed file system underneath. Setting one up from scratch — installing Java, matching versions, configuring networking — is a genuine barrier that has stopped many students before they ever touch streaming. The community edition removes the installation step so the course can spend its time on the concepts (windows, sampling, analytics) rather than the plumbing. When a question asks why Databricks is used in this course, the answer is pedagogical: it strips away the orchestration overhead and leaves the actual stream analytics.

1.5.3 One Notebook for Both Assignments

A practical convention simplifies submission: both assignments can be submitted together in a single Jupyter notebook — this has been the established practice and continues this run. The notebook has two parts:

  • Part one: the artifacts of assignment 1 — the documentation of the streaming architecture exploration. Jupyter helps you write nice documentation, the way you would present a slide deck, so the entire content goes in as part one.
  • Part two: the coding for assignment 2 — the PySpark ML implementation.

One file, both assignments, submitted at the end. That has been the practice, and the course continues with it.

Q: By structured data, do you mean Spark SQL — is it related to Spark QL? A: Spark SQL, correct. In this course we will be focusing predominantly on Spark structured streaming and the Spark DataFrame API — those two things. You have used Spark locally for processing and pre-processing, so the streaming side will be new and useful.

The vocabulary fix here matters: structured in this course is not a vague adjective — it names the structured-data stack of Spark (Spark SQL and the DataFrame API), where data sits in tables with named columns and queries are expressed like SQL. The course's structured streaming is "SQL-like queries over streams," which is why the professor says both belong together: the DataFrame API gives you the table shape, structured streaming gives you the streaming shape, and the query logic in between is the same.

1.6 Stream Processing vs Batch Processing

1.6.1 The Time-Scale Rule

The single most important distinction in this course is stream processing versus batch processing, and the deciding factor is one thing: the time scale you work on. The instructor's bottom line is compact and worth memorizing:

  • If you analyze data on a time scale of minutes or seconds, it is stream processing.
  • If you schedule your analysis activities hourly, every eight hours, daily, or every two days, it becomes batch processing.

Formalizing the rule. Let the unit of analysis be the answer's freshness — how old the newest data in a result can be. The rule states:

  • freshness of minutes or seconds → stream processing
  • freshness of hours or days → batch processing

Two things to note. First, the rule is about the question you are answering, not the industry or the tool: the same company runs both modes on overlapping data. Second, the boundary is a spectrum, not a cliff — an hourly job is batch, a five-second computation is stream, and between them sits the gray zone where architectures are designed to switch. The professor's phrasing — "the time scale of your collection window decides whether you call it stream or batch" — is the exam-ready version of this idea.

Real-world: in the BFSI (banking, financial services, and insurance) domain, streaming analytics is everywhere. But the same organization often needs both modes: real-time fraud checks on transactions while they happen (stream), and overnight risk analysis over millions of customer records (batch). The time scale of the question determines the mode, not the industry or the technology.

Exam note: expect the stream-versus-batch distinction to be examined conceptually — the time-scale rule is the cleanest way to answer "is this stream or batch?" When given a scenario, ask one question first: how old may the newest data be when the answer appears? Seconds → stream; hours/days → batch. This single test answers almost every stream-or-batch question on the paper.

1.6.2 Customizable Batch Size

Kafka and Spark both support customizable batch sizes, and this is what makes them flexible enough for both regimes:

  • Micro-batch processing — near-real-time windows that process small batches of events continuously.
  • Stream processing — true event-by-event processing.
  • Proper batch processing — large jobs scheduled at fixed hours of the day.

Because you can tune the batch size, one platform can serve both the streaming and the batch sides of a business. The practical implication for architecture: your architecture should be able to switch between these strategies as the analysis requirement moves along the time scale.

Micro-batch is the bridge. A micro-batch is a stream chopped into small, fixed-size chunks — say, events accumulated for two seconds, then processed as a unit. It is literally a batch whose batch size is tiny and whose schedule is continuous. The connection to windows (Section 1.7) is direct: a micro-batch is a time-based window whose length equals the batch size. This is why the platforms are flexible: the same engine parameter — how many events accumulate before processing — slides smoothly from seconds (stream-like) to hours (batch-like). Spark's streaming lineage is built on exactly this: structured streaming processes a stream as a sequence of micro-batches.

1.6.3 One Architecture for Both Strategies

A clarifying question from a student produced the richest explanation of the session — the collection-window view of the problem. The answer used an analogy that runs through the entire course (developed fully in the next section): stand on the bank of a river, and you cannot capture the whole river in a bucket. You capture a sample, and the sampling strategy — count-based or time-based — is exactly the window mechanism of stream processing. Once the sample is collected, you apply algorithms to it and draw inferences.

The deeper point is that the stream/batch question is not a binary technology choice. The same event data can be analyzed as a stream (per-second fraud scoring) or as a batch (nightly trend reports), and a well-designed architecture keeps both options open.

Q: Is batch processing also included — is it a part of stream processing only, or do you consider it separately? A: Think of the collection window. A stream is like standing on the bank of a river and wanting to analyze the minerals in the water. You cannot capture the entire water in a bucket — you collect a sample, and you collect it by one of two strategies. Strategy one: you collect water up to a particular level in the bucket — that is the event-based window mechanism, you collect that many events for processing. Strategy two: temporal — you put a stopwatch and fill the water for five minutes or ten minutes; once the stopwatch stops, you stop collecting. In the same sense you have a window with a time frame of one second or one minute, and within that time window you collect the events. Once you collect the data, you use appropriate algorithms to analyze it and get inferences. So batch is part of the same picture — the time scale of your collection window decides whether you call it stream or batch. And here is the catch: the algorithms used in streaming analytics are not deterministic. A deterministic algorithm — say, a linear search to count the frequency of an element — gives you the same count at 3 o'clock and the same count again at 4 o'clock. Streaming algorithms are probabilistic and non-deterministic, because you only collect a random sample, and the sample may not reflect the entire stream. That is why the sampling and analysis techniques in streaming are probabilistic.

The correction to carry forward: batch is not a different technology category from stream — it is the same pipeline viewed at a different time scale. Both modes share the same machinery (collect → analyze → infer); the dial that changes is the size of the collection window. And the answer previews the probabilistic-algorithms thread of Section 1.8: because the window holds only a sample of the stream, the analysis built on it inherits randomness — a fact that will matter the moment you design a streaming solution.

Dimension Stream processing Batch processing
Time scale of the answer Minutes or seconds Hourly, 8-hourly, daily, or longer
Unit of work Small windows / individual events Large fixed jobs
Example in the same bank Real-time fraud check on a transaction Overnight risk analysis over millions of records
Platform knob Small batch size (micro-batch to event-by-event) Large scheduled batch
Algorithm character Probabilistic, non-deterministic (random sample) Deterministic (same input, same result)

When to pick which: let the freshness requirement of the business question decide — seconds need stream, hours need batch, and a well-designed architecture keeps the ability to switch between the two rather than committing to one technology.

Scope note — what the time-scale rule does and does not say. The rule classifies analysis modes, not systems: Kafka and Spark are not "streaming tools" in a way that forbids batch use — Spark runs batch jobs every day in industry, and Kafka is a durable log either way. Also, "streaming" here means the analytic freshness scale, not a promise of zero latency: real streaming systems have buffers, queues, and unavoidable delays. If a question says "is this stream or batch?", answer with the time-scale rule, and only then discuss the platforms.

