Multi-stream: pair open/close events and measure SLA breaches

Duration lives across two rows of the same feed. Group by the correlation id and collect the pair into a small map - then the ticket that never closed is a null rather than a crash, and it is the row that matters most.

Full code & output

This topic is available to signed-in members.