Watermarking for late data in Apache Spark

Introduction

Watermarking helps us handle data that arrives late in streaming. It tells the system how long to wait for late data before processing.

When processing live data streams like sensor readings that might arrive late.

When analyzing user activity logs that can be delayed due to network issues.

When aggregating events by time windows but some events come after the window closes.

When you want to balance between waiting for late data and producing timely results.

Syntax

Apache Spark

streamingDF.withWatermark("eventTime", "delayThreshold")

eventTime is the column with event timestamps.

delayThreshold is how long to wait for late data, e.g., "10 minutes".

Examples

Waits 5 minutes for late data based on the 'timestamp' column.

Apache Spark

streamingDF.withWatermark("timestamp", "5 minutes")

Waits 1 hour for late data based on the 'event_time' column.

Apache Spark

streamingDF.withWatermark("event_time", "1 hour")

Sample Program

This example shows how to add a watermark of 5 minutes on the eventTime column. It groups events into 5-minute windows and counts them. Late events arriving after 5 minutes will be ignored in aggregation.

Apache Spark

from pyspark.sql import SparkSession
from pyspark.sql.functions import window, col

spark = SparkSession.builder.appName("WatermarkExample").getOrCreate()

# Sample streaming data simulating events with timestamps
input_data = [
    ("2024-06-01 10:00:00", "event1"),
    ("2024-06-01 10:02:00", "event2"),
    ("2024-06-01 10:07:00", "event3"),  # Late event
]

# Create DataFrame with schema
schema = "eventTime STRING, event STRING"
staticDF = spark.createDataFrame(input_data, schema)

# Convert eventTime to timestamp type
streamingDF = staticDF.withColumn("eventTime", col("eventTime").cast("timestamp"))

# Simulate streaming by using staticDF as streaming source (for example only)
# In real use, streamingDF would come from a streaming source like Kafka

# Apply watermark of 5 minutes on eventTime
watermarkedDF = streamingDF.withWatermark("eventTime", "5 minutes")

# Group events by 5-minute windows
aggDF = watermarkedDF.groupBy(window(col("eventTime"), "5 minutes")).count()

# Show the aggregation result
aggDF.show(truncate=False)

spark.stop()

Important Notes

Watermarking only works with event time columns of timestamp type.

Late data arriving after the watermark delay is dropped from aggregations.

Choosing the right delay threshold balances accuracy and latency.

Summary

Watermarking helps handle late data in streaming by setting a wait time.

Use with event time columns to group or aggregate streaming data.

Late data beyond the watermark is ignored to keep results timely.

Practice

1. What is the main purpose of watermarking in Apache Spark streaming?

easy

A. To handle late data by setting a threshold time for event processing

B. To speed up the streaming job by skipping data

C. To permanently store all incoming data

D. To convert batch data into streaming data

Solution

1. Step 1: Understand watermarking concept

   Watermarking sets a time limit to wait for late data in streaming.

2. Step 2: Identify purpose in streaming

   It helps to ignore data that arrives too late to keep results timely.

3. Final Answer:

   To handle late data by setting a threshold time for event processing -> Option A

4. Quick Check:

   Watermarking = handle late data [OK]

Hint: Watermarking sets max wait time for late events [OK]

Common Mistakes:

• Thinking watermark speeds up jobs by skipping all data
• Confusing watermark with data storage
• Assuming watermark converts batch to streaming

2. Which of the following is the correct syntax to add a watermark on a streaming DataFrame df with event time column eventTime and delay threshold of 10 minutes?

easy

A. df.withWatermark(eventTime, 10)

B. df.withWatermark("eventTime", "10 minutes")

C. df.watermark("eventTime", 10)

D. df.withWatermark("eventTime", 10)

Solution

1. Step 1: Recall correct method signature

   The method is withWatermark with two string arguments: column name and delay duration.

2. Step 2: Match correct syntax

   df.withWatermark("eventTime", "10 minutes") uses correct method and string format for delay "10 minutes".

3. Final Answer:

   df.withWatermark("eventTime", "10 minutes") -> Option B

4. Quick Check:

   Correct syntax uses strings for both args [OK]

Hint: Use strings for column and delay in withWatermark() [OK]

Common Mistakes:

• Passing column name without quotes
• Using integer instead of string for delay
• Using wrong method name like watermark()

3. Given the following Spark Structured Streaming code snippet, what will be the output schema's watermark column after applying watermark?

val streamingDF = spark.readStream.format("csv")
  .option("header", "true")
  .load("/data/events")

val withWatermarkDF = streamingDF.withWatermark("eventTime", "5 minutes")
withWatermarkDF.printSchema()

medium

A. eventTime: timestamp (nullable = true) with watermark

B. eventTime: string (nullable = true) with watermark

C. eventTime: timestamp (nullable = false) without watermark

D. No watermark added to schema

Solution

1. Step 1: Understand watermark effect on schema

   Watermark adds metadata to the event time column, which must be timestamp type.

2. Step 2: Check expected schema output

   Schema shows eventTime as timestamp with watermark metadata.

3. Final Answer:

   eventTime: timestamp (nullable = true) with watermark -> Option A

4. Quick Check:

   Watermark adds metadata to timestamp column [OK]

Hint: Watermark adds metadata to timestamp event column [OK]

Common Mistakes:

• Assuming eventTime remains string type
• Thinking watermark changes nullability
• Believing watermark does not affect schema

4. Identify the error in the following Spark Structured Streaming code that uses watermarking:

val df = spark.readStream.format("json")
  .load("/stream/data")

val result = df.withWatermark("timestamp", "1 minute")
  .groupBy(window(col("timestamp"), "30 seconds"))
  .count()

medium

A. withWatermark must be called after groupBy

B. Column name "timestamp" should be "eventTime"

C. Window duration cannot be "30 seconds"

D. Watermark delay must be shorter than window duration

Solution

1. Step 1: Check watermark and window durations

   Watermark delay must be shorter than window duration to ensure the query emits results.

2. Step 2: Compare durations in code

   Watermark is 1 minute but window is 30 seconds, watermark delay longer than window duration and causes error.

3. Final Answer:

   Watermark delay must be shorter than window duration -> Option D

4. Quick Check:

   Watermark < window duration [OK]

Hint: Watermark delay must be < window duration [OK]

Common Mistakes:

• Assuming any column name works
• Thinking window duration cannot be "30 seconds"
• Calling withWatermark after groupBy

5. You have a streaming dataset with event times and want to aggregate counts per 10-minute window. Late data can arrive up to 15 minutes late. Which watermark delay should you set to ensure correct results without excessive delay?

hard

A. "25 minutes"

B. "10 minutes"

C. "15 minutes"

D. "5 minutes"

Solution

1. Step 1: Understand watermark delay role

   Watermark delay should cover the maximum expected lateness of data to include late events.

2. Step 2: Match delay to late data arrival

   Since late data can arrive up to 15 minutes late, watermark delay must be at least 15 minutes.

3. Step 3: Avoid setting delay too short or too long

   Setting delay less than 15 minutes risks dropping late data; too long delays output.

4. Final Answer:

   "15 minutes" -> Option C

5. Quick Check:

   Watermark delay = max late arrival [OK]

Hint: Set watermark delay to max expected late arrival [OK]

Common Mistakes:

• Setting delay equal to window size instead of late arrival
• Using shorter delay than late data time
• Using unnecessarily long delay causing latency