1.7 Windows in Stream Processing

1.7.1 The River Bucket Analogy

The central mental model for windows is the river bucket analogy. Imagine you stand near the bank of a river and want to analyze the minerals in the water. You cannot capture the entire river in a bucket — so you collect a sample. The question is how you decide when to stop collecting, and there are exactly two strategies:

  1. Collect water up to a particular level in the bucket — a fixed amount of water, whatever that takes.
  2. Collect water for a fixed duration — put a stopwatch on, fill for five or ten minutes, and stop when the timer ends.

These two strategies map exactly onto the two window mechanisms of stream processing: event-based (count) windows and time-based (temporal) windows.

Why the analogy is the definition. A window (a finite slice of an infinite stream, on which you run your computation) exists for one reason: the stream is unbounded, and every algorithm you know operates on bounded input. The bucket is the window, the water level is the count, the stopwatch is the clock. Every property of real windows — when it fills, when it empties, what it contains — is a property of the bucket-and-stopwatch setup. Keep this mapping, and the platform-specific window APIs become easy to decode: they are all just ways of expressing "how much to collect" and "when to stop collecting."

1.7.2 Event-Based (Count) Windows

The first strategy — fill the bucket to a level — is the event-based window. You collect events until the window reaches a specified number of events, then you process that group and start the next window. The window is defined by how many events it holds, not by how long it took to collect them. In the analogy, the bucket level is the count; a slow stream takes longer to fill the bucket, a fast stream fills it quickly, but the processing unit is always "these N events together."

Two policies behind the mechanism. Every window is governed by two rules (these appear in the windowing literature and in Spark/Flink APIs): the trigger policy — when the system stops collecting and starts processing — and the eviction policy — when old data leaves the window. For a count window, both are driven by the quantity of data: when the N-th event arrives, the trigger fires and the window is drained, no matter whether it took one second or five hours to collect those N events. A slow stream therefore yields long count-windows; a fast stream yields short ones. That asymmetry is the fingerprint of an event-based window.

1.7.3 Time-Based (Temporal) Windows

The second strategy — the stopwatch — is the time-based window. You collect every event that arrives within a fixed time frame — for example, one second or one minute — regardless of how many events that turns out to be. When the window closes, you process whatever accumulated. In the analogy, the stopwatch is the clock; a busy river fills the bucket faster, a quiet river slower, but the processing unit is always "everything that arrived in this time slice."

The count/time symmetry. Compare the two triggers: a count window's trigger is "the window is full" (a fixed number of events, variable time); a time window's trigger is "the timer has expired" (a fixed duration, variable number of events). The pair is complementary — every real deployment chooses one of these two knobs, and some engines let you combine them. Note the trade: a time window gives you regular results (an answer every minute, reliably) but irregular sample sizes (a quiet minute holds 3 events, a busy minute holds 3,000); a count window gives you regular sample sizes but irregular timing. Which regularity you need — steady answers, or steady sample sizes — is a design decision, not a technical detail.

1.7.4 Why Windows Matter

Windows exist because infinite data cannot be processed as an infinite batch. You need a finite unit to apply algorithms to, and the window defines that unit. Two properties of windows are worth internalizing:

  • You use a logical window for the accumulation of events — the window is a logical grouping, not a physical storage constraint.
  • Whether a particular event is selected into a window is a random process — the stream arrives continuously, and the window simply captures whatever falls inside its boundaries.

Once the window closes, the collected events are analyzed with appropriate algorithms and the inferences are drawn — the same analysis step whether the window was count-based or time-based. Choosing the right window length (and type) is a design decision that shapes the latency and accuracy of the whole pipeline: shorter windows give faster answers on less data; longer windows give more stable answers but delayed results.

The river bucket, worked with real numbers.

A point-of-sale terminal emits one transaction event per second on average, but traffic is bursty. Two window choices:

  • Event-based window of N = 100 events. The bucket fills to the 100-event level. During a quiet morning (0.2 events/second) the window takes 500 seconds (~8 minutes) to fill; during a sale rush (5 events/second) it fills in 20 seconds. Either way, the analysis always runs on exactly 100 transactions. Result: constant sample size, wildly varying answer cadence.
  • Time-based window of 60 seconds. The stopwatch runs for one minute regardless of traffic. A quiet minute yields ~12 events; a rush minute yields ~300. Result: an answer every 60 seconds on the dot, but the sample size swings 25× between quiet and rush minutes.

Sense-check: in both cases the pipeline processes finite units (100 events, or 60 seconds of events) from an infinite stream, and in both cases the analysis step is identical once the unit is collected — exactly what the professor's analogy promised. The choice is which irregularity you can tolerate: erratic timing (count windows) or erratic sample size (time windows).

Pitfalls to avoid when thinking about windows:

  • Treating windows as storage. The window is a logical grouping of events, not a physical buffer that fills the machine's memory. Events flow through it continuously; the windowing logic decides which ones belong to the current unit.
  • Ignoring which clock the window uses. A time window can be keyed to event time (when the event actually occurred) or processing time (when it reached the system). A delayed event — a phone reconnecting after being offline, a straggler arriving late from a network hiccup — lands in a processing-time window that no longer matches its real time. Streams that depend on accurate time windows must reconcile this.
  • Expecting a window to be deterministic. Which events fall in a window is governed by arrival timing, which is random — so window contents vary between runs. This is the same randomness the professor tied to sampling in Section 1.6, and it is the reason streaming analytics need probabilistic thinking.
  • Forgetting the latency/accuracy trade. Shorter windows answer faster on less data (noisier answers); longer windows smooth the noise but delay the answer. There is no free window length — every choice buys one at the expense of the other.

The wider family of time windows. The professor's two mechanisms are the foundation; production engines layer two more variations on them. A tumbling window is a fixed-length time window with no overlap — every event belongs to exactly one window (e.g., all events between 10:03:00 and 10:03:59, then 10:04:00–10:04:59). A sliding (hopping) window also has fixed length but advances on a shorter interval, so windows overlap — a 5-minute window advancing every minute recomputes over the last 5 minutes each minute, smoothing results the way a dashboard wants. And a session window has no fixed length at all: it groups a user's events and closes after the user has been inactive for a set period (the classic "30 minutes of no clicks ends the session"). All four are stopwatch-based; the count family follows the bucket-level rule.

Exam note: the window mechanics — event-based versus time-based, and how the river bucket maps to each — are classic mid-semester theory questions. Be ready to explain both mechanisms and to say which one a given scenario uses. The exam-ready test: "does the scenario stop collecting at a fixed count or a fixed duration?" Also be ready to state why windows exist at all (infinite stream → need finite units for algorithms) and what the trigger/eviction policies do. The professor's analogy maps: bucket level = count window, stopwatch = time window.

1.8 Deterministic vs Probabilistic Streaming Algorithms

1.8.1 The Deterministic Baseline

Before streaming, recall what an ordinary algorithm guarantees. A deterministic algorithm produces the same output for the same input, every time. The professor's example is a linear search used to count the frequency of occurrence of an element: run it today at 3 o'clock and you get a count; run the same thing at 4 o'clock and you get the same count. The answer is stable because the input is fully known and the algorithm examines it completely.

