What was the final decision taken on the above approaches? We are building fraud detection application with Flink and planning to go with way 2 mentioned by you. Aggregates will be written to topics and another Flink job for rule execution will subscribe to required topics. There are two draw backs for this approach:

1. Monitor multiple Flink jobs
2. Join on multiple topics related with aggregates required for a rule which might lead to forever wait in case of failure scenarios