Determinism is a property of the input and the method, not the hardware. The count is exact because every occurrence is examined — nothing is sampled, nothing is dropped.

Frequency counting with linear search, worked in full.

Input: the list of elements to count. Suppose the list is

and the element in question is "card." The algorithm is a single pass: start with a counter at 0, walk the list one element at a time, and increment the counter on every match.

  • Position 1: card → counter 1
  • Position 2: card → counter 2
  • Position 3: card → counter 3
  • Position 4: cash → no change (3)
  • Position 5: card → counter 4
  • Position 6: cash → no change (4)

The count is 4. Run it at 3 o'clock, get 4; run it at 4 o'clock, get 4; run it a thousand times, get 4 — the entire list is examined every time, so nothing is left to chance. That exactness is the baseline the professor means: with the complete input in hand and a complete scan of it, the same question gets the same answer forever. This is precisely why a batch analysis over a fully known dataset is deterministic.

1.8.2 Why Streaming Algorithms Are Probabilistic

Streaming algorithms, by contrast, are probabilistic and non-deterministic. The reason is the sample. You only collect a random sample of the stream — remember the bucket in the river — and the sample may not reflect the entire stream. Randomness is involved in the collection of the sample, so the analysis built on it inherits that randomness.

This is why the algorithms used in data processing over streams — and even over batch samples — are non-deterministic in nature. The same analysis run twice can produce slightly different numbers, not because the code is buggy, but because the underlying sample differs. That is the fundamental trade: exactness is sacrificed for the ability to handle data too large to hold, at the speed the stream demands.

Two distinct sources of randomness — and what each means. First, the collection side: the window holds a sample, and the sample is random (Section 1.7), so any statistic computed from it carries sampling error — the sample proportion is not the stream proportion. Second, the algorithmic side: streaming systems deliberately use approximation algorithms that trade a little accuracy for huge memory savings. A Bloom filter answers "have I seen this key before?" using a small bitmap, but occasionally says yes when the answer is no (a false positive). HyperLogLog estimates "how many distinct elements are in this stream?" from a few kilobytes, with a small known error, instead of storing every element. Both families are probabilistic by design: they return answers with guaranteed error bounds rather than exact values — and that is an acceptable contract when the exact alternative cannot fit in memory at all.

1.8.3 The Logical Window and Random Sampling

The bridge between the two regimes is the logical window. You accumulate events into a logical window, decide an appropriate window length, and within that window the selection of a particular event is a random process — whether an event lands in the window is governed by timing and arrival, not by choice. Consequently, the sampling and analysis techniques used in streaming are probabilistic techniques.

The design consequence: when you design a streaming analytics solution, you are not choosing between "right" and "wrong" algorithms in the classical sense. You are choosing probabilistic algorithms with known error characteristics, and the window length is your dial for controlling accuracy. Understanding which traditional algorithms carry over to streaming — the course spends two to three lectures on exactly this — is a core skill of the second half of the course.

Pitfalls when reasoning about streaming algorithms:

  • Expecting the same answer on every run. A streaming computation will not return the identical answer on every run, because the sample is random. If an answer looks different between runs, the first thing to check is the window and the sample, not the code. This is the professor's warning, and it is the most commonly missed point in this lecture.
  • Calling the difference a bug. Non-determinism here is a design feature — the price paid for processing data too large to hold. Only if results differ beyond the known error bounds should the algorithm itself be suspect.
  • Forgetting that batch samples are also probabilistic. The professor noted the same non-determinism appears when you analyze a random sample of a batch dataset: the sample, not the algorithm, injects the randomness.
  • Treating error bounds as optional knowledge. Probabilistic algorithms are chosen by their guarantees (Bloom filter false-positive rate, HyperLogLog relative error). A streaming design without known error characteristics is a design without a contract.

Exam note: the deterministic baseline (linear search frequency counting returns the same count every run) vs the probabilistic stream regime (random sample → non-deterministic results) is a guaranteed conceptual question. The one-line answer to remember: determinism requires the complete input; streaming can never hold the complete input, so its analyses are probabilistic by construction. Expect to be asked why a streamed count can differ between runs — the answer is the sample, not the code.

1.9 Real-World Applications of Stream Processing

1.9.1 Credit Card Fraud Detection

Real-world: the canonical streaming use case is credit card fraud detection. Credit card transactions happen continuously, day in and day out, and each transaction is captured as an event — a very small piece of data, a few kilobytes, like a mobile SMS. The question is how to analyze this data in real time.

Here is the everyday experience the architecture explains: if you swipe a card for more than 80,000 rupees, you get a phone call from customer care saying a transaction just happened — press one to confirm, press two to raise an issue. Behind that call, the bank's stream processing engine analyzes transactions as they occur, classifies each one as genuine or fraudulent using machine learning, and triggers the confirmation call the moment a suspicious transaction passes. This is real-time transaction classification with machine learning, running on streaming data.

The fraud flow, worked step by step.

The pipeline is a four-stage relay, each stage receiving the output of the previous one:

  1. Capture — a transaction event (a few kilobytes of data, roughly the size of a short SMS) arrives at the bank's platform.
  2. Analyze in real time — a stream processing engine (the Kafka + Spark pair of this course) ingests the event and makes it available for computation within the chosen time window — here, seconds.
  3. Classify — a machine learning classifier scores the transaction as fraudulent or legitimate, using features such as amount, location, merchant, and the card's history.
  4. Act — if the score crosses the suspicion threshold, the system triggers an immediate action: the confirmation call (press 1 to confirm, press 2 to raise an issue).

Worked through: you swipe a card for 85,000 rupees. The event arrives, the engine analyzes it within seconds, the classifier flags it as suspicious (an amount far above the card's usual pattern), and the call lands within moments. The transaction is not blocked outright — it is confirmed in real time, because the bank's business decision is to balance fraud prevention against blocking legitimate purchases. Sense-check the design: the entire decision happens within the seconds time scale, which is exactly why this is stream processing by the Section 1.6 rule — and why the course's canonical example is also its cleanest demonstration of the window + algorithm + action pattern.

1.9.2 Ride-Hailing and Stock Trading

Real-world: ride-hailing platforms such as Uber and Ola are streaming businesses. The availability of cabs, traffic congestion in real time, and the decisions built on that information — where to route cars, how to price a ride — all depend on processing streams of location and demand events as they happen. Traffic information loses its value the moment it is stale; streaming is the only mode that works.

Real-world: online stock trading platforms — ICICI Direct is the example used — are streaming applications at heart. When you view a stock, the time series graph updates as a function of every second, even milliseconds. The interesting part is the bracket order: you set a price bracket as a threshold, and the platform monitors the streaming price data continuously. When the price enters the bracket, the purchase triggers automatically — no human in the loop. The events of the stock and its value are analyzed as a function of time, and the action is triggered by the analysis performed on this real-time streaming data.

The bracket order, worked step by step.

  1. Configure — you set a price bracket, say buy automatically when the stock price falls between 1,950 and 2,000 rupees, with the current price at 2,050.
  2. Monitor — the platform ingests the stock's price ticks (an event per second or per millisecond) and runs each tick through its stream pipeline.
  3. Match — each incoming price is compared against the bracket threshold. At 2,030 — no; at 2,010 — no; at 1,998 — the price enters the bracket.
  4. Trigger — the purchase executes automatically. No human watches the screen; the analysis of the streaming data is the trigger.

Sense-check: the value of this design is timing — a bracket order exists to act the instant the price crosses the threshold, which is only possible when the analysis runs on a seconds-scale stream. This is also the cleanest example of the "analyze → act" loop the whole course is built around: small events, continuously analyzed, with an action fired by the analysis.

1.9.3 Insurance and BFSI Analytics

Real-world: insurers such as Max Bupa and Sundaram use analytics at two different time scales. Issuing a policy to a prospective customer starts with analyzing your data and asking questions about your past health history. The indicators behind those questions come from batch processing: analyzing voluminous records of many insurance customers to derive risk markers — if a person carries these kinds of risks, the policy is issued or refused accordingly.

The same insurance domain shows the streaming-versus-batch split in miniature. Term plan policies — lifelong plans with monthly premiums — examine health and lifestyle factors like hypertension and diabetes to arrive at a recommended premium. That analysis runs as batch: you run the analytics script daily or every two days, derive trends, and use those trends for future decisions — including pricing riders on existing policies at a competitive price. The risk assessment is batch; the policy pricing is batch; but the same data, analyzed in seconds, would be stream.

Insurance risk markers, worked step by step.

  1. Collect — the insurer accumulates customer health records: medical histories, lifestyle factors (hypertension, diabetes, and similar markers), claims data.
  2. Batch analyze — a daily or every-two-days job scans these voluminous records and derives risk markers — statistical patterns linking customer attributes to risk.
  3. Apply — when a prospective customer applies, the questions asked and the policy decision (issue or refuse) are driven by those markers.
  4. Price — term plan premiums are recommended from the same batch-derived trends, including competitive pricing for riders on existing policies.

Sense-check: every step operates on hours-to-days time scales — risk markers do not change every second, so there is no value in recomputing them in real time. By the time-scale rule this is batch processing, and it is the professor's favorite contrast: the same insurance data, analyzed in seconds, would be a stream problem — the mode belongs to the question's time scale, not to the industry.

1.9.4 The Common Thread

Across all four domains — banking, ride-hailing, stock trading, insurance — the pattern is identical: small events generated continuously, analyzed within a chosen time scale, with an action triggered by the analysis. The only variable is the window: seconds for fraud and stock prices, minutes for traffic, hours or days for insurance risk trends. That is why the time-scale rule from Section 1.6 is the connective tissue of the entire course.

Q: Where do all these technologies fit in the real world? Can you give some examples of how stream processing is actually used? A: Take credit card transactions — day in and day out we do a lot of them, and each is captured as an event. If you swipe for more than 80,000 rupees, you get a phone call asking you to press one to confirm or press two to raise an issue. That happens because the bank analyzes the transactions in real time through its stream processing engine, which classifies some transactions as fraudulent using machine learning. Then consider Uber or Ola: cab availability, traffic congestion, real-time information for decision making — another stream processing example. And the best example is stock purchases on platforms like ICICI Direct: the time series graph is a function of every second or millisecond, you place a bracket order with a price threshold, and when the price enters the bracket the transaction triggers automatically by analyzing the events as they are generated at regular intervals. Insurance vendors like Max Bupa or Sundaram analyze your data and health history to issue a policy — those risk markers come from batch processing over voluminous records, run daily or every two days. So on whichever time scale you are working — minutes or seconds is stream processing, hourly or every eight hours or daily is batch processing — your architecture should be switched to both strategies.

1.10 Industry Relevance: Kafka, Spark, and Databricks

1.10.1 State-of-the-Art Skills

Real-world: a student asked whether the technologies in this course are actually used in industry or whether the course lags behind. The answer is direct: Kafka and Spark are state-of-the-art technologies — the two most important skills in the data engineering job market today. A couple of years back, the course covered all the frameworks with little time left for practice; the current focus is deliberate.

The positioning matters for career planning:

  • For a data engineer role, there are two very important skills: Kafka and Spark.
  • Spark can be done through Scala or through Python; this course uses the Python flavor of Spark — PySpark — the most happening variant.
  • Spark and Databricks are very prominent in industry right now — Databricks is a major platform in production data work.

The other frameworks the course mentions are still real, but less central — which is exactly why they are assigned for exploration rather than taught in depth. You come out with working depth on the two technologies that matter most, and a survey-level understanding of the rest.

Q: Are the technologies we will learn in this course used in the industry — is it state of the art, or are we lagging behind? A: This is a fantastic question. If you look at the data engineer role, there are two skills that are very, very important: one is Kafka, the other is Spark. Spark can be done through Scala or Python, but we are looking at the Python flavor — PySpark — which is most happening. And Spark with Databricks is very prominent — the Databricks platform is very popular in industry now. So these two are basically state-of-the-art technologies. The remaining platforms may not be that relevant, which is why I am putting them as part of your assignments — you get a basic understanding of the other platforms, but we take the deep dive on Kafka and Spark.

The straight answer, extracted: the course is not lagging — it is deliberately front-loaded on the two skills the data engineer job market actually pays for. When you meet a "why this course?" question, the expected answer is the job-market one: Kafka (moving events) + Spark (analyzing events) are the state-of-the-art pair for data engineering, and PySpark is the most widely used flavor of Spark.

1.10.2 Kafka on Your Laptop

A common fear about Kafka is the setup — installation and orchestration feel heavy, and people become apprehensive about picking up the technology because of it. The course removes that barrier. Kafka's free community edition can be installed locally on your laptop, and the instructor shares the industry installation setup file plus the script commands for running producers and consumers. There is a structured way to set up the environment locally, and the course follows it exactly, so you can follow along in parallel on your own machine.

What a Kafka producer and consumer actually do. A producer is any process that writes events into Kafka; a consumer is any process that reads them. Between the two sits Kafka's core abstraction, the topic — a named, partitioned log where events are appended and later read back in order. When you run the instructor's producer script, you are appending events to a topic; when you run the consumer script, you are tailing that topic. That is the entire mental model the course builds on, and it is why the local setup is so valuable: a two-terminal demo (produce on one, consume on the other) makes the abstraction concrete in minutes.

1.10.3 PySpark and Structured Streaming

On the Spark side, the course focuses on two things: Spark structured streaming and the Spark DataFrame API. Structured streaming is the newer addition to this run of the course — if you are familiar with SQL queries, it answers the question "how do we write queries over streaming data?" This is the "structured data" dimension students sometimes ask about: it is Spark SQL applied to streams.

The second half of the course is predominantly hands-on with Spark: creating Spark DataFrames, the analytics aspects of PySpark, and — across two to three lectures — the details of which traditional algorithms carry over to streaming applications. The machine learning algorithms themselves are self-learned for the assignment, while the instructor demonstrates the platform side.

The intellectual bridge to structured streaming. If you already know SQL — SELECT ... FROM ... WHERE ... GROUP BY — then structured streaming asks you to run those same queries on data that never stops arriving. The engine handles the windowing for you: your query defines what to compute, and the streaming layer decides which window each event belongs to and when to emit results. The course's two to three lectures on algorithms that carry over to streaming are the same bridge viewed from the other side: given a traditional algorithm (a count, a distinct count, a percentile), which version still works when the input is an endless stream and the memory budget is small?

1.10.4 Hadoop Is Optional

Real-world: a student with local Spark experience asked whether Spark streaming needs Hadoop at the backbone. The answer: Hadoop can be used, but it is not a necessary option — there are multiple options. HDFS is one distributed file system mechanism, but the semantics of distributed computing do not depend on it; the course explains the various configuration setups for a cluster, while focusing on how to set up the ecosystem on a laptop locally.

For learning purposes, Hadoop is not needed at all: knowing the concepts and running a proof of concept locally is entirely sufficient. In production, Hadoop could be one of the parallel options — but the focus of this course is how to best use the streaming platforms themselves. If you look at Databricks, it was developed by the creators of Spark and has everything built in — you never bother about installing clusters; the platform takes care of it, and there is a lot of help documentation. There is a cost attached to some workloads, but it is not high, and compared with GCP, AWS, or Azure, Databricks has become more and more prominent because of its features and user-friendliness for Spark analytics.

Q: Does Spark streaming use Hadoop at the backbone? I know Hadoop makes things production scale, but can we experiment without it? A: It can be used, but it is not a necessary option — there are multiple options we can use. I will be explaining the various configuration setups for the cluster, but I will predominantly focus on how you set up this ecosystem on the laptop locally. In my own experience I configured Hadoop locally even when the client had it on a real cluster — for exploring the areas, we just configured locally. Hadoop is one of the file system mechanisms for distributed computing; each machine in a cluster is identically similar, and the semantics are preserved. Unless it is a real-time environment, you normally do not have the feasibility of having all the infrastructure, especially for training purposes. Just knowing the concept and doing a proof of concept is absolutely fine — Hadoop is probably not needed to explore the concepts. In production it could be one of the options, but for learning, the laptop setup is enough, and Databricks takes care of the cluster entirely.

The correction to remember: HDFS is one storage option, not a requirement of distributed computing. Distributed processing semantics (tasks running across identically similar machines, outputs recomputable from inputs) hold whether the filesystem is HDFS, a cloud blob store, or a local disk. For the course, the laptop setup proves the concepts; in production, Hadoop is one of several parallel options — and on Databricks it is handled entirely by the platform.

Exam note: the industry-relevance claims in this section are context that can frame exam answers, not examinable facts themselves. What is examinable is the reasoning pattern: Kafka and Spark are the state-of-the-art pair for data engineering; PySpark is the Python flavor of Spark used with Databricks; Hadoop is optional for learning (laptop proof-of-concept suffices); and the course's assignment list covers the ecosystem beyond these two.

1.11 Prerequisites and Preparation

1.11.1 Python Programming

The one prerequisite the instructor states outright is Python programming. Backgrounds vary from batch to batch, so if the majority of the class does not have Python experience, there will be a one-hour refresher — one lecture on the programming basics, described as "not so difficult." You do not need to be a Python expert going in; you need to be able to read and write basic Python, and the refresher covers the gap for those who need it.

Why Python specifically? The course's computation platform is PySpark — Spark's Python API — and the assignment code, the notebook work, and the structured-streaming examples are all written in Python. Basic Python fluency (variables, lists, loops, functions, reading data) is enough to start; the course does not require advanced Python. The one-hour refresher exists because batches vary: if most of the class already programs, the refresher may not run at all — the decision is made based on the majority, not the individual.

1.11.2 Maturity Over Tools

No specific technologies are required beforehand. Once you know a couple of programming languages and how an IDE works, installation and setup are not a problem — that is learnable on the spot. The fundamental requirement is programming fluency in any language: Java is fine, Python is the course language, and the only real problem would be entering the course unfamiliar with any programming language at all.

The stated expectation for students: you already carry industry maturity — understanding, context, and the ability to reason about systems. The course expects that maturity, and nothing else is needed.

Q: What are the prerequisites of this course — what should we know before we start? A: Each batch comes with a different background, so I will tell you straight: you need to know Python programming. If the majority of you do not have that experience, we will have a one-hour refresher — one lecture on programming, and it is not so difficult. There are no specific technologies you need. Once you know a couple of languages and how the IDE works, you will know how to install and set things up — that is not a problem. The only real problem would be if you are not familiar with any programming language at all. So: Python is needed, any other programming background such as Java is fine, and no specific technology stack is expected.

The takeaway, in one line: the course requires programming maturity, not tool knowledge. Languages and IDEs are learnable on the spot; the ability to reason about systems is the real prerequisite, and the course is designed for working professionals who already carry it.

1.12 Learning Philosophy and Expectations

1.12.1 Assessments Match the Class

The course's operating principle is stated up front and repeated: assessments are perfectly aligned with what is covered in class. The instructor is explicit that students will not face pressure preparing for the exams, because the exam focus is exactly the class content. There is no extra study and no self-study exercise required — the course is designed for working professionals, for whom putting ten hours a week into a course is unrealistic, and the instructor reasons that too many expectations cause students to lose interest.

Exam note: even that is enough: the preparation guidance is simply reviewing the notes from the last class for 10 to 15 minutes a day before the next class. That daily revision is your exam preparation. Your examination is not a separate, isolated activity — it is part of what you learn in the classes.

1.12.2 Closed Book and Open Book Need the Same Skills

The distinction between EC2 (closed book) and EC3 (open book) matters less than students expect. The instructor's position: even the closed-book exams could be given as open-book exams — there is no real difference, because the evaluation is about whether you know the concept, whether you know how to design an architecture, and whether you have learned the skills. It is not about remembering and reproducing. Whether the book is open or closed, the questions test understanding: evaluate this architecture, design an architecture for this business case, write this algorithm for streaming data.

What "understanding, not recall" means in practice. A recall-based exam asks "state the definition of a tumbling window" — answerable by memory. This course's exam asks "here is an architecture; evaluate it" or "here is a business case; design the architecture" — answerable only by reasoning. That is why open or closed book makes no real difference: you cannot look up reasoning in a book. Prepare by practicing the evaluation and design moves (every lecture's whiteboard work is practice for exactly these moves), not by memorizing definitions.

1.12.3 The Daily Revision Habit

The recommended rhythm is deliberately light: every day, spend 10 to 15 minutes on the notes covered in the last class before coming to the next class. That is sufficient — it doubles as exam preparation. The philosophy is that learning should not feel like pressure; the instructor's own analogy: if someone gives you a delivery target of 5 p.m., you deliver, but with the 5 p.m. target in the back of your mind, some pressure is always on. If the same person says "forget about delivery, give it whenever you are comfortable" and just checks the status at 5 p.m., you have progressed more — you know a greater amount — precisely because the pressure was removed. Deadlines that remove pressure improve learning.

The delivery analogy, mapped. The relationship being explained is pressure → performance. In the analogy: the delivery target (5 p.m.) is the deadline; the deliverer is the student; the check-in at 5 p.m. is the assessment. The claim: an aggressive deadline keeps pressure on the whole way, while a deadline stated as a soft check-in keeps the work happening without the anxiety — and the anxious student learns less. Where the analogy breaks: real assessment deadlines (the quiz window, the 24th of March submission) still must be met — the course is not deadline-free, it is pressure-free. The 10–15 minute daily habit is the mechanism: small, steady, low-stakes work that accumulates into exam readiness.

1.12.4 Why Attend at All

The question "why should you attend these classes when all content exists on YouTube and Google" gets a direct answer: you cannot manage without attendance. The lectures are customized specifically to this particular handout and curriculum, and — most importantly — they attach a real-time industry perspective to the content. That perspective is something you will not find elsewhere; it is the unique value of the sessions.

The second argument for attendance is structure. A student summed it up: left to oneself, exploration can go anywhere — you can plan, detail, and get lost in exploration. A concrete learning plan guides you, so you cover the right things in the right order. The class is that plan, executed with a real-time perspective attached.

Q: I have the internet, YouTube, and Google — I can search anything. So why should I attend these classes at all? A: Because these lectures are customized specifically to this particular handout. Most importantly, we attach real-time perspectives to this content — the real-time industry angle is something you will not be able to find elsewhere. That is why it is important to attend. And you get a concrete learning plan — a structured path so you do not get lost in exploration. With the plan, you know exactly what is covered, what is expected, and how it is evaluated.

Q: I want to learn as much as possible — I have 25 years of industry experience as an architect, so I know a little about stream analytics and the problems it tries to solve. What is your plan for the course? A: The first part of this course is predominantly architecture — various streaming architectures, how we design architectures for streaming applications, the principles of design for streaming architectures — all that we cover until mid-semester. After mid-semester it is all hands-on with Spark, and for the first time I also want to use some Java in Kafka streaming and demonstrate certain things. We will do everything with our own hands, and explicit instructions will be shared with you so you can do it in parallel on your own laptop.

The two answers together define the course's contract: customized content + industry perspective + a structured path you cannot get from general search. Even a 25-year architect is offered something new — the first half's architecture-design principles and the second half's hands-on Spark with explicit parallel instructions. The answer to "why attend" is that the search engine gives you everything except the specific mapping of this curriculum to this industry reality.

Exam note: the mid-semester is theory-based — evaluate a given architecture, or take a business case and develop an architecture. The post-mid-semester content is algorithm design and implementation. Both follow the same rule: what is covered in class is what is examined. There is nothing hidden, nothing extra. Also remember the assessment alignment claim: assessments are perfectly aligned with class coverage, so the 10–15 minute daily revision of the previous class's notes is genuinely sufficient preparation.

Exam Guidance Summary

  • Weightage: Assignment 1 (10) + Assignment 2 (10) + Quiz (10) = EC1, 30 marks. EC2 (mid-semester) = 30 marks, roughly 3–4 questions, closed book. EC3 (comprehensive) = 40 marks, open book. Five-credit course. Total 100 marks.
  • Quiz mechanics: two quizzes of five marks each; objective type (true/false); 10 questions in roughly 15–20 minutes depending on complexity; a 3–4 day window (typically Friday through Monday); no makeup; once started, must finish in one sitting.
  • Assignment 1: deep exploration of a streaming architecture (Flink, Samza, AWS Kinesis, similar); groups of four (calibrated to class strength); given after the 6th lecture; 3-week window; flexible deadline; 10 marks; submitted as an artifact.
  • Assignment 2: machine learning techniques on Spark via PySpark on Databricks community edition; 10 marks; can be submitted with Assignment 1 as a single Jupyter notebook (part one: assignment 1 documentation, part two: assignment 2 code).
  • Mid-semester style: theory-based. Expect architecture evaluation ("here is an architecture — evaluate it") and business case to architecture design ("here is a business case — design the architecture"). Covers data systems, streaming architecture principles, and Kafka architecture up to the exam.
  • Post-mid-semester style: coding questions; algorithm design and implementation over streaming data; two to three lectures cover which traditional algorithms carry over to streaming.
  • Core conceptual rules: the time-scale rule decides stream vs batch (minutes/seconds = stream; hourly/daily = batch); the window mechanics (event-based vs time-based, river-bucket mapping) are classic theory questions; streaming algorithms are probabilistic and non-deterministic because the random sample may not reflect the entire stream.
  • No pressure: assessments align exactly with class coverage; no extra study; 10–15 minutes of daily note review between classes is enough preparation. Closed-book and open-book exams test the same skills — understanding and design, not recall.

Key Industry Applications

  • Kafka + Spark (PySpark): state-of-the-art skills for data engineer roles; the two most important technologies in the streaming space; Databricks prominent in industry.
  • Credit card fraud detection: events of a few kilobytes analyzed in real time by a stream processing engine; machine learning classifies transactions; a swipe above 80,000 rupees triggers a confirmation call (press 1 to confirm, press 2 to raise an issue).
  • Ride-hailing (Uber, Ola): cab availability and traffic congestion analyzed in real time for decision making.
  • Stock trading (ICICI Direct): time series graphs updating per second or millisecond; bracket orders auto-trigger purchases when the streaming price enters the threshold bracket.
  • Insurance (Max Bupa, Sundaram): batch analytics over voluminous customer records derive risk markers for policy issuance; term plan premiums reflect health factors like hypertension and diabetes; rider pricing set competitively from daily or two-day batch trends.
  • Time-scale rule: minutes or seconds → stream processing; hourly, 8-hourly, or daily → batch processing; Kafka and Spark support customizable batch sizes (micro-batch, stream, or scheduled batch), so one architecture serves both regimes.
  • The common pattern: across banking, ride-hailing, trading, and insurance — small events generated continuously, analyzed within a chosen time scale, with an action triggered by the analysis; only the window (seconds for fraud and stock prices, minutes for traffic, hours or days for insurance trends) varies.
  • Kafka community edition: free local installation on a laptop with shared setup files and producer/consumer script commands — no cloud needed to learn.
  • Databricks community edition: free cloud platform from the creators of Spark; AWS, Azure, or GCP flavor chosen at registration; handles cluster setup entirely.

SPA Lecture 01 notes · Stream Processing and Analytics — Course Overview and Core Concepts

Stream Processing and Analytics· postgraduate· 2026-08-07

Sections Breakdown

1Course Overview and Learning Plan

The course explores stream processing and streaming analytics around two platforms: Kafka as the streaming backbone that moves events, and PySpark as the analytics engine that processes them; the ecosystem (Flink, Samza, AWS Kinesis) is surveyed through assignments.

2Course Structure, Modules, and Resources

Four modules (data systems, streaming architectures, streaming frameworks/Kafka, then post-mid-semester streaming analytics and SQL) with the mid-semester exam after Kafka architecture; 16 actual contact sessions in flip mode, one primary textbook, and shared Kafka setup files as practical resources.

3Evaluation Components

Evaluation is 100 marks: EC1 (30) = assignment 1 (10) + assignment 2 (10) + two 5-mark quizzes (10); EC2 mid-semester (30, closed book, 3-4 theory questions on architecture evaluation and design); EC3 comprehensive (40, open book). Quizzes are timed (15-20 minutes for 10 objective questions), run on a 3-4 day window with no makeup and no pausing.

4Assignment 1 — Deep Exploration of Streaming Architectures

Assignment 1 (10 marks, part of EC1) is a group deep exploration of one streaming architecture (Flink, Samza, AWS Kinesis, or similar), submitted as an artifact; group size is calibrated to class strength (4 per group for 45-50 students, 2-3 for 10-15), published after the 6th lecture with a flexible 3-week window.

5Assignment 2 — Machine Learning with PySpark on Databricks

Assignment 2 (10 marks) implements machine learning techniques on Spark via PySpark on the free Databricks community edition, using the platform's MLlib-style libraries on DataFrames; algorithms are self-learned while the instructor teaches the platform mechanics; both assignments submit as one Jupyter notebook.

6Stream Processing vs Batch Processing

The stream-vs-batch decision is the time-scale rule: analysis on a minutes-or-seconds scale is stream processing, hourly-to-daily scheduling is batch processing; customizable batch sizes (micro-batch, stream, proper batch) let one architecture serve both regimes, and batch is the same pipeline at a larger collection-window time scale, not a separate technology.

7Windows in Stream Processing

Windows are finite slices of an infinite stream defined by two collection strategies: event-based (count) windows fill to a fixed event count regardless of time, and time-based (temporal) windows collect everything arriving within a fixed duration; the river-bucket analogy maps bucket level to count and stopwatch to clock, and window choice trades latency against accuracy.

8Deterministic vs Probabilistic Streaming Algorithms

Deterministic algorithms (linear search frequency counting) return the same output for the same input because the complete input is examined; streaming algorithms are probabilistic and non-deterministic because the logical window holds only a random sample that may not reflect the entire stream, so design picks probabilistic algorithms with known error bounds and uses window length as the accuracy dial.

9Real-World Applications of Stream Processing

Four domains share one pattern — small events generated continuously, analyzed within a chosen time scale, action triggered by the analysis: credit card fraud detection (a swipe above 80,000 rupees triggers a real-time confirmation call), ride-hailing (Uber/Ola cab availability and congestion), stock trading (ICICI Direct bracket orders auto-trigger when price enters the bracket), and insurance (Max Bupa/Sundaram batch-derived risk markers for policy issuance).

10Industry Relevance: Kafka, Spark, and Databricks

Kafka and Spark are state-of-the-art and the two key data engineer skills; the course uses PySpark (Python flavor) with Databricks; Kafka's free community edition installs locally with shared setup files and producer/consumer scripts; Hadoop is an optional backbone for Spark streaming, not a requirement, with HDFS being one file system mechanism among several.

11Prerequisites and Preparation

Python programming is the one stated prerequisite (with a one-hour refresher if the majority lacks it); no specific technologies are required — programming fluency in any language plus industry maturity is what the course expects.

12Learning Philosophy and Expectations

Assessments align exactly with class coverage so no extra study is needed; closed-book and open-book exams test the same understanding-and-design skills; 10-15 minutes of daily revision of the previous class's notes is sufficient exam preparation; attendance adds a customized curriculum, real-time industry perspective, and a concrete learning plan.

13Exam Guidance Summary

Consolidated exam guidance: EC1 (30) = two assignments (10 each) + quiz (10); EC2 mid-semester (30, closed book, 3-4 theory questions on architecture evaluation and design); EC3 comprehensive (40, open book, coding); quiz window/no-makeup/no-pause rules; stream vs batch time-scale rule, window mechanics, and probabilistic streaming algorithms as core theory topics; 10-15 minutes daily revision is sufficient.

14Key Industry Applications

Named real-world applications of stream processing: credit card fraud detection (80,000-rupee swipe triggers confirmation call), ride-hailing (Uber, Ola), stock trading (ICICI Direct bracket orders), insurance batch risk markers (Max Bupa, Sundaram); plus Kafka/Databricks community editions and the time-scale rule as the connective tissue.

Postgraduate students in stream processing and analytics

Exam Revision Notes

Below is the distilled, exam-ready core. Every entry comes from the full explanation above. Use this section for rapid review; return to the main notes when a point needs more context.

Course Overview and Learning Plan

Must-know: Two platforms drive the course: Kafka moves/stores continuous event streams (the backbone), Spark via PySpark analyzes them at scale; other frameworks (Flink, Samza, AWS Kinesis) are covered through assignments only.

⚠️ Top pitfall: Confusing the two platform roles: Kafka is the transport/ingestion layer, Spark is the computation layer; a streaming pipeline needs both legs.

Self-check: Which platform in this course is described as the streaming backbone that ingests, stores, and moves continuous streams of events?

Connects to: Industry Relevance: Kafka, Spark, and Databricks (1.10); Course Structure, Modules, and Resources (1.2)

Course Structure, Modules, and Resources

Must-know: Module order is data systems → streaming architecture principles → Kafka architecture (mid-semester boundary) → streaming analytics, streaming SQL, and streaming algorithms; the mid-semester covers everything up to and including Kafka architecture.

⚠️ Top pitfall: Assuming the 11 visible contact sessions are the whole course — there are actually 16; the plan display quirk hides content, not reduces it.

Self-check: Where does the mid-semester exam land in the module sequence?

Connects to: Course Overview and Learning Plan (1.1); Evaluation Components (1.3)

Evaluation Components

Must-know: EC1 = 10 + 10 + 10 = 30; EC2 mid-semester = 30 (closed book, 3-4 questions, theory: evaluate an architecture or design one for a business case); EC3 comprehensive = 40 (open book, coding and algorithm design).

⚠️ Top pitfall: Calendar dates for assignments are publish dates, not deadlines; the submission closes three weeks later. For quizzes: no makeup and no pausing once started.

Self-check: If the mid-semester exam is closed book with roughly 3-4 questions for 30 marks, what style of questions should you expect?

Connects to: Course Structure, Modules, and Resources (1.2); Learning Philosophy and Expectations (1.12)

Assignment 1 — Deep Exploration of Streaming Architectures

Must-know: Assignment 1 = deep exploration of a streaming architecture (Flink, Samza, AWS Kinesis); groups of four calibrated to class strength; published after lecture 6 with a 3-week, mutually agreeable deadline; 10 marks in EC1; submitted as an artifact.

⚠️ Top pitfall: Assuming group size is fixed at four — it is calibrated to class strength (2-3 people per group for smaller batches).

Self-check: Why does the course assign Flink, Samza, and AWS Kinesis for exploration instead of teaching them in class?

Connects to: Evaluation Components (1.3); Industry Relevance: Kafka, Spark, and Databricks (1.10)

Assignment 2 — Machine Learning with PySpark on Databricks

Must-know: Assignment 2 = ML on Spark via PySpark on the free Databricks community edition; ML algorithms are self-learned; the instructor teaches platform mechanics (Spark DataFrames, analytics); one Jupyter notebook holds both assignments.

⚠️ Top pitfall: Confusing 'structured' with a generic adjective — in this course it means the structured-data stack: Spark SQL, the DataFrame API, and structured streaming over streams.

Self-check: Why does the course use the Databricks community edition rather than having students install Spark clusters?

Connects to: Evaluation Components (1.3); Industry Relevance: Kafka, Spark, and Databricks (1.10); Prerequisites and Preparation (1.11)

Stream Processing vs Batch Processing

Must-know: Time-scale rule: minutes/seconds = stream processing; hourly/8-hourly/daily = batch processing. Kafka and Spark support customizable batch sizes (micro-batch, stream, proper batch), so one architecture switches between both strategies; batch is the same picture at a larger collection-window time scale.

⚠️ Top pitfall: Treating stream and batch as different technologies — they are the same collection-window mechanism at different time scales; also confusing the mode with the platform (Spark runs batch; Kafka is a durable log).

Self-check: A bank runs real-time fraud checks on transactions while they happen and overnight risk analysis over millions of records. Which mode is which, and what single rule decides?

Connects to: Windows in Stream Processing (1.7); Deterministic vs Probabilistic Streaming Algorithms (1.8); Real-World Applications of Stream Processing (1.9)

Windows in Stream Processing

Must-know: Two window mechanisms: event-based (count) windows collect until a fixed number of events; time-based (temporal) windows collect everything in a fixed duration. River bucket level = count window; stopwatch = time window. Windows exist because infinite data cannot be processed as an infinite batch. Tumbling/sliding/session variants extend the time family.

⚠️ Top pitfall: Expecting windows to be deterministic (which events land in a window is a random process governed by arrival timing), and ignoring event time vs processing time when assigning delayed events to windows.

Self-check: A dashboard processes exactly the events that arrive in each 60-second slice, regardless of how many arrive. Which window mechanism is this, and which part of the river analogy does it map to?

Connects to: Stream Processing vs Batch Processing (1.6); Deterministic vs Probabilistic Streaming Algorithms (1.8)

Deterministic vs Probabilistic Streaming Algorithms

Must-know: Streaming algorithms are probabilistic and non-deterministic because the random sample (logical window) may not reflect the entire stream; deterministic algorithms like linear-search frequency counting give the same count on every run; window length is the dial controlling accuracy of probabilistic algorithms.

⚠️ Top pitfall: Expecting a streaming computation to return the same answer on every run — the sample is random; check the window and the sample, not the code.

Self-check: Why does the same frequency-counting analysis produce slightly different numbers when run twice on a stream, while the same analysis on a complete batch list does not?

Connects to: Stream Processing vs Batch Processing (1.6); Windows in Stream Processing (1.7)

Real-World Applications of Stream Processing

Must-know: Common pattern across banking, ride-hailing, trading, insurance: small continuous events analyzed at a chosen time scale trigger an action. Fraud = seconds/stream (confirmation call above 80,000 rupees); Uber/Ola = minutes/stream; insurance risk markers = daily batch; ICICI Direct bracket order = stream trigger.

⚠️ Top pitfall: Assigning the mode to the industry instead of the time scale — insurance uses batch for risk markers but the same data analyzed in seconds would be stream; the question's time scale decides.

Self-check: In the ICICI Direct bracket order example, which step is the trigger for the automatic purchase, and what time scale makes it possible?

Connects to: Stream Processing vs Batch Processing (1.6); Windows in Stream Processing (1.7)

Industry Relevance: Kafka, Spark, and Databricks

Must-know: Kafka + Spark = the two state-of-the-art skills for data engineer roles; PySpark is the Python flavor; Databricks is prominent and handles clusters; Kafka community edition installs locally; Hadoop is optional (HDFS is one distributed file-system mechanism, not a requirement); Databricks is from Spark's creators with AWS/Azure/GCP flavors.

⚠️ Top pitfall: Believing Spark streaming requires Hadoop at the backbone — it can be used but is not necessary; the laptop setup and Databricks remove the cluster-installation barrier entirely.

Self-check: For a data engineer role, which two skills does the professor identify as the most important, and which Python flavor of Spark does the course use?

Connects to: Course Overview and Learning Plan (1.1); Assignment 2 — Machine Learning with PySpark on Databricks (1.5)

Prerequisites and Preparation

Must-know: Prerequisite: Python programming (basic read/write fluency; a one-hour refresher covers gaps if the majority needs it). No specific technology stack expected; any programming background (e.g., Java) is fine; the only real problem is entering with no programming language at all.

⚠️ Top pitfall: Believing specific tools or a Spark/Hadoop background are required beforehand — installation and setup are learnable on the spot; maturity and reasoning ability are the real prerequisite.

Self-check: If the majority of the batch lacks Python experience, what does the instructor offer?

Connects to: Course Overview and Learning Plan (1.1); Assignment 2 — Machine Learning with PySpark on Databricks (1.5)

Learning Philosophy and Expectations

Must-know: Assessments align exactly with class coverage; daily 10-15 minute review of the last class's notes is the exam preparation; open/closed book test the same skills (evaluate an architecture, design an architecture for a business case, write streaming algorithms); what is covered in class is what is examined.

⚠️ Top pitfall: Treating the exams as separate, isolated study tasks — the course's design makes exam preparation identical to daily revision of class notes; extra self-study is unnecessary.

Self-check: According to the professor's delivery analogy, why does removing the pressure of a hard deadline improve learning progress?

Connects to: Evaluation Components (1.3); Stream Processing vs Batch Processing (1.6)

Exam Guidance Summary

Must-know: 100-mark breakdown: EC1 30 (A1 10 + A2 10 + quiz 10), EC2 30 closed book theory (architecture evaluation + design), EC3 40 open book (coding/algorithm design); quizzes are timed, windowed, no-makeup, no-pause; stream vs batch = time-scale rule; window mechanics and probabilistic algorithms are core theory.

⚠️ Top pitfall: Assuming EC2 and EC3 need different preparation — both test understanding and design, not recall; class coverage equals exam scope.

Self-check: Which exam component is closed book with 3-4 theory questions, and what two question styles should you expect in it?

Connects to: Evaluation Components (1.3); Stream Processing vs Batch Processing (1.6); Windows in Stream Processing (1.7); Deterministic vs Probabilistic Streaming Algorithms (1.8); Learning Philosophy and Expectations (1.12)

Key Industry Applications

Must-know: Fraud detection = stream (confirmation call on >80,000 rupee swipe); Uber/Ola = stream; ICICI Direct bracket orders = stream trigger; insurance risk markers (Max Bupa, Sundaram) = batch (daily/every two days); time-scale rule decides the mode everywhere.

⚠️ Top pitfall: Assigning an application to stream or batch by industry rather than by the time scale of the analysis question.

Self-check: In the insurance example, why are risk markers derived by batch processing rather than streaming?

Connects to: Stream Processing vs Batch Processing (1.6); Real-World Applications of Stream Processing (1.9)

Was this lecture useful?

Loading comments…
🤖

BitsNotes AI Assistant

Subject Notes Assistant

Configure AI Chat

Choose how to access the chatbot
Have your own API key?

Switch to "Bring Your Own Key" tab above for unlimited access with any OpenAI-compatible provider.

🔑 Enter API key above to fetch live models from provider, or enter model name manually.
OpenAI-Compatible API Support

Choose any provider preset (Gemini, DeepSeek, Kimi, GLM, MiniMax, Qwen, OpenAI, Groq, Ollama, etc.) or enter a custom endpoint URL.

Security & Privacy First

Your API key is sent directly from your browser to your specified provider. BitsNotes servers never store or see your key.